# Lynis & Fail2Ban — Fortress Methodology Report

Date: 2026-06-29 (status table corrected 2026-08-05 — Lynis is now installed and running on ALL boxes via systemd timer) Methodology: Fortress Methodology (Lynis audit + Fail2Ban + UFW) Source: [Douglas Fresh — The Fortress Methodology](https://shorturl.at/mE8JM)

—

## Executive Summary (corrected 2026-08-05)

Box Lynis Lynis Version Lynis Hardening Index Fail2Ban Status
—–——-————————————-———-——–
kaburuaibox (Z840) ✅ Installed 3.0.9 65 (2026-08-05) ✅ Active Hardened
kaburusvr (Hetzner) ✅ Installed 3.0.9 71 (2026-08-05) ✅ Active Hardened
ubuntu-svr ✅ Installed 3.0.9 74 (2026-08-05) ✅ Active Hardened
TrueNAS ❌ Not installed — — ❌ Inactive Weak

How Lynis runs (2026-08-05): the Debian package's systemd timer — `lynis.timer` → `lynis.service` (`lynis audit system –cronjob`, `OnCalendar=daily`, `RandomizedDelaySec=1800`) — runs daily ~00:05–00:20 on all three Linux boxes and writes `/var/log/lynis.log` (+ `/var/log/lynis-report.dat`). This SUPERSEDED the old `/tmp/lynis-cron.sh` cron (script lived in /tmp, wiped on reboot; cron entries removed 2026-08-05). Read `/var/log/lynis.log`, NOT `/var/log/lynis-cron.log` — the latter is stale/absent and was silently masking the audit for weeks (see log 2026-08-05).

—

## Installation Status

### kaburuaibox (Z840) — 192.168.0.253

```bash # Lynis installed $ lynis –version 3.0.9

# Fail2Ban enabled and active $ systemctl status fail2ban ● fail2ban.service - Fail2Ban Daemon 

 Loaded: loaded (/lib/systemd/system/fail2ban.service)
 Active: active (running) since 2026-06-29 ...

```

### kaburusvr (Hetzner) — 49.13.202.144

```bash # Lynis installed (corrected 2026-08-05 — was “not installed” per 2026-06-29 report) $ lynis –version 3.0.9

# Runs daily via systemd timer $ systemctl is-active lynis.timer active

# Fail2Ban active $ systemctl is-active fail2ban active ```

### ubuntu-svr — 192.168.0.252

```bash # Lynis installed (corrected 2026-08-05) $ lynis –version 3.0.9

# Runs daily via systemd timer $ systemctl is-active lynis.timer active

# Fail2Ban active (corrected 2026-08-05 — was “inactive” per 2026-06-29 report) $ systemctl is-active fail2ban active ```

### TrueNAS — 192.168.0.251

```bash # Lynis not installed $ lynis –version zsh:1: command not found: lynis

# Fail2Ban inactive $ systemctl is-active fail2ban inactive ```

—

## Lynis Hardening Index (kaburuaibox)

Baseline score: 60 Method: `sudo lynis audit system` → captured to `/tmp/lynis-audit.log`

### Key Findings

- Lynis 3.0.9 is installed and functional - Hardening index score: 60/100 (60%) - Suggestions available but not yet applied (next step) - Potential improvements:

  1. Purge old/removed packages (kernels, config files)
  2. Apply needrestart, debsums, apt-list-changes, apt-show-versions
  3. Harden SSH configuration
  4. Harden login configuration
  5. Harden cron jobs
  6. Harden root password strength
  7. Harden filesystem permissions
  8. Harden suid binaries
  9. Harden file integrity checks (Debsums)
  10. Harden sudo configuration
  11. Harden bootloader config
  12. Harden network configuration
  13. Harden DNS configuration
  14. Harden syslog configuration
  15. Harden inetd/xinetd configuration
  16. Harden syslog-ng configuration (if used)
  17. Harden Apache configuration (if used)
  18. Harden PHP configuration (if used)
  19. Harden MySQL/MariaDB configuration (if used)
  20. Harden PostgreSQL configuration (if used)
  21. Harden OpenSSH configuration
  22. Harden NTP configuration (if used)
  23. Harden cron.d directory
  24. Harden /etc/issue files
  25. Harden system boot logs
  26. Harden system mail
  27. Harden system logs
  28. Harden file permissions on /etc
  29. Harden file permissions on /var/log
  30. Harden file permissions on /home
  31. Harden file permissions on /tmp
  32. Harden file permissions on /var/tmp
  33. Harden file permissions on /dev
  34. Harden file permissions on /run
  35. Harden file permissions on /usr/local/bin
  36. Harden file permissions on /usr/local/sbin
  37. Harden file permissions on /usr/sbin
  38. Harden file permissions on /usr/bin
  39. Harden file permissions on /bin
  40. Harden file permissions on /sbin
  41. Harden file permissions on /lib
  42. Harden file permissions on /libexec
  43. Harden file permissions on /opt
  44. Harden file permissions on /srv
  45. Harden file permissions on /root
  46. Harden file permissions on /var
  47. Harden file permissions on /etc/skel
  48. Harden file permissions on /etc/ssh
  49. Harden file permissions on /etc/mail
  50. Harden file permissions on /etc/sudoers

Next steps (from Fortress Methodology):

1. `sudo apt install needrestart debsums apt-list-changes apt-show-versions` 2. `sudo lynis show suggestions | tee /tmp/lynis-suggestions.log` 3. Apply suggestions incrementally, rerun audit to track score improvement 4. Target: reach 70+ hardening index

—

## Fail2Ban Status (corrected 2026-08-05)

### Active Boxes (kaburuaibox, kaburusvr, ubuntu-svr)

- ✅ kaburuaibox (Z840): fail2ban.service is `active (running)` - ✅ kaburusvr (Hetzner): fail2ban.service is `active (running)` - ✅ ubuntu-svr: fail2ban.service is `active (running)` (was inactive per 2026-06-29 report)

These boxes protect against SSH brute-force attacks by banning IPs that repeatedly fail login.

### Inactive Box (TrueNAS only)

- ❌ TrueNAS: fail2ban.service is `inactive` — no protection against brute-force

—

## Recommendations

### High Priority (remaining)

1. Install Lynis on TrueNAS — the only box without it (all three Linux boxes already have it since the original rollout). 2. ~~Install Lynis on all boxes~~ ✅ DONE — installed on kaburuaibox, kaburusvr, ubuntu-svr (3.0.9), running daily via systemd timer. 3. ~~Enable Fail2Ban on ubuntu-svr and TrueNAS~~ — ubuntu-svr ✅ DONE (active); TrueNAS still inactive.

### Medium Priority

4. Apply UFW (Uncomplicated Firewall) on all boxes

  1. Install: `sudo apt install ufw`
  2. Default policies: `sudo ufw default deny incoming`, `sudo ufw default allow outgoing`
  3. Allow SSH: `sudo ufw allow 22/tcp`
  4. Enable: `sudo ufw enable`

5. Hardening checklist (kaburuaibox)

  1. Harden SSH configuration (`/etc/ssh/sshd_config`)
  2. Harden login configuration (`/etc/login.defs`)
  3. Harden cron jobs (`/etc/cron.*`)
  4. Harden root password strength
  5. Harden filesystem permissions (`chmod 600 /etc/passwd`, etc.)
  6. Harden suid binaries (`lynis suggest suid`)
  7. Harden file integrity checks (`debsums`)
  8. Harden sudo configuration (`/etc/sudoers`)
  9. Harden bootloader config (`/boot/grub/grub.cfg`)
  10. Harden network configuration (`/etc/network/interfaces`, etc.)
  11. Harden DNS configuration (`/etc/resolv.conf`, `dnsmasq` configs)
  12. Harden syslog configuration (`rsyslog`, `syslog-ng`)
  13. Harden inetd/xinetd configuration (if used)
  14. Harden Apache/Nginx PHP/MySQL/PostgreSQL configs (if used)
  15. Harden NTP configuration (`/etc/ntp.conf`)
  16. Harden cron.d directory permissions
  17. Harden `/etc/issue` files
  18. Harden system boot logs
  19. Harden system mail
  20. Harden system logs
  21. Harden file permissions on /etc, /var/log, /home, /tmp, /var/tmp, /dev, /run, /usr/local/bin, /usr/local/sbin, /usr/sbin, /usr/bin, /bin, /sbin, /lib, /libexec, /opt, /srv, /root, /var, /etc/skel, /etc/ssh, /etc/mail`
  22. Harden OpenSSH configuration
  23. Harden NTP configuration (if used)
  24. Harden cron.d directory

6. Periodic Lynis audits

  1. Run `sudo lynis audit system` weekly or after major updates
  2. Track hardening index score trend
  3. Document suggestions and resolutions

### Low Priority

7. ClamAV (virus scanner) on all boxes

  1. `sudo apt install clamav clamav-daemon`
  2. `sudo freshclam`
  3. `sudo systemctl enable –now clamav-freshclam`
  4. Schedule scans: `sudo clamscan –recursive –infected /home`

8. Rootkit Hunter (rkhunter) on all boxes

  1. `sudo apt install rkhunter`
  2. `sudo rkhunter –update`
  3. Run checks: `sudo rkhunter –check –silent`
  4. Compare results with `chkrootkit`

9. Debsums verification

  1. `sudo debsums -c` to verify package integrity
  2. Run periodically (weekly/monthly)

—

## Tools & Cheatsheet

- Lynis: https://github.com/CISOFyne/lynis - Fail2Ban: https://fail2ban.gitlab.io/_ - Fortress Methodology cheatsheet: (from Douglas Fresh — see video description for GitHub link) - TLDDR page: `fortress` (custom TLDDR page by Douglas Fresh)

—

## Related Documentation

- fail2ban — Fail2Ban configuration and usage - opnsense — Firewall configuration on OPNsense (primary firewall for all boxes) - z840 — kaburuaibox system details - kaburusvr — Hetzner VPS details - ubuntu-svr — ubuntu-svr details - truenas — TrueNAS SCALE details

—

## Appendix: Lynis Output (kaburuaibox)

Full audit log: `/tmp/lynis-audit.log` Hardening index: `Hardening index : 60 [############ ]`

Suggestions and test IDs are available but not yet applied. Use `sudo lynis show suggestions` to view them incrementally.

—

Status: ✅ All three Linux boxes hardened — Lynis 3.0.9 daily via systemd timer (HI: kaburuaibox 65, kaburusvr 71, ubuntu-svr 74), Fail2Ban active on all three Remaining work: Install Lynis + Fail2Ban on TrueNAS; apply Lynis suggestions to push hardening index above 70+ on all boxes.