Hardening audits

The security checklist covers what Demerzel reads by itself. An audit tool goes further: Lynis runs hundreds of tests, and OpenSCAP checks a host against a full benchmark such as ANSSI-BP-028 or CIS. Demerzel doesn’t pick the tool for you. It reads the report of the one you prefer and shows it in each server’s Security tab, the same way whatever the tool:

• the score, as the tool gives it (Lynis’s hardening index, OpenSCAP’s XCCDF score), and how it moved over the last runs;
• when it last ran: a report older than 8 days fails the checklist item A hardening audit runs regularly;
• the findings: Lynis’s warnings and suggestions, OpenSCAP’s failed rules. Each one comes with its severity and the tool’s own identifier, linked to the tool’s page for it when there is one.

The agent runs neither tool, because both need root and the agent never has it. You choose how the report reaches it.

Let the agent read your report

Already running Lynis (from cron, by hand)? Point the agent at its report:

curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s grant-audit lynis --from /var/log/lynis-report.dat

/var/log/lynis-report.dat is Lynis’s default, and the one used when --from is left out. A systemd path unit copies the report into /var/lib/demerzel/audits/lynis/ (root:demerzel, 0750) each time it changes. The agent reads it from there and never touches the original.

For OpenSCAP, name your results file (oscap xccdf eval --results, or --results-arf):

curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s grant-audit openscap --from /var/lib/oscap/results.xml

Or have it scheduled

Not running one yet? Install the tool you prefer, then let service.sh schedule it with a systemd timer (daily or weekly). The timer runs it as root and writes the report straight into the spool:

sudo apt-get install lynis
curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s grant-audit lynis --run weekly

sudo apt-get install openscap-scanner ssg-debian
curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s grant-audit openscap --run weekly \
  --profile xccdf_org.ssgproject.content_profile_anssi_bp28_minimal

For OpenSCAP the datastream defaults to the one ssg-debian ships for the host’s release (ssg-debian12-ds.xml); pass --datastream to use another. oscap info <datastream> lists the profiles. service.sh never installs a tool itself. To run an audit now, use sudo systemctl start demerzel-audit-lynis.service.

Take it back

curl -fsSL https://get.demerzel.cloud/service.sh | sudo sh -s revoke-audit lynis

This removes the units and the spool directory. The tool, and its own reports, stay as they were.

What leaves the host

Each report is parsed on the host. The agent sends the tool’s version, the profile, the score, the count of results by status, and for each finding its identifier, status, severity and title, worst first and at most 500. Lynis’s free-text details can name accounts, files or values, so they are dropped on the host. A home directory in a title is sent as ~/…. See data privacy.

Another tool

Every tool is turned into the same shape on the host, so supporting another one only takes a parser in the agent. If you rely on a tool that isn’t supported yet, tell us which one.