Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Are there any good tools that can be used for Security auditing of Redhat Linux. That can audit all the critical areas of System and provide the detailed output of all the audited sections.

share|improve this question
    
No automatic tool or group of tools is 100% inclusive, computers are designed as generic computing machines, this allows one to run ones own programs and services, run custom servers listening on various ports. Meanwhile, new attacks and methods are constantly being invented. –  ewanm89 Jan 5 '13 at 10:12
    
Came across this question, but didn't see my tool Lynis mentioned. Open source and not limited to Red Hat only. –  Michael Boelen Oct 10 '13 at 9:03
    
Just tried this, I quite like it! –  DarkMantis Oct 10 '13 at 9:27
add comment

1 Answer

Free automated assessment tools are notoriously missing. Historically we had Bastille, which was reasonably not terrible, it also hasn't been updated since 2008 and doesn't support any of the EL releases of RedHat. Currently we do have Tiger, which requires a fair bit of configuration to be properly useful. It is also infrequently updated, the current release being from 2010, but it does provide some baseline usefulness.

In any event, in order to audit a system, you must first know what you're going to audit against. So pick a standard that fits for your environment (both technically and business process) and start using it. Depending on which standard you pick there may be assessment tools available. For example, if you are a CIS member then you can use the CIS-CAT tool to audit systems against their standards. If you are a Nessus Pro Feed customer then you can use their auditing system to test a system against a number of standards including CIS and DISA STIGS.

Configuration auditing isn't necessarily easy, and will likely require some capital outlay, but it is a necessary step if you're going to claim to use a standard.

If you are unable, or unwilling, to lay out money for an automated tool the next best step is to perform a manual assessment. I wouldn't recommend if, but if you do, I would start with these steps:

  1. Pick a standard.
  2. Thoroughly read the standard and compare it against your environment and business needs.
  3. Throw out the changes that are unnecessary or aren't worth implementing (for whatever reason).
  4. Convert the remaining items to a checklist.
  5. For each checklist item determine a testing method to determine if the particular item has been completed.
  6. Compare your system against the checklist and make sure everything has been addressed.
share|improve this answer
    
Thank you @Scott Pack for providing indepth information. Ok i will check CIS-CAT and TIGER. CIS-CAT provides 30 days free trial and so i will give it a try –  OmiPenguin Jan 6 '13 at 12:40
    
@UmairMustafa: Keep in mind that the CIS-CAT tool will validate against the relevant CIS benchmark. Their standards are freely available, but the OS ones are pretty in-depth. Make sure to review the document first, because depending on your workload it could easily take more than 30 days to configure a baseline system against it. –  Scott Pack Jan 6 '13 at 14:55
    
Thanks for giving me a head start. I will read the document first now and will implement on test server first. I will come back to you later for further help. –  OmiPenguin Jan 6 '13 at 15:05
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.