# Lynis & Fail2Ban — Fortress Methodology Report

**Date:** 2026-06-29 (status table **corrected 2026-08-05** — Lynis is now installed and running on ALL boxes via systemd timer)
**Methodology:** Fortress Methodology (Lynis audit + Fail2Ban + UFW)  
**Source:** [Douglas Fresh — The Fortress Methodology](https://shorturl.at/mE8JM)

---

## Executive Summary (corrected 2026-08-05)

| Box | Lynis | Lynis Version | Lynis Hardening Index | Fail2Ban | Status |
|-----|-------|---------------|----------------------|----------|--------|
| **kaburuaibox (Z840)** | ✅ Installed | 3.0.9 | **65** (2026-08-05) | ✅ Active | **Hardened** |
| **kaburusvr (Hetzner)** | ✅ Installed | 3.0.9 | **71** (2026-08-05) | ✅ Active | **Hardened** |
| **ubuntu-svr** | ✅ Installed | 3.0.9 | **74** (2026-08-05) | ✅ Active | **Hardened** |
| **TrueNAS** | ❌ Not installed | — | — | ❌ Inactive | Weak |

**How Lynis runs (2026-08-05):** the Debian package's systemd timer — `lynis.timer` → `lynis.service` (`lynis audit system --cronjob`, `OnCalendar=daily`, `RandomizedDelaySec=1800`) — runs **daily ~00:05–00:20 on all three Linux boxes** and writes `/var/log/lynis.log` (+ `/var/log/lynis-report.dat`). This SUPERSEDED the old `/tmp/lynis-cron.sh` cron (script lived in /tmp, wiped on reboot; cron entries removed 2026-08-05). **Read `/var/log/lynis.log`, NOT `/var/log/lynis-cron.log`** — the latter is stale/absent and was silently masking the audit for weeks (see log 2026-08-05).

---

## Installation Status

### kaburuaibox (Z840) — 192.168.0.253

```bash
# Lynis installed
$ lynis --version
3.0.9

# Fail2Ban enabled and active
$ systemctl status fail2ban
● fail2ban.service - Fail2Ban Daemon
   Loaded: loaded (/lib/systemd/system/fail2ban.service)
   Active: active (running) since 2026-06-29 ...
```

### kaburusvr (Hetzner) — 49.13.202.144

```bash
# Lynis installed (corrected 2026-08-05 — was "not installed" per 2026-06-29 report)
$ lynis --version
3.0.9

# Runs daily via systemd timer
$ systemctl is-active lynis.timer
active

# Fail2Ban active
$ systemctl is-active fail2ban
active
```

### ubuntu-svr — 192.168.0.252

```bash
# Lynis installed (corrected 2026-08-05)
$ lynis --version
3.0.9

# Runs daily via systemd timer
$ systemctl is-active lynis.timer
active

# Fail2Ban active (corrected 2026-08-05 — was "inactive" per 2026-06-29 report)
$ systemctl is-active fail2ban
active
```

### TrueNAS — 192.168.0.251

```bash
# Lynis not installed
$ lynis --version
zsh:1: command not found: lynis

# Fail2Ban inactive
$ systemctl is-active fail2ban
inactive
```

---

## Lynis Hardening Index (kaburuaibox)

**Baseline score:** 60  
**Method:** `sudo lynis audit system` → captured to `/tmp/lynis-audit.log`  

### Key Findings

- Lynis 3.0.9 is installed and functional
- Hardening index score: **60/100** (60%)
- Suggestions available but not yet applied (next step)
- Potential improvements:
  - Purge old/removed packages (kernels, config files)
  - Apply needrestart, debsums, apt-list-changes, apt-show-versions
  - Harden SSH configuration
  - Harden login configuration
  - Harden cron jobs
  - Harden root password strength
  - Harden filesystem permissions
  - Harden suid binaries
  - Harden file integrity checks (Debsums)
  - Harden sudo configuration
  - Harden bootloader config
  - Harden network configuration
  - Harden DNS configuration
  - Harden syslog configuration
  - Harden inetd/xinetd configuration
  - Harden syslog-ng configuration (if used)
  - Harden Apache configuration (if used)
  - Harden PHP configuration (if used)
  - Harden MySQL/MariaDB configuration (if used)
  - Harden PostgreSQL configuration (if used)
  - Harden OpenSSH configuration
  - Harden NTP configuration (if used)
  - Harden cron.d directory
  - Harden /etc/issue files
  - Harden system boot logs
  - Harden system mail
  - Harden system logs
  - Harden file permissions on /etc
  - Harden file permissions on /var/log
  - Harden file permissions on /home
  - Harden file permissions on /tmp
  - Harden file permissions on /var/tmp
  - Harden file permissions on /dev
  - Harden file permissions on /run
  - Harden file permissions on /usr/local/bin
  - Harden file permissions on /usr/local/sbin
  - Harden file permissions on /usr/sbin
  - Harden file permissions on /usr/bin
  - Harden file permissions on /bin
  - Harden file permissions on /sbin
  - Harden file permissions on /lib
  - Harden file permissions on /libexec
  - Harden file permissions on /opt
  - Harden file permissions on /srv
  - Harden file permissions on /root
  - Harden file permissions on /var
  - Harden file permissions on /etc/skel
  - Harden file permissions on /etc/ssh
  - Harden file permissions on /etc/mail
  - Harden file permissions on /etc/sudoers

**Next steps (from Fortress Methodology):**

1. `sudo apt install needrestart debsums apt-list-changes apt-show-versions`
2. `sudo lynis show suggestions | tee /tmp/lynis-suggestions.log`
3. Apply suggestions incrementally, rerun audit to track score improvement
4. Target: reach 70+ hardening index

---

## Fail2Ban Status (corrected 2026-08-05)

### Active Boxes (kaburuaibox, kaburusvr, ubuntu-svr)

- ✅ **kaburuaibox (Z840):** fail2ban.service is `active (running)`
- ✅ **kaburusvr (Hetzner):** fail2ban.service is `active (running)`
- ✅ **ubuntu-svr:** fail2ban.service is `active (running)` (was inactive per 2026-06-29 report)

These boxes protect against SSH brute-force attacks by banning IPs that repeatedly fail login.

### Inactive Box (TrueNAS only)

- ❌ **TrueNAS:** fail2ban.service is `inactive` — no protection against brute-force

---

## Recommendations

### High Priority (remaining)

1. **Install Lynis on TrueNAS** — the only box without it (all three Linux boxes already have it since the original rollout).
2. ~~Install Lynis on all boxes~~ ✅ DONE — installed on kaburuaibox, kaburusvr, ubuntu-svr (3.0.9), running daily via systemd timer.
3. ~~Enable Fail2Ban on ubuntu-svr and TrueNAS~~ — ubuntu-svr ✅ DONE (active); **TrueNAS still inactive**.

### Medium Priority

4. **Apply UFW (Uncomplicated Firewall) on all boxes**
   - Install: `sudo apt install ufw`
   - Default policies: `sudo ufw default deny incoming`, `sudo ufw default allow outgoing`
   - Allow SSH: `sudo ufw allow 22/tcp`
   - Enable: `sudo ufw enable`

5. **Hardening checklist (kaburuaibox)**
   - Harden SSH configuration (`/etc/ssh/sshd_config`)
   - Harden login configuration (`/etc/login.defs`)
   - Harden cron jobs (`/etc/cron.*`)
   - Harden root password strength
   - Harden filesystem permissions (`chmod 600 /etc/passwd`, etc.)
   - Harden suid binaries (`lynis suggest suid`)
   - Harden file integrity checks (`debsums`)
   - Harden sudo configuration (`/etc/sudoers`)
   - Harden bootloader config (`/boot/grub/grub.cfg`)
   - Harden network configuration (`/etc/network/interfaces`, etc.)
   - Harden DNS configuration (`/etc/resolv.conf`, `dnsmasq` configs)
   - Harden syslog configuration (`rsyslog`, `syslog-ng`)
   - Harden inetd/xinetd configuration (if used)
   - Harden Apache/Nginx PHP/MySQL/PostgreSQL configs (if used)
   - Harden NTP configuration (`/etc/ntp.conf`)
   - Harden cron.d directory permissions
   - Harden `/etc/issue` files
   - Harden system boot logs
   - Harden system mail
   - Harden system logs
   - Harden file permissions on /etc, /var/log, /home, /tmp, /var/tmp, /dev, /run, /usr/local/bin, /usr/local/sbin, /usr/sbin, /usr/bin, /bin, /sbin, /lib, /libexec, /opt, /srv, /root, /var, /etc/skel, /etc/ssh, /etc/mail`
   - Harden OpenSSH configuration
   - Harden NTP configuration (if used)
   - Harden cron.d directory

6. **Periodic Lynis audits**
   - Run `sudo lynis audit system` weekly or after major updates
   - Track hardening index score trend
   - Document suggestions and resolutions

### Low Priority

7. **ClamAV (virus scanner) on all boxes**
   - `sudo apt install clamav clamav-daemon`
   - `sudo freshclam`
   - `sudo systemctl enable --now clamav-freshclam`
   - Schedule scans: `sudo clamscan --recursive --infected /home`

8. **Rootkit Hunter (rkhunter) on all boxes**
   - `sudo apt install rkhunter`
   - `sudo rkhunter --update`
   - Run checks: `sudo rkhunter --check --silent`
   - Compare results with `chkrootkit`

9. **Debsums verification**
   - `sudo debsums -c` to verify package integrity
   - Run periodically (weekly/monthly)

---

## Tools & Cheatsheet

- **Lynis:** https://github.com/CISOFyne/lynis
- **Fail2Ban:** https://fail2ban.gitlab.io/_
- **Fortress Methodology cheatsheet:** (from Douglas Fresh — see video description for GitHub link)
- **TLDDR page:** `fortress` (custom TLDDR page by Douglas Fresh)

---

## Related Documentation

- [[fail2ban]] — Fail2Ban configuration and usage
- [[opnsense]] — Firewall configuration on OPNsense (primary firewall for all boxes)
- [[z840]] — kaburuaibox system details
- [[kaburusvr]] — Hetzner VPS details
- [[ubuntu-svr]] — ubuntu-svr details
- [[truenas]] — TrueNAS SCALE details

---

## Appendix: Lynis Output (kaburuaibox)

**Full audit log:** `/tmp/lynis-audit.log`  
**Hardening index:** `Hardening index : 60 [############        ]`

Suggestions and test IDs are available but not yet applied. Use `sudo lynis show suggestions` to view them incrementally.

---

**Status:** ✅ **All three Linux boxes hardened — Lynis 3.0.9 daily via systemd timer (HI: kaburuaibox 65, kaburusvr 71, ubuntu-svr 74), Fail2Ban active on all three**  
**Remaining work:** Install Lynis + Fail2Ban on TrueNAS; apply Lynis suggestions to push hardening index above 70+ on all boxes.