Kaburu Wiki

# Lynis & Fail2Ban — Fortress Methodology Report

Date: 2026-06-29 (status table corrected 2026-08-05 — Lynis is now installed and running on ALL boxes via systemd timer) Methodology: Fortress Methodology (Lynis audit + Fail2Ban + UFW) Source: [Douglas Fresh — The Fortress Methodology](https://shorturl.at/mE8JM)

—

## Executive Summary (corrected 2026-08-05)

How Lynis runs (2026-08-05): the Debian package's systemd timer — `lynis.timer` → `lynis.service` (`lynis audit system –cronjob`, `OnCalendar=daily`, `RandomizedDelaySec=1800`) — runs daily ~00:05–00:20 on all three Linux boxes and writes `/var/log/lynis.log` (+ `/var/log/lynis-report.dat`). This SUPERSEDED the old `/tmp/lynis-cron.sh` cron (script lived in /tmp, wiped on reboot; cron entries removed 2026-08-05). Read `/var/log/lynis.log`, NOT `/var/log/lynis-cron.log` — the latter is stale/absent and was silently masking the audit for weeks (see log 2026-08-05).

—

## Installation Status

### kaburuaibox (Z840) — 192.168.0.253

```bash # Lynis installed $ lynis –version 3.0.9

# Fail2Ban enabled and active $ systemctl status fail2ban ● fail2ban.service - Fail2Ban Daemon

 Loaded: loaded (/lib/systemd/system/fail2ban.service)
 Active: active (running) since 2026-06-29 ...

```

### kaburusvr (Hetzner) — 49.13.202.144

```bash # Lynis installed (corrected 2026-08-05 — was “not installed” per 2026-06-29 report) $ lynis –version 3.0.9

# Runs daily via systemd timer $ systemctl is-active lynis.timer active

# Fail2Ban active $ systemctl is-active fail2ban active ```

### ubuntu-svr — 192.168.0.252

```bash # Lynis installed (corrected 2026-08-05) $ lynis –version 3.0.9

# Runs daily via systemd timer $ systemctl is-active lynis.timer active

# Fail2Ban active (corrected 2026-08-05 — was “inactive” per 2026-06-29 report) $ systemctl is-active fail2ban active ```

### TrueNAS — 192.168.0.251

```bash # Lynis not installed $ lynis –version zsh:1: command not found: lynis

# Fail2Ban inactive $ systemctl is-active fail2ban inactive ```

—

## Lynis Hardening Index (kaburuaibox)

Baseline score: 60 Method: `sudo lynis audit system` → captured to `/tmp/lynis-audit.log`

### Key Findings

- Lynis 3.0.9 is installed and functional - Hardening index score: 60/100 (60%) - Suggestions available but not yet applied (next step) - Potential improvements:

1. Purge old/removed packages (kernels, config files)
2. Apply needrestart, debsums, apt-list-changes, apt-show-versions
3. Harden SSH configuration
4. Harden login configuration
5. Harden cron jobs
6. Harden root password strength
7. Harden filesystem permissions
8. Harden suid binaries
9. Harden file integrity checks (Debsums)
10. Harden sudo configuration
11. Harden bootloader config
12. Harden network configuration
13. Harden DNS configuration
14. Harden syslog configuration
15. Harden inetd/xinetd configuration
16. Harden syslog-ng configuration (if used)
17. Harden Apache configuration (if used)
18. Harden PHP configuration (if used)
19. Harden MySQL/MariaDB configuration (if used)
20. Harden PostgreSQL configuration (if used)
21. Harden OpenSSH configuration
22. Harden NTP configuration (if used)
23. Harden cron.d directory
24. Harden /etc/issue files
25. Harden system boot logs
26. Harden system mail
27. Harden system logs
28. Harden file permissions on /etc
29. Harden file permissions on /var/log
30. Harden file permissions on /home
31. Harden file permissions on /tmp
32. Harden file permissions on /var/tmp
33. Harden file permissions on /dev
34. Harden file permissions on /run
35. Harden file permissions on /usr/local/bin
36. Harden file permissions on /usr/local/sbin
37. Harden file permissions on /usr/sbin
38. Harden file permissions on /usr/bin
39. Harden file permissions on /bin
40. Harden file permissions on /sbin
41. Harden file permissions on /lib
42. Harden file permissions on /libexec
43. Harden file permissions on /opt
44. Harden file permissions on /srv
45. Harden file permissions on /root
46. Harden file permissions on /var
47. Harden file permissions on /etc/skel
48. Harden file permissions on /etc/ssh
49. Harden file permissions on /etc/mail
50. Harden file permissions on /etc/sudoers

Next steps (from Fortress Methodology):

1. `sudo apt install needrestart debsums apt-list-changes apt-show-versions` 2. `sudo lynis show suggestions | tee /tmp/lynis-suggestions.log` 3. Apply suggestions incrementally, rerun audit to track score improvement 4. Target: reach 70+ hardening index

—

## Fail2Ban Status (corrected 2026-08-05)

### Active Boxes (kaburuaibox, kaburusvr, ubuntu-svr)

- ✅ kaburuaibox (Z840): fail2ban.service is `active (running)` - ✅ kaburusvr (Hetzner): fail2ban.service is `active (running)` - ✅ ubuntu-svr: fail2ban.service is `active (running)` (was inactive per 2026-06-29 report)

These boxes protect against SSH brute-force attacks by banning IPs that repeatedly fail login.

### Inactive Box (TrueNAS only)

- ❌ TrueNAS: fail2ban.service is `inactive` — no protection against brute-force

—

## Recommendations

### High Priority (remaining)

1. Install Lynis on TrueNAS — the only box without it (all three Linux boxes already have it since the original rollout). 2. ~~Install Lynis on all boxes~~ ✅ DONE — installed on kaburuaibox, kaburusvr, ubuntu-svr (3.0.9), running daily via systemd timer. 3. ~~Enable Fail2Ban on ubuntu-svr and TrueNAS~~ — ubuntu-svr ✅ DONE (active); TrueNAS still inactive.

### Medium Priority

4. Apply UFW (Uncomplicated Firewall) on all boxes

1. Install: `sudo apt install ufw`
2. Default policies: `sudo ufw default deny incoming`, `sudo ufw default allow outgoing`
3. Allow SSH: `sudo ufw allow 22/tcp`
4. Enable: `sudo ufw enable`

5. Hardening checklist (kaburuaibox)

1. Harden SSH configuration (`/etc/ssh/sshd_config`)
2. Harden login configuration (`/etc/login.defs`)
3. Harden cron jobs (`/etc/cron.*`)
4. Harden root password strength
5. Harden filesystem permissions (`chmod 600 /etc/passwd`, etc.)
6. Harden suid binaries (`lynis suggest suid`)
7. Harden file integrity checks (`debsums`)
8. Harden sudo configuration (`/etc/sudoers`)
9. Harden bootloader config (`/boot/grub/grub.cfg`)
10. Harden network configuration (`/etc/network/interfaces`, etc.)
11. Harden DNS configuration (`/etc/resolv.conf`, `dnsmasq` configs)
12. Harden syslog configuration (`rsyslog`, `syslog-ng`)
13. Harden inetd/xinetd configuration (if used)
14. Harden Apache/Nginx PHP/MySQL/PostgreSQL configs (if used)
15. Harden NTP configuration (`/etc/ntp.conf`)
16. Harden cron.d directory permissions
17. Harden `/etc/issue` files
18. Harden system boot logs
19. Harden system mail
20. Harden system logs
21. Harden file permissions on /etc, /var/log, /home, /tmp, /var/tmp, /dev, /run, /usr/local/bin, /usr/local/sbin, /usr/sbin, /usr/bin, /bin, /sbin, /lib, /libexec, /opt, /srv, /root, /var, /etc/skel, /etc/ssh, /etc/mail`
22. Harden OpenSSH configuration
23. Harden NTP configuration (if used)
24. Harden cron.d directory

6. Periodic Lynis audits

1. Run `sudo lynis audit system` weekly or after major updates
2. Track hardening index score trend
3. Document suggestions and resolutions

### Low Priority

7. ClamAV (virus scanner) on all boxes

1. `sudo apt install clamav clamav-daemon`
2. `sudo freshclam`
3. `sudo systemctl enable –now clamav-freshclam`
4. Schedule scans: `sudo clamscan –recursive –infected /home`

8. Rootkit Hunter (rkhunter) on all boxes

1. `sudo apt install rkhunter`
2. `sudo rkhunter –update`
3. Run checks: `sudo rkhunter –check –silent`
4. Compare results with `chkrootkit`

9. Debsums verification

1. `sudo debsums -c` to verify package integrity
2. Run periodically (weekly/monthly)

—

## Tools & Cheatsheet

- Lynis: https://github.com/CISOFyne/lynis - Fail2Ban: https://fail2ban.gitlab.io/_ - Fortress Methodology cheatsheet: (from Douglas Fresh — see video description for GitHub link) - TLDDR page: `fortress` (custom TLDDR page by Douglas Fresh)

—

## Related Documentation

- fail2ban — Fail2Ban configuration and usage - opnsense — Firewall configuration on OPNsense (primary firewall for all boxes) - z840 — kaburuaibox system details - kaburusvr — Hetzner VPS details - ubuntu-svr — ubuntu-svr details - truenas — TrueNAS SCALE details

—

## Appendix: Lynis Output (kaburuaibox)

Full audit log: `/tmp/lynis-audit.log` Hardening index: `Hardening index : 60 [############ ]`

Suggestions and test IDs are available but not yet applied. Use `sudo lynis show suggestions` to view them incrementally.

—

Status: ✅ All three Linux boxes hardened — Lynis 3.0.9 daily via systemd timer (HI: kaburuaibox 65, kaburusvr 71, ubuntu-svr 74), Fail2Ban active on all three Remaining work: Install Lynis + Fail2Ban on TrueNAS; apply Lynis suggestions to push hardening index above 70+ on all boxes.