Lynis est un outil open source d'audit de sécurité pour systèmes Unix/Linux, développé par CISOfy. Il analyse la configuration d'une machine et signale les points faibles. Il peut remonter des alertes ou encore des suggestions. Il ne réalise aucune modification et se contente de remonter les observations réalisées durant le scan.
Pour utiliser Lynis, une commande est disponible :
$ lynis audit system
Il est nécessaire d'installer le paquet
lynis.
Il faut exécuter Lynis avec les droits et l'environnement de l'utilisateur
root.
Par défaut, Lynis affiche ses résultats dans la console au fur et à mesure du scan. Ces résultats sont également stockés dans /var/log/ avec les fichiers lynis.log et lynis-report.dat. Ce dernier fichier nous intéresse puisque c'est lui qui contient les données du scan.
Ces données sont exportable sous différent format grâce à https://github.com/d4t4king/lynis-report-converter. En utilisant ce convertisseur. Nous pouvons obtenir par exemple un fichier .xml, comme ci-dessous.
<?xml version="1.0" encoding="UTF-8"?>
<lynisReportData>
<apache_module></apache_module>
<apache_version>&nbsp;</apache_version>
<apparmor_enabled>0</apparmor_enabled>
<apparmor_policy_loaded>0</apparmor_policy_loaded>
<arpwatch_running>0</arpwatch_running>
<audit_daemon_running>0</audit_daemon_running>
<auditor>[Not Specified]</auditor>
<auth_failed_logins_logged>0</auth_failed_logins_logged>
<auth_group_ids_unique>1</auth_group_ids_unique>
<auth_group_names_unique>1</auth_group_names_unique>
<automation_tool_present>0</automation_tool_present>
<available_shells>
<available_shell>/bin/bash</available_shell>
<available_shell>/bin/rbash</available_shell>
<available_shell>/bin/sh</available_shell>
<available_shell>/usr/bin/bash</available_shell>
<available_shell>/usr/bin/dash</available_shell>
<available_shell>/usr/bin/rbash</available_shell>
<available_shell>/usr/bin/sh</available_shell>
</available_shells>
<binaries_count>1003</binaries_count>
<binaries_sgid_count>/usr/bin/chage /usr/bin/crontab /usr/bin/dotlockfile /usr/bin/expiry /usr/bin/ssh-agent /usr/sbin/unix_chkpwd </binaries_sgid_count>
<binaries_suid_count>/usr/bin/chfn /usr/bin/chsh /usr/bin/gpasswd /usr/bin/mailq /usr/bin/mount /usr/bin/newaliases /usr/bin/newgrp /usr/bin/passwd /usr/bin/sg /usr/bin/su /usr/bin/sudo /usr/bin/sudoedit /usr/bin/umount /usr/sbin/exim /usr/sbin/exim4 /usr/sbin/rmail /usr/sbin/rsmtp /usr/sbin/runq /usr/sbin/sendmail </binaries_suid_count>
<binary_paths>/usr/bin,/usr/sbin,/usr/local/bin,/usr/local/sbin</binary_paths>
<boot_loader>GRUB2</boot_loader>
<boot_services>
<boot_service>anacron</boot_service>
<boot_service>apparmor</boot_service>
<boot_service>blk-availability</boot_service>
<boot_service>bluetooth</boot_service>
<boot_service>console-setup</boot_service>
<boot_service>cron</boot_service>
<boot_service>e2scrub_reap</boot_service>
<boot_service>exim4</boot_service>
<boot_service>getty@</boot_service>
<boot_service>grub-common</boot_service>
<boot_service>keyboard-setup</boot_service>
<boot_service>lvm2-monitor</boot_service>
<boot_service>networking</boot_service>
<boot_service>ssh</boot_service>
<boot_service>sshd-keygen</boot_service>
<boot_service>systemd-pstore</boot_service>
<boot_service>systemd-timesyncd</boot_service>
<boot_service>wpa_supplicant</boot_service>
<boot_service>wtmpdb-update-boot</boot_service>
</boot_services>
<boot_service_tool>systemctl</boot_service_tool>
<boot_uefi_booted>1</boot_uefi_booted>
<boot_uefi_booted_secure>0</boot_uefi_booted_secure>
<certificates>
<certificate>/etc/ssl/certs/ca-certificates.crt|0|cn:ACCVRAIZ1;notafter:Dec 31 09:37:37 2030 GMT;|</certificate>
</certificates>
<certificates>0</certificates>
<compiler></compiler>
<compiler_installed>0</compiler_installed>
<container>0</container>
<cpu_nx>1</cpu_nx>
<cpu_pae>1</cpu_pae>
<crond_running>1</crond_running>
<cronjobs>
<cronjob>/etc/cron.d/anacron</cronjob>
<cronjob>/etc/cron.d/debsecan</cronjob>
<cronjob>/etc/cron.d/e2scrub_all</cronjob>
<cronjob>/etc/cron.daily/0anacron</cronjob>
<cronjob>/etc/cron.daily/apt-compat</cronjob>
<cronjob>/etc/cron.daily/dpkg</cronjob>
<cronjob>/etc/cron.daily/exim4-base</cronjob>
<cronjob>/etc/cron.daily/logrotate</cronjob>
<cronjob>/etc/cron.daily/man-db</cronjob>
<cronjob>/etc/cron.monthly/0anacron</cronjob>
<cronjob>/etc/cron.weekly/0anacron</cronjob>
<cronjob>/etc/cron.weekly/man-db</cronjob>
<cronjob>1,5,cron.daily,run-parts,--report,/etc/cron.daily</cronjob>
<cronjob>17,*,*,*,*,root,cd,/,&&,run-parts,--report,/etc/cron.hourly</cronjob>
<cronjob>25,6,*,*,*,root,test,-x,/usr/sbin/anacron,||,{,cd,/,&&,run-parts,--report,/etc/cron.daily;,}</cronjob>
<cronjob>47,6,*,*,7,root,test,-x,/usr/sbin/anacron,||,{,cd,/,&&,run-parts,--report,/etc/cron.weekly;,}</cronjob>
<cronjob>52,6,1,*,*,root,test,-x,/usr/sbin/anacron,||,{,cd,/,&&,run-parts,--report,/etc/cron.monthly;,}</cronjob>
<cronjob>7,10,cron.weekly,run-parts,--report,/etc/cron.weekly</cronjob>
<cronjob>@monthly,15,cron.monthly,run-parts,--report,/etc/cron.monthly</cronjob>
<cronjob>@yearly,20,cron.yearly,run-parts,--report,/etc/cron.yearly</cronjob>
</cronjobs>
<deleted_file></deleted_file>
<details>
<detail id="KRNL-6000" service="sysctl" description="desc:Disable loading of TTY line disciplines;field:dev.tty.ldisc_autoload;prefval:0;value:1;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Disable magic SysRQ;field:kernel.sysrq;prefval:0;value:438;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Disable process tracing for everyone;field:kernel.yama.ptrace_scope;prefval:1 2 3;value:0;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Disable/Ignore ICMP routing redirects;field:net.ipv4.conf.all.accept_redirects;prefval:0;value:1;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Disable/Ignore ICMP routing redirects;field:net.ipv4.conf.all.send_redirects;prefval:0;value:1;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Disable/Ignore ICMP routing redirects;field:net.ipv4.conf.default.accept_redirects;prefval:0;value:1;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Disable/Ignore ICMP routing redirects;field:net.ipv6.conf.all.accept_redirects;prefval:0;value:1;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Disable/Ignore ICMP routing redirects;field:net.ipv6.conf.default.accept_redirects;prefval:0;value:1;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Enforce ingress/egress filtering for packets;field:net.ipv4.conf.all.rp_filter;prefval:1;value:0;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Hardened BPF JIT compilation;field:net.core.bpf_jit_harden;prefval:2;value:0;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Log all packages for which the host does not have a path back to the source;field:net.ipv4.conf.all.log_martians;prefval:1;value:0;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Log all packages for which the host does not have a path back to the source;field:net.ipv4.conf.default.log_martians;prefval:1;value:0;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Restrict BPF for unprivileged users;field:kernel.unprivileged_bpf_disabled;prefval:1;value:2;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Restrict FIFO special device creation behavior;field:fs.protected_fifos;prefval:2;value:1;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Restrict access to kernel symbols;field:kernel.kptr_restrict;prefval:2;value:0;" />
<detail id="KRNL-6000" service="sysctl" description="desc:Restrict module loading once this sysctl value is loaded;field:kernel.modules_disabled;prefval:1;value:0;" />
<detail id="SSH-7408" service="sshd" description="desc:sshd option AllowAgentForwarding;field:AllowAgentForwarding;prefval:NO;value:YES;" />
<detail id="SSH-7408" service="sshd" description="desc:sshd option AllowTcpForwarding;field:AllowTcpForwarding;prefval:NO;value:YES;" />
<detail id="SSH-7408" service="sshd" description="desc:sshd option ClientAliveCountMax;field:ClientAliveCountMax;prefval:2;value:3;" />
<detail id="SSH-7408" service="sshd" description="desc:sshd option LogLevel;field:LogLevel;prefval:VERBOSE;value:INFO;" />
<detail id="SSH-7408" service="sshd" description="desc:sshd option MaxAuthTries;field:MaxAuthTries;prefval:3;value:6;" />
<detail id="SSH-7408" service="sshd" description="desc:sshd option MaxSessions;field:MaxSessions;prefval:2;value:10;" />
<detail id="SSH-7408" service="sshd" description="desc:sshd option Port;field:Port;prefval:;value:22;" />
<detail id="SSH-7408" service="sshd" description="desc:sshd option TCPKeepAlive;field:TCPKeepAlive;prefval:NO;value:YES;" />
<detail id="SSH-7408" service="sshd" description="desc:sshd option X11Forwarding;field:X11Forwarding;prefval:NO;value:YES;" />
</details>
<dhcp_client_running>1</dhcp_client_running>
<domainname>eduroam.univ-ubs.fr</domainname>
<encryption></encryption>
<expired_certificate></expired_certificate>
<fail2ban_config>&nbsp;</fail2ban_config>
<fail2ban_enabled_service></fail2ban_enabled_service>
<file_systems_exts>
<file_systems_ext>/boot|ext4|</file_systems_ext>
<file_systems_ext>/|ext4|</file_systems_ext>
</file_systems_exts>
<finish>true</finish>
<firewall_active>1</firewall_active>
<firewall_empty_ruleset>1</firewall_empty_ruleset>
<firewall_installed>1</firewall_installed>
<firewall_softwares>
<firewall_software>iptables</firewall_software>
<firewall_software>nftables</firewall_software>
</firewall_softwares>
<framework_grsecurity>0</framework_grsecurity>
<framework_selinux>0</framework_selinux>
<hardening_index>63</hardening_index>
<home_directories>
<home_directory>/</home_directory>
<home_directory>/bin</home_directory>
<home_directory>/dev</home_directory>
<home_directory>/home/user</home_directory>
<home_directory>/root</home_directory>
<home_directory>/run/sshd</home_directory>
<home_directory>/usr/games</home_directory>
<home_directory>/usr/lib/dhcpcd</home_directory>
<home_directory>/usr/sbin</home_directory>
<home_directory>/var/backups</home_directory>
<home_directory>/var/cache/man</home_directory>
<home_directory>/var/mail</home_directory>
<home_directory>/var/spool/exim4</home_directory>
</home_directories>
<hostid>36ab43ddc19f0e2ada2ecab50981503d69edd4c4</hostid>
<hostid2>098fa34cba1f2987899a3f55c0efdb9601b95dd3b55541fe0cad955dbdd5e783</hostid2>
<hostname>debian</hostname>
<ids_ips_tooling></ids_ips_tooling>
<imap_daemon>&nbsp;</imap_daemon>
<installed_kernel_packages>2</installed_kernel_packages>
<installed_packages>405</installed_packages>
<installed_packages>
<installed_package name="|adduser" version="3.152|alsa-topology-conf" />
</installed_packages>
<ipv6_mode>auto</ipv6_mode>
<ipv6_only>0</ipv6_only>
<journal_coredumps_lastday>&nbsp;</journal_coredumps_lastday>
<journal_disk_size>&nbsp;</journal_disk_size>
<journal_meta_data>&nbsp;</journal_meta_data>
<kernel_entropy>256</kernel_entropy>
<ldap_auth_enabled>0</ldap_auth_enabled>
<ldap_pam_enabled>0</ldap_pam_enabled>
<license_key>&nbsp;</license_key>
<linux_auditd_running>0</linux_auditd_running>
<linux_config_file>/boot/config-6.12.111+deb13-amd64</linux_config_file>
<linux_default_runlevel>5</linux_default_runlevel>
<linux_kernel_io_scheduler></linux_kernel_io_scheduler>
<linux_kernel_release>6.12.111+deb13-amd64</linux_kernel_release>
<linux_kernel_type>modular</linux_kernel_type>
<linux_kernel_version>#1 SMP PREEMPT_DYNAMIC Debian 6.12.111-1 (2026-09-28)</linux_kernel_version>
<linux_version>Debian</linux_version>
<loaded_kernel_modules>
<loaded_kernel_module>8021q</loaded_kernel_module>
<loaded_kernel_module>ac</loaded_kernel_module>
<loaded_kernel_module>ac97_bus</loaded_kernel_module>
<loaded_kernel_module>aesni_intel</loaded_kernel_module>
<loaded_kernel_module>ahci</loaded_kernel_module>
<loaded_kernel_module>ata_generic</loaded_kernel_module>
<loaded_kernel_module>ata_piix</loaded_kernel_module>
<loaded_kernel_module>autofs4</loaded_kernel_module>
<loaded_kernel_module>battery</loaded_kernel_module>
<loaded_kernel_module>binfmt_misc</loaded_kernel_module>
<loaded_kernel_module>button</loaded_kernel_module>
<loaded_kernel_module>cdrom</loaded_kernel_module>
<loaded_kernel_module>cfg80211</loaded_kernel_module>
<loaded_kernel_module>configfs</loaded_kernel_module>
<loaded_kernel_module>crc16</loaded_kernel_module>
<loaded_kernel_module>crc32_pclmul</loaded_kernel_module>
<loaded_kernel_module>crc32c_generic</loaded_kernel_module>
<loaded_kernel_module>crc32c_intel</loaded_kernel_module>
<loaded_kernel_module>crct10dif_pclmul</loaded_kernel_module>
<loaded_kernel_module>cryptd</loaded_kernel_module>
<loaded_kernel_module>crypto_simd</loaded_kernel_module>
<loaded_kernel_module>dm_crypt</loaded_kernel_module>
<loaded_kernel_module>dm_mod</loaded_kernel_module>
<loaded_kernel_module>drm</loaded_kernel_module>
<loaded_kernel_module>drm_kms_helper</loaded_kernel_module>
<loaded_kernel_module>drm_ttm_helper</loaded_kernel_module>
<loaded_kernel_module>e1000</loaded_kernel_module>
<loaded_kernel_module>efi_pstore</loaded_kernel_module>
<loaded_kernel_module>efivarfs</loaded_kernel_module>
<loaded_kernel_module>ehci_hcd</loaded_kernel_module>
<loaded_kernel_module>ehci_pci</loaded_kernel_module>
<loaded_kernel_module>evdev</loaded_kernel_module>
<loaded_kernel_module>ext4</loaded_kernel_module>
<loaded_kernel_module>fat</loaded_kernel_module>
<loaded_kernel_module>garp</loaded_kernel_module>
<loaded_kernel_module>gf128mul</loaded_kernel_module>
<loaded_kernel_module>ghash_clmulni_intel</loaded_kernel_module>
<loaded_kernel_module>hid</loaded_kernel_module>
<loaded_kernel_module>hid_generic</loaded_kernel_module>
<loaded_kernel_module>i2c_piix4</loaded_kernel_module>
<loaded_kernel_module>i2c_smbus</loaded_kernel_module>
<loaded_kernel_module>inet_diag</loaded_kernel_module>
<loaded_kernel_module>intel_pmc_core</loaded_kernel_module>
<loaded_kernel_module>intel_rapl_common</loaded_kernel_module>
<loaded_kernel_module>intel_rapl_msr</loaded_kernel_module>
<loaded_kernel_module>intel_uncore_frequency_common</loaded_kernel_module>
<loaded_kernel_module>intel_vsec</loaded_kernel_module>
<loaded_kernel_module>ip_tables</loaded_kernel_module>
<loaded_kernel_module>jbd2</loaded_kernel_module>
<loaded_kernel_module>joydev</loaded_kernel_module>
<loaded_kernel_module>libahci</loaded_kernel_module>
<loaded_kernel_module>libata</loaded_kernel_module>
<loaded_kernel_module>libcrc32c</loaded_kernel_module>
<loaded_kernel_module>llc</loaded_kernel_module>
<loaded_kernel_module>mbcache</loaded_kernel_module>
<loaded_kernel_module>mrp</loaded_kernel_module>
<loaded_kernel_module>nf_tables</loaded_kernel_module>
<loaded_kernel_module>nfnetlink</loaded_kernel_module>
<loaded_kernel_module>nls_ascii</loaded_kernel_module>
<loaded_kernel_module>nls_cp437</loaded_kernel_module>
<loaded_kernel_module>ohci_hcd</loaded_kernel_module>
<loaded_kernel_module>ohci_pci</loaded_kernel_module>
<loaded_kernel_module>pcspkr</loaded_kernel_module>
<loaded_kernel_module>pmt_class</loaded_kernel_module>
<loaded_kernel_module>pmt_telemetry</loaded_kernel_module>
<loaded_kernel_module>psmouse</loaded_kernel_module>
<loaded_kernel_module>rapl</loaded_kernel_module>
<loaded_kernel_module>rfkill</loaded_kernel_module>
<loaded_kernel_module>scsi_common</loaded_kernel_module>
<loaded_kernel_module>scsi_mod</loaded_kernel_module>
<loaded_kernel_module>sd_mod</loaded_kernel_module>
<loaded_kernel_module>serio_raw</loaded_kernel_module>
<loaded_kernel_module>sg</loaded_kernel_module>
<loaded_kernel_module>sha1_ssse3</loaded_kernel_module>
<loaded_kernel_module>sha256_ssse3</loaded_kernel_module>
<loaded_kernel_module>sha512_ssse3</loaded_kernel_module>
<loaded_kernel_module>snd</loaded_kernel_module>
<loaded_kernel_module>snd_ac97_codec</loaded_kernel_module>
<loaded_kernel_module>snd_intel8x0</loaded_kernel_module>
<loaded_kernel_module>snd_pcm</loaded_kernel_module>
<loaded_kernel_module>snd_timer</loaded_kernel_module>
<loaded_kernel_module>soundcore</loaded_kernel_module>
<loaded_kernel_module>sr_mod</loaded_kernel_module>
<loaded_kernel_module>stp</loaded_kernel_module>
<loaded_kernel_module>tcp_diag</loaded_kernel_module>
<loaded_kernel_module>ttm</loaded_kernel_module>
<loaded_kernel_module>udp_diag</loaded_kernel_module>
<loaded_kernel_module>usb_common</loaded_kernel_module>
<loaded_kernel_module>usbcore</loaded_kernel_module>
<loaded_kernel_module>usbhid</loaded_kernel_module>
<loaded_kernel_module>vboxguest</loaded_kernel_module>
<loaded_kernel_module>vfat</loaded_kernel_module>
<loaded_kernel_module>video</loaded_kernel_module>
<loaded_kernel_module>vmw_vmci</loaded_kernel_module>
<loaded_kernel_module>vmw_vsock_virtio_transport_common</loaded_kernel_module>
<loaded_kernel_module>vmw_vsock_vmci_transport</loaded_kernel_module>
<loaded_kernel_module>vmwgfx</loaded_kernel_module>
<loaded_kernel_module>vsock</loaded_kernel_module>
<loaded_kernel_module>vsock_loopback</loaded_kernel_module>
<loaded_kernel_module>wmi</loaded_kernel_module>
<loaded_kernel_module>x_tables</loaded_kernel_module>
</loaded_kernel_modules>
<localhost-mapped-to>::1</localhost-mapped-to>
<log_directorys>
<log_directory>/var/log</log_directory>
<log_directory>/var/log</log_directory>
<log_directory>/var/log/apt</log_directory>
<log_directory>/var/log/exim4</log_directory>
</log_directorys>
<log_file>&nbsp;</log_file>
<log_rotation_config_found>1</log_rotation_config_found>
<log_rotation_tool>logrotate</log_rotation_tool>
<lvm_volumes>
<lvm_volume>root</lvm_volume>
<lvm_volume>swap_1</lvm_volume>
</lvm_volumes>
<lvm_volume_groups>
<lvm_volume_group>debian-vg</lvm_volume_group>
</lvm_volume_groups>
<lynis_tests_done>260</lynis_tests_done>
<lynis_update_available>0</lynis_update_available>
<lynis_version>3.1.4</lynis_version>
<malware_scanner></malware_scanner>
<malware_scanner_installed>0</malware_scanner_installed>
<manuals>
<manual>Make sure an explicit deny all is the default policy for all unmatched traffic</manual>
<manual>Verify all traffic is filtered the right way between the different security zones</manual>
<manual>Verify if a list is available with all required services</manual>
<manual>Verify if there is a formal process for testing and applying firewall rules</manual>
</manuals>
<manual_event></manual_event>
<memory_size>3995652</memory_size>
<memory_units>kB</memory_units>
<name_cache_used>0</name_cache_used>
<nameservers>
<nameserver>10.0.2.3</nameserver>
</nameservers>
<network_interfaces>
<network_interface>enp0s3</network_interface>
<network_interface>lo</network_interface>
</network_interfaces>
<network_ipv4_addresss>
<network_ipv4_address>10.0.2.15</network_ipv4_address>
<network_ipv4_address>127.0.0.1</network_ipv4_address>
</network_ipv4_addresss>
<network_ipv6_addresss>
<network_ipv6_address>::1</network_ipv6_address>
<network_ipv6_address>fe80::6f77:4897:dd13:a7d4</network_ipv6_address>
</network_ipv6_addresss>
<network_listens>
<network_listen>raw,ss,v1|tcp|0.0.0.0:22|sshd|</network_listen>
<network_listen>raw,ss,v1|tcp|127.0.0.1:25|exim4|</network_listen>
<network_listen>raw,ss,v1|tcp|[::1]:25|exim4|</network_listen>
<network_listen>raw,ss,v1|tcp|[::]:22|sshd|</network_listen>
<network_listen>raw,ss,v1|udp|10.0.2.15:68|dhcpcd|</network_listen>
<network_listen>raw,ss,v1|udp|[fe80::6f77:4897:dd13:a7d4]%enp0s3:546|dhcpcd|</network_listen>
</network_listens>
<network_mac_address></network_mac_address>
<nft_version>1.1.3</nft_version>
<nginx_config_option></nginx_config_option>
<nginx_main_conf_file>&nbsp;</nginx_main_conf_file>
<nginx_sub_conf_file></nginx_sub_conf_file>
<non_encrypted_swap></non_encrypted_swap>
<notebook>0</notebook>
<ntp_config_file></ntp_config_file>
<ntp_config_found>0</ntp_config_found>
<ntp_config_type_daemon>1</ntp_config_type_daemon>
<ntp_config_type_eventbased>0</ntp_config_type_eventbased>
<ntp_config_type_scheduled>0</ntp_config_type_scheduled>
<ntp_config_type_startup>0</ntp_config_type_startup>
<ntp_daemon>systemd-timesyncd</ntp_daemon>
<ntp_daemon_running>1</ntp_daemon_running>
<ntp_unreliable_peer></ntp_unreliable_peer>
<ntp_version>&nbsp;</ntp_version>
<openssh_daemon_running>1</openssh_daemon_running>
<os>Linux</os>
<os_fullname>Debian GNU/Linux 13 (trixie)</os_fullname>
<os_kernel_version>6.12.111+deb13</os_kernel_version>
<os_kernel_version_full>6.12.111+deb13-amd64</os_kernel_version_full>
<os_name>Debian</os_name>
<os_version>13</os_version>
<package_audit_tool>apt-get</package_audit_tool>
<package_audit_tool_found>1</package_audit_tool_found>
<package_manager></package_manager>
<pam_auth_brute_force_protection_module></pam_auth_brute_force_protection_module>
<pam_modules>
<pam_module>/lib/x86_64-linux-gnu/security/pam_access.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_canonicalize_user.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_debug.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_deny.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_echo.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_env.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_exec.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_faildelay.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_faillock.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_filter.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_ftp.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_group.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_issue.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_keyinit.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_limits.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_listfile.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_localuser.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_loginuid.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_mail.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_mkhomedir.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_motd.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_namespace.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_nologin.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_permit.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_pwhistory.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_rhosts.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_rootok.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_securetty.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_selinux.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_sepermit.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_setquota.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_shells.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_stress.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_succeed_if.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_systemd.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_systemd_loadkey.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_time.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_timestamp.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_tty_audit.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_umask.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_unix.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_userdb.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_usertype.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_warn.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_wheel.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_wtmpdb.so</pam_module>
<pam_module>/lib/x86_64-linux-gnu/security/pam_xauth.so</pam_module>
</pam_modules>
<pam_pwquality>&nbsp;</pam_pwquality>
<password_max_days>-1</password_max_days>
<password_min_days>-1</password_min_days>
<plugin_directory>/etc/lynis/plugins</plugin_directory>
<plugin_enabled_phase1s>
<plugin_enabled_phase1>debian|1.0.1|</plugin_enabled_phase1>
</plugin_enabled_phase1s>
<plugin_firewall_iptables_list>&nbsp;</plugin_firewall_iptables_list>
<plugin_processes_allprocesses>&nbsp;</plugin_processes_allprocesses>
<plugins_enabled>1</plugins_enabled>
<pop3_daemon>&nbsp;</pop3_daemon>
<printing_daemon>&nbsp;</printing_daemon>
<real_users>
<real_user uid="0">root</real_user>
<real_user uid="1000">user</real_user>
</real_users>
<remote_syslog_configured>0</remote_syslog_configured>
<report_datetime_end>2026-10-07 12:24:48</report_datetime_end>
<report_datetime_start>2026-10-07 12:23:15</report_datetime_start>
<report_version_major>1</report_version_major>
<report_version_minor>0</report_version_minor>
<resolv_conf_domain>eduroam.univ-ubs.fr</resolv_conf_domain>
<resolv_conf_search_domain></resolv_conf_search_domain>
<rng_found>0</rng_found>
<running_services>
<running_service>"NA"</running_service>
<running_service>cron</running_service>
<running_service>dbus</running_service>
<running_service>exim4</running_service>
<running_service>getty@tty1</running_service>
<running_service>ssh</running_service>
<running_service>systemd-journald</running_service>
<running_service>systemd-logind</running_service>
<running_service>systemd-timesyncd</running_service>
<running_service>systemd-udevd</running_service>
<running_service>user@0</running_service>
<running_service>user@1000</running_service>
<running_service>wpa_supplicant</running_service>
</running_services>
<running_service_tool>systemctl</running_service_tool>
<schedulers>
<scheduler>anacron</scheduler>
<scheduler>crond</scheduler>
</schedulers>
<selinux_mode>&nbsp;</selinux_mode>
<selinux_status>0</selinux_status>
<service_manager>systemd</service_manager>
<session_timeout_enabled>0</session_timeout_enabled>
<slow_tests>
<slow_test>CRYP-7902,12.220869</slow_test>
<slow_test>DEB-0001,13.580983</slow_test>
</slow_tests>
<smtp_daemon>exim</smtp_daemon>
<smtp_daemon>exim</smtp_daemon>
<ssh_daemon_running>1</ssh_daemon_running>
<ssl_tls_protocol_enabled></ssl_tls_protocol_enabled>
<suggestions>
<suggestion id="ACCT-9622" description="Enable process accounting" severity="-" f4="-" />
<suggestion id="ACCT-9626" description="Enable sysstat to collect accounting (no results)" severity="-" f4="-" />
<suggestion id="ACCT-9628" description="Enable auditd to collect audit information" severity="-" f4="-" />
<suggestion id="AUTH-9230" description="Configure password hashing rounds in /etc/login.defs" severity="-" f4="-" />
<suggestion id="AUTH-9262" description="Install a PAM module for password strength testing like pam_cracklib or pam_passwdqc or libpam-passwdqc" severity="-" f4="-" />
<suggestion id="AUTH-9282" description="When possible set expire dates for all password protected accounts" severity="-" f4="-" />
<suggestion id="AUTH-9286" description="Configure maximum password age in /etc/login.defs" severity="-" f4="-" />
<suggestion id="AUTH-9286" description="Configure minimum password age in /etc/login.defs" severity="-" f4="-" />
<suggestion id="AUTH-9328" description="Default umask in /etc/login.defs could not be found and defaults usually to 022, which could be more strict like 027" severity="-" f4="-" />
<suggestion id="BANN-7126" description="Add a legal banner to /etc/issue, to warn unauthorized users" severity="-" f4="-" />
<suggestion id="BANN-7130" description="Add legal banner to /etc/issue.net, to warn unauthorized users" severity="-" f4="-" />
<suggestion id="BOOT-5122" description="Set a password on GRUB boot loader to prevent altering boot configuration (e.g. boot in single user mode without password)" severity="-" f4="-" />
<suggestion id="BOOT-5180" description="Determine runlevel and services at startup" severity="-" f4="-" />
<suggestion id="BOOT-5264" description="Consider hardening system services" severity="Run '/usr/bin/systemd-analyze security SERVICE' for each service" f4="-" />
<suggestion id="DEB-0280" description="Install libpam-tmpdir to set $TMP and $TMPDIR for PAM sessions" severity="-" f4="-" />
<suggestion id="DEB-0810" description="Install apt-listbugs to display a list of critical bugs prior to each APT installation." severity="-" f4="-" />
<suggestion id="DEB-0831" description="Install needrestart, alternatively to debian-goodies, so that you can run needrestart after upgrades to determine which daemons are using old versions of libraries and need restarting." severity="-" f4="-" />
<suggestion id="DEB-0880" description="Install fail2ban to automatically ban hosts that commit multiple authentication errors." severity="-" f4="-" />
<suggestion id="FILE-6310" description="To decrease the impact of a full /home file system, place /home on a separate partition" severity="-" f4="-" />
<suggestion id="FILE-6310" description="To decrease the impact of a full /var file system, place /var on a separate partition" severity="-" f4="-" />
<suggestion id="FILE-7524" description="Consider restricting file permissions" severity="See screen output or log file" f4="text:Use chmod to change file permissions" />
<suggestion id="FINT-4350" description="Install a file integrity tool to monitor changes to critical and sensitive files" severity="-" f4="-" />
<suggestion id="HRDN-7230" description="Harden the system by installing at least one malware scanner, to perform periodic file system scans" severity="-" f4="Install a tool like rkhunter, chkrootkit, OSSEC, Wazuh" />
<suggestion id="KRNL-6000" description="One or more sysctl values differ from the scan profile and could be tweaked" severity="" f4="Change sysctl value or disable test (skip-test=KRNL-6000:<sysctl-key>)" />
<suggestion id="LOGG-2154" description="Enable logging to an external logging host for archiving purposes and additional protection" severity="-" f4="-" />
<suggestion id="LYNIS" description="This release is more than 4 months old. Check the website or GitHub to see if there is an update available." severity="-" f4="-" />
<suggestion id="NETW-2704" description="Check connection to this nameserver and make sure no outbound DNS queries are blocked (port 53 UDP and TCP)." severity="-" f4="-" />
<suggestion id="NETW-2705" description="Check your resolv.conf file and fill in a backup nameserver if possible" severity="-" f4="-" />
<suggestion id="NETW-3200" description="Determine if protocol 'dccp' is really needed on this system" severity="-" f4="-" />
<suggestion id="NETW-3200" description="Determine if protocol 'rds' is really needed on this system" severity="-" f4="-" />
<suggestion id="NETW-3200" description="Determine if protocol 'sctp' is really needed on this system" severity="-" f4="-" />
<suggestion id="NETW-3200" description="Determine if protocol 'tipc' is really needed on this system" severity="-" f4="-" />
<suggestion id="PKGS-7370" description="Install debsums utility for the verification of packages with known good database." severity="-" f4="-" />
<suggestion id="PKGS-7394" description="Install package apt-show-versions for patch management purposes" severity="-" f4="-" />
<suggestion id="PKGS-7420" description="Consider using a tool to automatically apply upgrades" severity="-" f4="-" />
<suggestion id="SSH-7408" description="Consider hardening SSH configuration" severity="AllowAgentForwarding (set YES to NO)" f4="-" />
<suggestion id="SSH-7408" description="Consider hardening SSH configuration" severity="AllowTcpForwarding (set YES to NO)" f4="-" />
<suggestion id="SSH-7408" description="Consider hardening SSH configuration" severity="ClientAliveCountMax (set 3 to 2)" f4="-" />
<suggestion id="SSH-7408" description="Consider hardening SSH configuration" severity="LogLevel (set INFO to VERBOSE)" f4="-" />
<suggestion id="SSH-7408" description="Consider hardening SSH configuration" severity="MaxAuthTries (set 6 to 3)" f4="-" />
<suggestion id="SSH-7408" description="Consider hardening SSH configuration" severity="MaxSessions (set 10 to 2)" f4="-" />
<suggestion id="SSH-7408" description="Consider hardening SSH configuration" severity="Port (set 22 to )" f4="-" />
<suggestion id="SSH-7408" description="Consider hardening SSH configuration" severity="TCPKeepAlive (set YES to NO)" f4="-" />
<suggestion id="SSH-7408" description="Consider hardening SSH configuration" severity="X11Forwarding (set YES to NO)" f4="-" />
<suggestion id="STRG-1846" description="Disable drivers like firewire storage when not used, to prevent unauthorized storage or data theft" severity="-" f4="-" />
<suggestion id="TOOL-5002" description="Determine if automation tools are present for system management" severity="-" f4="-" />
<suggestion id="USB-1000" description="Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft" severity="-" f4="-" />
</suggestions>
<swap_partitions>
<swap_partition>/dev/mapper/debian--vg-swap_1,/dev/mapper/debian--vg-swap_1,</swap_partition>
</swap_partitions>
<syslog_daemons>
<syslog_daemon>systemd-journal</syslog_daemon>
</syslog_daemons>
<syslog_daemon_present>1</syslog_daemon_present>
<systemd>1</systemd>
<systemd_builtin_components>&nbsp;</systemd_builtin_components>
<systemd_service_not_found></systemd_service_not_found>
<systemd_status>&nbsp;</systemd_status>
<systemd_unit_file></systemd_unit_file>
<systemd_unit_not_found></systemd_unit_not_found>
<systemd_version>&nbsp;</systemd_version>
<test_category>all</test_category>
<test_group>all</test_group>
<tz_variable_empty>1</tz_variable_empty>
<unattended_upgrade_option_available>1</unattended_upgrade_option_available>
<uncommon_network_protocol_enableds>
<uncommon_network_protocol_enabled>dccp</uncommon_network_protocol_enabled>
<uncommon_network_protocol_enabled>rds</uncommon_network_protocol_enabled>
<uncommon_network_protocol_enabled>sctp</uncommon_network_protocol_enabled>
<uncommon_network_protocol_enabled>tipc</uncommon_network_protocol_enabled>
</uncommon_network_protocol_enableds>
<uptime_in_days>0</uptime_in_days>
<uptime_in_seconds>7292</uptime_in_seconds>
<usb_authorized_default_devices>
<usb_authorized_default_device>/sys/bus/usb/devices/usb1</usb_authorized_default_device>
<usb_authorized_default_device>/sys/bus/usb/devices/usb2</usb_authorized_default_device>
</usb_authorized_default_devices>
<usb_authorized_devices>
<usb_authorized_device>/sys/bus/usb/devices/usb1</usb_authorized_device>
<usb_authorized_device>/sys/bus/usb/devices/usb2</usb_authorized_device>
</usb_authorized_devices>
<valid_certificate></valid_certificate>
<vm>1</vm>
<vmtype>virtualbox</vmtype>
<vulnerable_package></vulnerable_package>
<vulnerable_packages_found>0</vulnerable_packages_found>
<warnings>
<warning id="NETW-2704" description="Nameserver 10.0.2.3 does not respond" severity="-" f4="-" />
<warning id="NETW-2705" description="Couldn't find 2 responsive nameservers" severity="-" f4="-" />
</warnings>
<weak_banner_file></weak_banner_file>
</lynisReportData>
Nous pouvons interpréter les résultats comme il suit.
Le scan Lynis de la VM Debian 13 donne un score de 63/100 sur 260 tests, sans paquet vulnérable. Les principaux points faibles sont de haute priorité. Le pare-feu est actif mais son jeu de règles est vide, donc il ne filtre rien. SSH écoute sur toutes les interfaces avec les réglages par défaut (MaxAuthTries à 6, redirections activées). Aucun outil de détection ou de réaction n'est installé : ni fail2ban, ni auditd, ni antimalware, ni contrôle d'intégrité des fichiers. D'autres points sont de priorité moyenne : pas de politique de mots de passe (ni pwquality ni expiration), quinze paramètres sysctl non durcis et AppArmor inactif, donc aucun confinement des processus. Enfin, des points de priorité basse relèvent des bonnes pratiques : GRUB sans mot de passe, pas de bannière légale, umask à 022, protocoles rares chargeables (dccp, sctp, rds, tipc), USB et firewire actifs, /home et /var sur la même partition que le reste du système.
Nombre de ces points seront détaillés dans les pages dédiées aux mesures de renforcement dans l'étude des recommendations de l'ANSSI.