lynis简介

Lynis是一款Unix系统的安全审计以及加固工具，能够进行深层次的安全扫描，其目的是检测潜在的时间并对未来的系统加固提供建议。这款软件会扫描一般系统信息，脆弱软件包以及潜在的错误配置。扫描完成后，Lynis还会为我们生成一份包含所有扫描结果的安全报告。
Get Started with Lynis – Installation Guide – CISOfy
https://cisofy.com/documentation/lynis/get-started/#first-run

Lynis受众与用例

1） Lynis的典型用例包括：

• 安全审核
• 一致性测试（例如，PCI，HIPAA，SOx）
• 渗透测试
• 漏洞检测
• 系统强化

2） 受众和用例

• 开发人员：测试该Docker映像，或改善已部署Web应用程序的强化。
• 系统管理员：运行日常运行状况扫描，以发现新的漏洞。
• IT审核员：向同事或客户展示可以采取哪些措施来提高安全性。
• 渗透测试人员：发现客户端系统上的安全漏洞，最终可能导致系统受损。
• 支持的操作系统

支持的系统

Lynis几乎可以在所有基于UNIX的系统和版本上运行，包括：
1） AIX
2） FreeBSD
3） HP-UX
4） Linux
5） macOS
6） NetBSD
7） NixOS
8） OpenBSD
9） Solaris
10） and others
同样也可以在Raspberry Pi，IoT设备和QNAP存储设备等系统上运行。

Audit步骤

使用Lynis进行的典型扫描过程：
1） 初始化
2） 执行基本检查，例如文件所有权
3） 确定操作系统和工具
4） 搜索可用的软件组件
5） 检查最新的Lynis版本
6） 运行启用的插件
7） 按类别运行安全测试
8） 执行您的自定义测试（可选）
9） 报告安全扫描状态

除了屏幕上显示的报告和信息外，有关扫描的所有技术细节都存储在日志文件（lynis.log）中。警告和建议之类的结果存储在单独的报告文件（lynis-report.dat）中。

Lynis执行数百项单独的测试。大多数测试是用Shell脚本编写的，并且具有唯一的标识符（例如KRNL-6000）。使用唯一标识符，可以调整安全扫描。

Lynis是模块化的，可以运行您自己创建的测试。您甚至可以用其他脚本或编程语言创建它们。

Lynis插件

插件是Lynis的模块化扩展。借助插件，Lynis将执行附加测试并收集更多系统信息。

每个插件都有收集特定数据的目的。此数据存储在Lynis报告文件（lynis-report.dat）中。根据您对Lynis的使用情况，收集的数据可能会提供系统之间或各个扫描之间的宝贵见解。为了确保持续的开发，作者Michael Boelen创建了一个使用Lynis扫描输出的基于Web的付费解决方案。此解决方案称为Lynis Enterprise，并同时利用Lynis和插件。

该插件在拥有10个以上系统的环境中提供最大的价值。下载部分提供了一些插件。

插件网址：
Lynis plugins – CISOfy

自定义插件
可以通过利用通用的shell脚本来创建自定义插件，运行自己创建的测试。
Lynis Plugins – Development Guide – CISOfy

Available plugins

1.5 支持的标准

• CIS benchmarks
• NIST
• NSA
• OpenSCAP data Vendor guides and
  recommendations (e.g. Debian Gentoo, Red Hat)

2 Lynis审计模块介绍
命令行输入lynis show groups后可查看扫描类别.共有41个大类

审查示例

可以参考我这篇博客：
Centos7|Lynis安装与使用_我是一块小石头-ImapBox博客_centos下lynis安装步骤

• 系统审查

lynis audit system 

• 单独模块审查

lynis --tests-from-group "group name" 

审查恶意软件

lynis –tests-from-group “hardening malware”，需要安装malware scanner才能完成这个功能

Lynis control HRDN-7230: Presence malware scanner – CISOfy

审计一致性

审计模块明细表

输入指令 lynis show tests，实际只有39个大类
Lynis security controls: Accounting – CISOfy

Test-ID 详细

ACCT-2754 FreeBSD Check for available FreeBSD accounting information (security) ACCT-2760 OpenBSD Check for available OpenBSD accounting information (security) ACCT-9622 Linux Check for available Linux accounting information (security) ACCT-9626 Linux Check for sysstat accounting data (security) ACCT-9628 Linux Check for auditd (security) ACCT-9630 Linux Check for auditd rules (security) ACCT-9632 Linux Check for auditd configuration file (security) ACCT-9634 Linux Check for auditd log file (security) ACCT-9636 Linux Check for Snoopy wrapper and logger (security) ACCT-9650 Solaris Check Solaris audit daemon (security) ACCT-9652 Solaris Check auditd SMF status (security) ACCT-9654 Solaris Check BSM auditing in /etc/system (security) ACCT-9656 Solaris Check BSM auditing in module list (security) ACCT-9660 Solaris Check location of audit events (security) ACCT-9662 Solaris Check Solaris auditing stats (security) AUTH-9204  Check users with an UID of zero (security) AUTH-9208  Check non-unique accounts in passwd file (security) AUTH-9212  Test group file (security) AUTH-9216  Check group and shadow group files (security) AUTH-9218 FreeBSD Check harmful login shells (security) AUTH-9222  Check for non unique groups (security) AUTH-9226  Check non unique group names (security) AUTH-9228  Check password file consistency with pwck (security) AUTH-9234  Query user accounts (security) AUTH-9240  Query NIS+ authentication support (security) AUTH-9242  Query NIS authentication support (security) AUTH-9250  Checking sudoers file (security) AUTH-9252  Check sudoers file (security) AUTH-9254 Solaris Solaris passwordless accounts (security) AUTH-9262  Checking presence password strength testing tools (PAM) (security) AUTH-9264  Checking presence pam.conf (security) AUTH-9266  Checking presence pam.d files (security) AUTH-9268  Checking presence pam.d files (security) AUTH-9278  Checking LDAP pam status (security) AUTH-9282  Checking password protected account without expire date (security) AUTH-9283  Checking accounts without password (security) AUTH-9286  Checking user password aging (security) AUTH-9288  Checking for expired passwords (security) AUTH-9304 Solaris Check single user login configuration (security) AUTH-9306 HP-UX Check single boot authentication (security) AUTH-9308 Linux Check single user login configuration (security) AUTH-9328  Default umask values (security) AUTH-9340 Solaris Solaris account locking (security) AUTH-9402  Query LDAP authentication support (security) AUTH-9406  Query LDAP servers in client configuration (security) AUTH-9408  Logging of failed login attempts via /etc/login.defs (security) AUTH-9409 OpenBSD Check for doas file (security) AUTH-9410 OpenBSD Check for doas file permissions (security) AUTH-9489 DragonFly Check login shells for passwordless accounts (security) BANN-7113 FreeBSD Check COPYRIGHT banner file (security) BANN-7124  Check issue banner file (security) BANN-7126  Check issue banner file contents (security) BANN-7128  Check issue.net banner file (security) BANN-7130  Check issue.net banner file contents (security) BOOT-5102 AIX Check for AIX boot device (security) BOOT-5104  Determine service manager (security) BOOT-5106 MacOS Check EFI boot file on macOS (security) BOOT-5108 Linux Test Syslinux boot loader (security) BOOT-5116  Check if system is booted in UEFI mode (security) BOOT-5117 Linux Check for systemd-boot boot loader (security) BOOT-5121  Check for GRUB boot loader presence (security) BOOT-5122  Check for GRUB boot password (security) BOOT-5124 FreeBSD Check for FreeBSD boot loader presence (security) BOOT-5126 NetBSD Check for NetBSD boot loader presence (security) BOOT-5139  Check for LILO boot loader presence (security) BOOT-5142  Check SPARC Improved boot loader (SILO) (security) BOOT-5155  Check for YABOOT boot loader configuration file (security) BOOT-5159 OpenBSD Check for OpenBSD boot loader presence (security) BOOT-5165 FreeBSD Check for FreeBSD boot services (security) BOOT-5177 Linux Check for Linux boot and running services (security) BOOT-5180 Linux Check for Linux boot services (Debian style) (security) BOOT-5184 Linux Check permissions for boot files/scripts (security) BOOT-5202  Check uptime of system (security) BOOT-5260  Check single user mode for systemd (security) BOOT-5261 DragonFly Check for DragonFly boot loader presence (security) BOOT-5262 OpenBSD Check for OpenBSD boot daemons (security) BOOT-5263 OpenBSD Check permissions for boot files/scripts (security) CONT-8004 Solaris Query running Solaris zones (security) CONT-8102  Checking Docker status and information (security) CONT-8104  Checking Docker info for any warnings (security) CONT-8106  Gather basic stats from Docker (security) CONT-8107  Check number of unused Docker containers (performance) CONT-8108  Check file permissions for Docker files (security) CORE-1000  Check all system binaries (performance) CRYP-7902  Check expire date of SSL certificates (security) DNS-1600  Validating that the DNSSEC signatures are checked (security) DBS-1804  Checking active MySQL process (security) DBS-1816  Checking MySQL root password (security) DBS-1818  MongoDB status (security) DBS-1820  Check MongoDB authentication (security) DBS-1826  Checking active PostgreSQL processes (security) DBS-1840  Checking active Oracle processes (security) DBS-1860  Checking active DB2 instances (security) DBS-1880  Checking active Redis processes (security) DBS-1882  Redis configuration file (security) DBS-1884  Redis configuration (requirepass) (security) DBS-1886  Redis configuration (CONFIG command renamed) (security) DBS-1888  Redis configuration (bind on localhost) (security) FILE-6310  Checking /tmp, /home and /var directory (security) FILE-6311  Checking LVM volume groups (security) FILE-6312  Checking LVM volumes (security) FILE-6323 Linux Checking EXT file systems (security) FILE-6329  Checking FFS/UFS file systems (security) FILE-6330 FreeBSD Checking ZFS file systems (security) FILE-6332  Checking swap partitions (security) FILE-6336  Checking swap mount options (security) FILE-6344 Linux Checking proc mount options (security) FILE-6354  Searching for old files in /tmp (security) FILE-6362  Checking /tmp sticky bit (security) FILE-6363  Checking /var/tmp sticky bit (security) FILE-6368 Linux Checking ACL support on root file system (security) FILE-6372 Linux Checking / mount options (security) FILE-6374 Linux Checking /boot mount options (security) FILE-6376 Linux Determine if /var/tmp is bound to /tmp (security) FILE-6410  Checking Locate database (security) FILE-6430  Disable mounting of some filesystems (security) FILE-6439 DragonFly Checking HAMMER PFS mounts (security) FILE-7524  Perform file permissions check (security) FINT-4310  AFICK availability (security) FINT-4314  AIDE availability (security) FINT-4315  Check AIDE configuration file (security) FINT-4318  Osiris availability (security) FINT-4322  Samhain availability (security) FINT-4326  Tripwire availability (security) FINT-4328  OSSEC syscheck daemon running (security) FINT-4330  mtree availability (security) FINT-4334  Check lfd daemon status (security) FINT-4336  Check lfd configuration status (security) FINT-4338  osqueryd syscheck daemon running (security) FINT-4350  File integrity software installed (security) FINT-4402  Checksums (SHA256 or SHA512) (security) FIRE-4502 Linux Check iptables kernel module (security) FIRE-4508  Check used policies of iptables chains (security) FIRE-4512  Check iptables for empty ruleset (security) FIRE-4513  Check iptables for unused rules (security) FIRE-4518  Check pf firewall components (security) FIRE-4520  Check pf configuration consistency (security) FIRE-4524  Check for CSF presence (security) FIRE-4526 Solaris Check ipf status (security) FIRE-4530 FreeBSD Check IPFW status (security) FIRE-4532 MacOS Check macOS application firewall (security) FIRE-4534 MacOS Check for outbound firewalls (security) FIRE-4536 Linux Check nftables status (security) FIRE-4538 Linux Check nftables basic configuration (security) FIRE-4540 Linux Test for empty nftables configuration (security) FIRE-4586  Check firewall logging (security) FIRE-4590  Check firewall status (security) FIRE-4594  Check for APF presence (security) HOME-9302  Create list with home directories (security) HOME-9310  Checking for suspicious shell history files (security) HOME-9350  Collecting information from home directories (security) HRDN-7220  Check if one or more compilers are installed (security) HRDN-7222  Check compiler permissions (security) HRDN-7230  Check for malware scanner (security) HTTP-6622  Checking Apache presence (security) HTTP-6624  Testing main Apache configuration file (security) HTTP-6626  Testing other Apache configuration file (security) HTTP-6632  Determining all available Apache modules (security) HTTP-6640  Determining existence of specific Apache modules (security) HTTP-6641  Determining existence of specific Apache modules (security) HTTP-6643  Determining existence of specific Apache modules (security) HTTP-6702  Check nginx process (security) HTTP-6704  Check nginx configuration file (security) HTTP-6706  Check for additional nginx configuration files (security) HTTP-6708  Check discovered nginx configuration settings (security) HTTP-6710  Check nginx SSL configuration settings (security) HTTP-6712  Check nginx access logging (security) HTTP-6714  Check for missing error logs in nginx (security) HTTP-6716  Check for debug mode on error log in nginx (security) HTTP-6720  Check Nginx log files (security) INSE-8000  Installed inetd package (security) INSE-8002  Status of inet daemon (security) INSE-8004  Presence of inetd configuration file (security) INSE-8006  Check configuration of inetd when it is disabled (security) INSE-8016  Check for telnet via inetd (security) INSE-8050 MacOS Check for insecure services on macOS systems (security) INSE-8100  Installed xinetd package (security) INSE-8116  Insecure services enabled via xinetd (security) INSE-8200  Usage of TCP wrappers (security) INSE-8300  Presence of rsh client (security) INSE-8302  Presence of rsh server (security) KRNL-5622 Linux Determine Linux default run level (security) KRNL-5677 Linux Check CPU options and support (security) KRNL-5695 Linux Determine Linux kernel version and release number (security) KRNL-5723 Linux Determining if Linux kernel is monolithic (security) KRNL-5726 Linux Checking Linux loaded kernel modules (security) KRNL-5728 Linux Checking Linux kernel config (security) KRNL-5730 Linux Checking disk I/O kernel scheduler (security) KRNL-5745 FreeBSD Checking FreeBSD loaded kernel modules (security) KRNL-5770 Solaris Checking active kernel modules (security) KRNL-5788 Linux Checking availability new Linux kernel (security) KRNL-5820 Linux Checking core dumps configuration (security) KRNL-5830 Linux Checking if system is running on the latest installed kernel (security) KRNL-5831 DragonFly Checking DragonFly loaded kernel modules (security) KRNL-6000  Check sysctl key pairs in scan profile (security) LDAP-2219  Check running OpenLDAP instance (security) LDAP-2224  Check presence slapd.conf (security) LOGG-2130  Check for running syslog daemon (security) LOGG-2132  Check for running syslog-ng daemon (security) LOGG-2134  Checking Syslog-NG configuration file consistency (security) LOGG-2136  Check for running systemd journal daemon (security) LOGG-2138 Linux Checking kernel logger daemon on Linux (security) LOGG-2142 Linux Checking minilog daemon (security) LOGG-2146  Checking logrotate.conf and logrotate.d (security) LOGG-2148  Checking logrotated files (security) LOGG-2150  Checking directories in logrotate configuration (security) LOGG-2152  Checking loghost (security) LOGG-2154  Checking syslog configuration file (security) LOGG-2160  Checking /etc/newsyslog.conf (security) LOGG-2162  Checking directories in /etc/newsyslog.conf (security) LOGG-2164  Checking files specified /etc/newsyslog.conf (security) LOGG-2170  Checking log paths (security) LOGG-2180  Checking open log files (security) LOGG-2190  Checking for deleted files in use (security) LOGG-2192  Checking for opened log files that are empty (security) LOGG-2210  Check for running metalog daemon (security) LOGG-2230  Check for running RSyslog daemon (security) LOGG-2240  Check for running RFC 3195 compliant daemon (security) MACF-6204  Check AppArmor presence (security) MACF-6208  Check if AppArmor is enabled (security) MACF-6232  Check SELINUX presence (security) MACF-6234  Check SELINUX status (security) MACF-6240  Detection of TOMOYO binary (security) MACF-6242  Status of TOMOYO MAC framework (security) MACF-6290  Check for implemented MAC framework (security) MAIL-8802  Check Exim status (security) MAIL-8804  Exim configuration (security) MAIL-8814  Check postfix process status (security) MAIL-8816  Check Postfix configuration (security) MAIL-8817  Check Postfix configuration errors (security) MAIL-8818  Postfix banner (security) MAIL-8820  Postfix configuration (security) MAIL-8838  Check dovecot process (security) MAIL-8860  Check Qmail status (security) MAIL-8880  Check Sendmail status (security) MAIL-8920  Check OpenSMTPD status (security) MALW-3275  Check for chkrootkit (security) MALW-3276  Check for Rootkit Hunter (security) MALW-3278  Check for LMD (security) MALW-3280  Check if anti-virus tool is installed (security) MALW-3282  Check for clamscan (security) MALW-3284  Check for clamd (security) MALW-3286  Check for freshclam (security) MALW-3288  Check for ClamXav (security) NAME-4016  Check /etc/resolv.conf default domain (security) NAME-4018  Check /etc/resolv.conf search domains (security) NAME-4020  Check non default options (security) NAME-4024 Solaris Solaris uname -n output (security) NAME-4026 Solaris Check /etc/nodename (security) NAME-4028  Check domain name (security) NAME-4032  Check nscd status (security) NAME-4034  Check Unbound status (security) NAME-4036  Check Unbound configuration file (security) NAME-4202  Check BIND status (security) NAME-4204  Search BIND configuration file (security) NAME-4206  Check BIND configuration consistency (security) NAME-4210  Check DNS banner (security) NAME-4230  Check PowerDNS status (security) NAME-4232  Search PowerDNS configuration file (security) NAME-4236  Check PowerDNS backends (security) NAME-4238  Check PowerDNS authoritive status (security) NAME-4304  Check NIS ypbind status (security) NAME-4306  Check NIS domain (security) NAME-4402  Check duplicate line in /etc/hosts (security) NAME-4404  Check /etc/hosts contains an entry for this server name (security) NAME-4406  Check server hostname mapping (security) NAME-4408  Check localhost to IP mapping (security) NETW-2600 Linux Checking IPv6 configuration (security) NETW-2704  Basic nameserver configuration tests (security) NETW-2705  Check availability two nameservers (security) NETW-3001  Find default gateway (route) (security) NETW-3004  Search available network interfaces (security) NETW-3006  Get network MAC addresses (security) NETW-3008  Get network IP addresses (security) NETW-3012  Check listening ports (security) NETW-3014  Checking promiscuous interfaces (BSD) (security) NETW-3015 Linux Checking promiscuous interfaces (Linux) (security) NETW-3028  Checking connections in WAIT state (security) NETW-3030  Checking DHCP client status (security) NETW-3032 Linux Checking for ARP monitoring software (security) PHP-2211  Check php.ini presence (security) PHP-2320  Check PHP disabled functions (security) PHP-2368  Check PHP register_globals option (security) PHP-2372  Check PHP expose_php option (security) PHP-2374  Check PHP enable_dl option (security) PHP-2376  Check PHP allow_url_fopen option (security) PHP-2378  Check PHP allow_url_include option (security) PHP-2379  Check PHP suhosin extension status (security) PKGS-7301  Query NetBSD pkg (security) PKGS-7302  Query FreeBSD/NetBSD pkg_info (security) PKGS-7303  Query brew package manager (security) PKGS-7304  Querying Gentoo packages (security) PKGS-7306 Solaris Querying Solaris packages (security) PKGS-7308  Checking package list with RPM (security) PKGS-7310  Checking package list with pacman (security) PKGS-7312  Checking available updates for pacman based system (security) PKGS-7314  Checking pacman configuration options (security) PKGS-7320 Linux Check presence of arch-audit for Arch Linux (security) PKGS-7322 Linux Discover vulnerable packages on Arch Linux (security) PKGS-7328  Querying Zypper for installed packages (security) PKGS-7330  Querying Zypper for vulnerable packages (security) PKGS-7332  Detection of macOS ports and packages (security) PKGS-7334  Detection of available updates for macOS ports (security) PKGS-7345  Querying dpkg (security) PKGS-7346  Search unpurged packages on system (security) PKGS-7348 FreeBSD Check for old distfiles (security) PKGS-7350  Checking for installed packages with DNF utility (security) PKGS-7352  Checking for security updates with DNF utility (security) PKGS-7354  Checking package database integrity (security) PKGS-7366  Checking for debsecan utility (security) PKGS-7370  Checking for debsums utility (security) PKGS-7378  Query portmaster for port upgrades (security) PKGS-7380 NetBSD Check for vulnerable NetBSD packages (security) PKGS-7381  Check for vulnerable FreeBSD packages with pkg (security) PKGS-7382  Check for vulnerable FreeBSD packages with portaudit (security) PKGS-7383  Check for YUM package Update management (security) PKGS-7384  Check for YUM utils package (security) PKGS-7386  Check for YUM security package (security) PKGS-7387  Check for GPG signing in YUM security package (security) PKGS-7388  Check security repository in Debian/ubuntu apt sources.list file (security) PKGS-7390 Linux Check Ubuntu database consistency (security) PKGS-7392 Linux Check for Debian/Ubuntu security updates (security) PKGS-7393  Check for Gentoo vulnerable packages (security) PKGS-7394 Linux Check for Ubuntu updates (security) PKGS-7398  Check for package audit tool (security) PKGS-7410  Count installed kernel packages (security) PKGS-7420  Detect toolkit to automatically download and apply upgrades (security) PRNT-2302 FreeBSD Check for printcap consistency (security) PRNT-2304  Check cupsd status (security) PRNT-2306  Check CUPSd configuration file (security) PRNT-2307  Check CUPSd configuration file permissions (security) PRNT-2308  Check CUPSd network configuration (security) PRNT-2314  Check lpd status (security) PRNT-2316 AIX Checking /etc/qconfig file (security) PRNT-2418 AIX Checking qdaemon printer spooler status (security) PRNT-2420 AIX Checking old print jobs (security) PROC-3602 Linux Checking /proc/meminfo for memory details (security) PROC-3604 Solaris Query prtconf for memory details (security) PROC-3612  Check dead or zombie processes (security) PROC-3614  Check heavy IO waiting based processes (security) RBAC-6272  Check grsecurity presence (security) SCHD-7702  Check status of cron daemon (security) SCHD-7704  Check crontab/cronjobs (security) SCHD-7718  Check at users (security) SCHD-7720  Check at users (security) SCHD-7724  Check at jobs (security) SHLL-6202 FreeBSD Check console TTYs (security) SHLL-6211  Checking available and valid shells (security) SHLL-6220  Checking available and valid shells (security) SHLL-6230  Perform umask check for shell configurations (security) SINT-7010  System Integrity Status (security) SNMP-3302  Check for running SNMP daemon (security) SNMP-3304  Check SNMP daemon file location (security) SNMP-3306  Check SNMP communities (security) SQD-3602  Check for running Squid daemon (security) SQD-3604  Check Squid daemon file location (security) SQD-3606  Check Squid version (security) SQD-3610  Check Squid version (security) SQD-3613  Check Squid file permissions (security) SQD-3614  Check Squid authentication methods (security) SQD-3616  Check external Squid authentication (security) SQD-3620  Check Squid access control lists (security) SQD-3624  Check Squid safe ports (security) SQD-3630  Check Squid reply_body_max_size option (security) SQD-3680  Check Squid version suppression (security) SSH-7402  Check for running SSH daemon (security) SSH-7404  Check SSH daemon file location (security) SSH-7406  Detection of OpenSSH server version (security) SSH-7408  Check SSH specific defined options (security) SSH-7440  AllowUsers and AllowGroups (security) STRG-1840 Linux Check if USB storage is disabled (security) STRG-1842 Linux Check USB authorizations (security) STRG-1846 Linux Check if firewire storage is disabled (security) STRG-1902  Check rpcinfo registered programs (security) STRG-1904  Check nfs rpc (security) STRG-1906  Check nfs rpc (security) STRG-1920  Checking NFS daemon (security) STRG-1926  Checking NFS exports (security) STRG-1928  Checking empty /etc/exports (security) STRG-1930  Check client access to nfs share (security) TIME-3104  Check for running NTP daemon or client (security) TIME-3106  Check systemd NTP time synchronization status (security) TIME-3112  Check active NTP associations ID's (security) TIME-3116  Check peers with stratum value of 16 (security) TIME-3120  Check unreliable NTP peers (security) TIME-3124  Check selected time source (security) TIME-3128  Check preffered time source (security) TIME-3132  Check NTP falsetickers (security) TIME-3136 Linux Check NTP protocol version (security) TIME-3148 Linux Check TZ variable (performance) TIME-3160 Linux Check empty NTP step-tickers (security) TIME-3170  Check configuration files (security) TOOL-5002  Checking for automation tools (security) TOOL-5102  Check for presence of Fail2ban (security) TOOL-5104  Enabled tests for Fail2ban (security) TOOL-5120  Presence of Snort IDS (security) TOOL-5122  Snort IDS configuration file (security) TOOL-5160  Check for active OSSEC analysis daemon (security) TOOL-5190  Check presence of available IDS/IPS tooling (security) USB-3000 Linux Check for presence of USBGuard (security)