Are there any good tools that can be used for Security auditing of Redhat Linux. That can audit all the critical areas of System and provide the detailed output of all the audited sections.

  • No automatic tool or group of tools is 100% inclusive, computers are designed as generic computing machines, this allows one to run ones own programs and services, run custom servers listening on various ports. Meanwhile, new attacks and methods are constantly being invented.
    – ewanm89
    Jan 5, 2013 at 10:12
  • 1
    Came across this question, but didn't see my tool Lynis mentioned. Open source and not limited to Red Hat only. Oct 10, 2013 at 9:03
  • Just tried this, I quite like it!
    – DarkMantis
    Oct 10, 2013 at 9:27

2 Answers 2


Free automated assessment tools are notoriously missing. Historically we had Bastille, which was reasonably not terrible, it also hasn't been updated since 2008 and doesn't support any of the EL releases of RedHat. Currently we do have Tiger, which requires a fair bit of configuration to be properly useful. It is also infrequently updated, the current release being from 2010, but it does provide some baseline usefulness.

In any event, in order to audit a system, you must first know what you're going to audit against. So pick a standard that fits for your environment (both technically and business process) and start using it. Depending on which standard you pick there may be assessment tools available. For example, if you are a CIS member then you can use the CIS-CAT tool to audit systems against their standards. If you are a Nessus Pro Feed customer then you can use their auditing system to test a system against a number of standards including CIS and DISA STIGS.

Configuration auditing isn't necessarily easy, and will likely require some capital outlay, but it is a necessary step if you're going to claim to use a standard.

If you are unable, or unwilling, to lay out money for an automated tool the next best step is to perform a manual assessment. I wouldn't recommend if, but if you do, I would start with these steps:

  1. Pick a standard.
  2. Thoroughly read the standard and compare it against your environment and business needs.
  3. Throw out the changes that are unnecessary or aren't worth implementing (for whatever reason).
  4. Convert the remaining items to a checklist.
  5. For each checklist item determine a testing method to determine if the particular item has been completed.
  6. Compare your system against the checklist and make sure everything has been addressed.
  • Thank you @Scott Pack for providing indepth information. Ok i will check CIS-CAT and TIGER. CIS-CAT provides 30 days free trial and so i will give it a try
    – OmiPenguin
    Jan 6, 2013 at 12:40
  • @UmairMustafa: Keep in mind that the CIS-CAT tool will validate against the relevant CIS benchmark. Their standards are freely available, but the OS ones are pretty in-depth. Make sure to review the document first, because depending on your workload it could easily take more than 30 days to configure a baseline system against it.
    – Scott Pack
    Jan 6, 2013 at 14:55
  • Thanks for giving me a head start. I will read the document first now and will implement on test server first. I will come back to you later for further help.
    – OmiPenguin
    Jan 6, 2013 at 15:05

You can also use external tools like Lynis

It offer a free analysis and told you the points that you can improve the Hardening Security Level.

With that tools I have performed true improvement on RHEL7.3 OpenBSD FreeBSD ArchLinux and Debian

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .