Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I use the following tools for my auditing needs

A) System Auditing and Hardening (One time)

1) Linux Security Auditing Tool (Security centric,Text based output )

2) Dmidecode ( Retrieves info from BIOS )

3) Systeminfo ( Generates a nice html report)

4) Syssumm (Inactive since Oct 2000)

5) Rootkit Hunter (Does a basic config check in addition to rootkit checks)

6) CIS benchmarks

7) Bastille ( Interactive hardening and a security scoring tool)

B) Automatic Auditing (as a cron job or a service)

1) Logwatch

2) Psad

C) Remote Auditing

1) Nmap (Port scanning)

2) Nessus ( Remote Vulnerability check)

D) Wikipedia

1) System profiler

Any other tools/scripts which you can recommend?

share

migrated from stackoverflow.com Dec 1 '09 at 20:40

This question came from our site for professional and enthusiast programmers.

locked by Chris S Aug 26 '12 at 3:58

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

    
Lol - forgot a few? –  Mez Sep 29 '08 at 7:27
    
Wouldn't it have been better to have each utility as its own answer? This way people could vote on what utilities were most popular/useful. –  romandas Jan 5 '09 at 14:05

6 Answers 6

Ooh, Auditing tools :D

The main tool that I, personally use is "logwatch". This sends me an email every day which details different things that are going on in my system (everything from mailqueues, to logins, sudo access etc etc. Using this I can generally scan through and spot any issue that might have occured, or might have the potential to occur.

A nice tool for Debian based systems (and possibly others, though I haven't tried them) is tiger. Run as a cron job, this will email you with info about any issues (open ports that shouldn't be open etc etc)

The above however, are "ongoing" audit tools, and generally are installed on the box.

A tool that I find for external audits, or "on demand"/"infrequent" audits is Nessus which is a nifty tool that will take an address (or list of addresses) and actively scan them for security issues (including testing for known vulnerabilities in system software, or the way it's configured) - It's managed to spot a few things that I haven't a couple of times for me. Which is why I run it on a regular basis.

There are many other tools that also fall very vaguely into the "auditing" section, and I suggest you check out at least some of the following

  • Fail2ban
  • rootkit hunter
  • wapiti
  • rats
  • argus
  • bastille
  • selinux
  • apparmor
share

I recommend the Center for Internet Security's benchmarks. Unfortunately, these are not automated and require you to do all the steps yourself. You don't really get a score, you just change some settings.

For a score, more like your examples, CIS also has scoring tools, but I have not used these personally and don't know their quality. Furthermore, they require membership unlike the benchmarks.

share

A file monitoring tool like Osiris or Tripwire can also be extremely useful.

share

Lynis - from the creator of "Rootkit Hunter" is a good one to use when hardening your Linux or BSD-system step-by-step.

share

You could also use:

Tiger: The Unix security audit and intrusion detection tool http://www.nongnu.org/tiger/

share

One small tool I like is the ConfigServer Security & Firewall. "A Stateful Packet Inspection (SPI) firewall, Login/Intrusion Detection and Security application for Linux servers."

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.