What tools can be use for Security Auditing for Redhat

Question

Are there any good tools that can be used for Security auditing of Redhat Linux. That can audit all the critical areas of System and provide the detailed output of all the audited sections.

Answer 1

Free automated assessment tools are notoriously missing. Historically we had Bastille, which was reasonably not terrible, it also hasn't been updated since 2008 and doesn't support any of the EL releases of RedHat. Currently we do have Tiger, which requires a fair bit of configuration to be properly useful. It is also infrequently updated, the current release being from 2010, but it does provide some baseline usefulness.

In any event, in order to audit a system, you must first know what you're going to audit against. So pick a standard that fits for your environment (both technically and business process) and start using it. Depending on which standard you pick there may be assessment tools available. For example, if you are a CIS member then you can use the CIS-CAT tool to audit systems against their standards. If you are a Nessus Pro Feed customer then you can use their auditing system to test a system against a number of standards including CIS and DISA STIGS.

Configuration auditing isn't necessarily easy, and will likely require some capital outlay, but it is a necessary step if you're going to claim to use a standard.

If you are unable, or unwilling, to lay out money for an automated tool the next best step is to perform a manual assessment. I wouldn't recommend if, but if you do, I would start with these steps:

1. Pick a standard.
2. Thoroughly read the standard and compare it against your environment and business needs.
3. Throw out the changes that are unnecessary or aren't worth implementing (for whatever reason).
4. Convert the remaining items to a checklist.
5. For each checklist item determine a testing method to determine if the particular item has been completed.
6. Compare your system against the checklist and make sure everything has been addressed.