1

I am writing an open source python tool aimed at inventoring/auditing and hardening of a system. When I started off with the project, I did some research around it and figured out that there were not many tools (at least open source) that did that (I would later come to realize that apparently I was wrong)

As of now I have written the core of the system which has the following features:

  1. It is going to be open source
  2. It is plugin based. Plugins are again written in python
  3. It is not going to install any agents/binaries on the remote machine/s
  4. It is going to provide visualization on top of the data collected and analysis done
  5. It is going to generate Ansible cookbooks to facilitate admins to use it directly to fix the system (if they wanted to use it at all that is)
  6. Capabilities of the system depend on the plugins's capabilities
  7. As of now the tool is limited to Linux alone, but there are plans to expand it to other platforms as well.

I already knew about Lynis, before I started writing the tool and it looked like Lynis missed in a few small areas that I could improve on. Hence, I went ahead to write this tool.

Now after I have written most of the part of this tool, I get to realize that there is Nessus which already does something similar. And now I am rethinking if at all it makes sense to write this tool, is it really solving a problem or have I just wasted time reinventing the wheel (once again).

I however found this comparison of Lynis and Nessus, by the author of Lynis itself, and am not really convinced as to how is it different from what Nessus already does (not that I am a fan of Nessus or anything)

So here is what I actually want to know : Does it really make sense to write another OS hardening tool like the one with the capabilities above ? Or would it actually make more sense to simply scrape the project now ??

Improve this question
5
  • Qualys, OpenVAS, Nexpose, I could keep going. They all have the same features you list. (only OpenVAS is open source)
    – schroeder ♦
    Commented May 15, 2017 at 12:02
  • When it comes to this sort of tool, it's not always important that it is open source, but that it works. As a fan of open source, it would certainly not sway me to go with an open project over a closed one if it did what I needed it to do.
    – schroeder ♦
    Commented May 15, 2017 at 12:04
  • How would you keep up to date on vulnerabilities? That's where the cost comes in (daily creation of new 'ansible' cookbooks to address latest vulns).
    – schroeder ♦
    Commented May 15, 2017 at 12:06
  • I am planning on using CVE_Search to keep up with vulns, in addition to any more sources that I can consume over time. And thanks for your thoughts above. In fact I agree with most of it. However, I think I am still looking for the answer to whether the tool makes sense or not.
    – qre0ct
    Commented May 15, 2017 at 15:08
  • To add on to these, Nessus is not open sourced, you need to buy licenses from Tenable to run nessus scans on your network.
    – perfecto25
    Commented Feb 11, 2019 at 18:43

1 Answer 1

Reset to default
6

Author of Lynis here. Nessus is vulnerability scanning, Lynis is system auditing with some overlap in vulnerability discovery.

I'm curious why you want to start a new project. So let me answer by sharing some background about the Lynis project: The project is almost 10 years old. It got a lot of iterations to improve the tool to where it is now. More importantly, it is still open source and receives regular updates. The amount of work that goes into an open source project can be overwhelming. Especially keeping it up-to-date, the questions your users will ask, the promotion needed, etc. etc. I'm the first to say "go write your own", but I learned along the way that the maintenance burden is a serious one to consider.

So let me rephrase the question above: why not become part of the ecosystem and contribute, create add-ons, join efforts?

If you like, I happily make time available to discuss (by email, chat, or even phone). The world needs quality (the best possible tools), not quantity (many average tools) :)

Improve this answer
3
  • 1
    Amazing. Thanks. Although Lynis is open source and a pretty good one, I was curious to know if it has an option to remotely audit and esp. without actually installing an agent etc. That's where I thought I could write something that catered to this requirement of mine, and hence the above project. Let me connect with you over an email for further discussions.
    – qre0ct
    Commented May 15, 2017 at 16:12
  • 2
    Hey and a big shout-out to @Michael-Boelen, a great tool you gifted the community there! I'm currently writing a tool-asessment comparison between OpenVAS/Nessus and Lynis. Im struggling a little with the details; you mentioned that Lynis is a system auditing tool while nessus is a vulnerability scanner - with some overlapment. What exactly is the overlapment? What would you consider the biggest differnce? What are advantages of Lynis, what are drawbacks - compared to OpenVas/Nessus? thank you, Jasper
    – Gewure
    Commented Jul 31, 2017 at 9:19
  • The main difference is host-based versus network scanning. The overlap is that both tools help with some compliance, some configuration management best practices. Advantages of Lynis: you can see what it does. It runs on system, so it can find more details than just looking from network. Installation is optional, root permissions are optional as well. But you have still to run something on the system (which might be a drawback, as sometimes you may not have access).
    – Michael Boelen
    Commented Aug 7, 2017 at 10:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .