Community maintained fixes

[maxdd]

Hello,
i have seen this great tool and decided to try it out.
I was wondering if there exist a community maintained implementation of the most common fixes and whether this is against the rules

Regards,

[mboelen]

Good that you found it.

Not sure if there is such a community at the moment. There are no rules to when it comes to using Lynis (besides adhering to GPLv3 and respect the community). So if it fine to create things "around" the project and support it. We are thinking to make a big chance to our documentation (especially of the controls) and considering if we want to open this fully up for contributors. This way the controls can also be translated, as just an example. So maybe that is in line with your thoughts?

[maxdd]

Hello,
That would be great, indeed knowing how the control/check is performed would lead to an easy implementation of the fix as well.

An automatic script (wild dream) or documentation community driven with how to approach the different fixes would be great.
It took me a little bit of time to understand that /etc/sudoers.d is supposed to have 750 permission, the check was still failing with 640 which theoretically is more secure, but again it was more of a trial and error approach which made me waste some time for example.

EDIT:
Another good example would be "basic" hardening suggestions on systemd services.
In my case i have 15 services which are flagged as UNSAFE and it would be great to reduce them with some community driven guidelines without knowing too much. Ofc i am willing to dig into each attributes but for "average" use case it might be a bit overkill and some guidelines would be great

[mboelen]

We are working on renewing our blog content. Looks like this can be a good source as well.

Regarding automatic scripts: that is something we know for sure we will not provide. So much things that can go wrong and impacting the Availability part of the CIA triad. It is typically also not needed, as one can script things themselves if they want to automate, or use configuration management tools.

[maxdd]

yeah that's why i wrote "wild dream" for the automation script. Although basic hardening suggestions collected here would be ideal