Perform General Security Tests on Linux Systems

By Kevin Beaver

Perform some general security testing on your Linux systems to help counter hacks. With testing, you can assess critical, and often overlooked, security issues on your Linux systems, such as the following:

  • Misconfigurations or unauthorized entries in the shadow password files, which could provide covert system access

  • Password complexity requirements

  • Users equivalent to root

  • Suspicious automated tasks configured in cron, the script scheduler program

  • Signature checks on system binary files

  • Checks for rootkits

  • Network configuration, including measures to prevent packet spoofing and other denial of service (DoS) attacks

  • Permissions on system log files

You can do all these assessments manually — or better yet, use an automated tool to do it for you! The following figure shows the initiation of the Tiger security-auditing tool.

Running the Tiger security-auditing tool.

Running the Tiger security-auditing tool.

The following figure shows a portion of the audit results. Talk about some great bang for no buck with this tool!

Partial output of the Tiger tool.

Partial output of the Tiger tool.

Alternatives to Tiger include Linux Security Auditing Tool (LSAT) as well as Bastille UNIX.