{"id":3933,"date":"2015-12-01T02:15:00","date_gmt":"2015-11-30T18:15:00","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=3933"},"modified":"2015-12-01T02:16:36","modified_gmt":"2015-11-30T18:16:36","slug":"lsat-linux-security-auditing-tool","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2015\/12\/lsat-linux-security-auditing-tool\/","title":{"rendered":"LSAT &#8211; Linux Security Auditing Tool"},"content":{"rendered":"<p>Linux Security Auditing Tool (LSAT) is a post install security auditing tool. It is modular in design, so new features can be added quickly. It checks inetd entries and scans for unneeded RPM packages. It is being expanded to work with Linux distributions other than Red Hat, and checks for kernel versions. <\/p>\n<p>It (for now) works under Linux (x86: Gentoo, RedHat, Debian, Mandrake; Sparc: SunOS (2.x), Redhat sparc, Mandrake Sparc; Apple OS X).<\/p>\n<p align=\"center\"><img decoding=\"async\" src=\"https:\/\/c2.staticflickr.com\/6\/5790\/23426981775_dae6ec59df.jpg\" alt=\"LSAT - Linux Security Auditing Tool\" \/><\/p>\n<p>You can also check out tools like:<\/p>\n<p>&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2014\/09\/lynis-v1-6-0-released-download-linux-security-auditing-tool\/\">Lynis v1.6.0 Released For Download \u2013 Linux Security Auditing Tool<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2015\/08\/tiger-unix-security-audit-intrusion-detection-tool\/\">Tiger \u2013 Unix Security Audit &#038; Intrusion Detection Tool<\/a><br \/>\n&#8211; <a href=\"https:\/\/www.darknet.org.uk\/2015\/06\/unix-privesc-check-unixlinux-user-privilege-escalation-scanner\/\">unix-privesc-check \u2013 Unix\/Linux User Privilege Escalation Scanner<\/a><\/p>\n<h3>Modules\/Features<\/h3>\n<ul>\n<li>checkbp: Checks for boot loader password.<\/li>\n<li>checkcfg: This module is performed last<\/li>\n<li>checkdotfiles: Looks for .forward, .exrc, .rhosts and .netrc files on the system.<\/li>\n<li>checkfiles: Checks that \/tmp and \/var\/tmp have sitcky bit set, checks utmp, wtmp, motd, mtab for chmod 644.<\/li>\n<li>checkftpusers: Checks that all accounts in \/etc\/passwd are in \/etc\/ftpusers.<\/li>\n<li>checkhostsfiles: Reads \/etc\/hosts.allow and \/etc\/hosts.deny files<\/li>\n<li>checkinetd: Checks either \/etc\/inetd.conf or \/etc\/xinetd.d\/* <\/li>\n<li>checkinittab: Checks to see if default runlevel is 5. If it is, give the user a warning.<\/li>\n<li>checkipv4: Checks to see that common forwarding and ignoring are off\/on in ipv4.<\/li>\n<li>checklimits: Performs simple check of limits.conf file<\/li>\n<li>checklogging: Performs a simple check to see if auth and authpriv logging facilities are on.<\/li>\n<li>checkmd5: Performs md5sum on all regular files on the system and saves in lsatmd5.out<\/li>\n<li>checknetforward: Checks that ipv4 forwarding is disabled under linux<\/li>\n<li>checkopenfiles: Checks all open files on the system using lsof (if installed)<\/li>\n<li>checkpasswd: Checks \/etc\/passwd for unneeded accounts.<\/li>\n<li>checkpkgs: Checks list of packages (rpms, debs) installed on the system.<\/li>\n<li>checksecuretty: Check to see if ttys other than tty[1-6] are in \/etc\/securetty<\/li>\n<li>checkset: Checks system for all setuid\/setgid files.<\/li>\n<li>checkssh: Check some security features of ssh for instance: root logins, X11 forwarding and the like.<\/li>\n<li>checkumask: Checks that the default umask on the system is sensible.<\/li>\n<li>checkwrite: Checks system for world writable files.<\/li>\n<li>checklistening: Checks for applications listening. This is an &#8220;extra&#8221; test<\/li>\n<\/ul>\n<h3>Usage<\/h3>\n<pre>.\/lsat [OPTIONS]\r\n\r\nOptions: \r\n\r\n        -d                      diff current and old md5, output in lsatmd5.diff\r\n        -f        Force a specific distribution test. Distro names are:\r\n                                redhat\r\n                                debian\r\n                                mandrake\r\n                                solaris\r\n                                gentoo\r\n                                macosx\r\n                                If no -f option, lsat will guess. If lsat can\r\n                                not guess the distribution, default is redhat.\r\n        -a            Show this (advanced) help page\r\n        -o            Output file name -- default is lsat.out\r\n        -r            Check rpm integrity -- redhat or mandrake only\r\n        -s            Silent mode\r\n        -v            Verbose output\r\n        -w            Output file in html format\r\n        -x            eXclude module(s) in filelist from checks...\r\n                                modules listed in filename will be excluded\r\n                                from checks. Valid module names are the module\r\n                                names themselves without the check.\r\n                                (e.g. set not checkset) the check.\r\n<\/pre>\n<p>You can download LSAT here:<\/p>\n<p><a href=\"http:\/\/download2.polytechnic.edu.na\/pub4\/sourceforge\/u\/project\/us\/usat\/lsat-0.9.8.2\/lsat-0.9.8.2.zip\">lsat-0.9.8.2.zip<\/a><\/p>\n<p>Or read more <a href=\"http:\/\/usat.sourceforge.net\/\">here<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Linux Security Auditing Tool (LSAT) is a post install security auditing tool. It is modular in design, so new features can be added quickly. It checks inetd entries and scans for unneeded RPM packages. It is being expanded to work with Linux distributions other than Red Hat, and checks for kernel versions. It (for now) [&hellip;]<\/p>\n","protected":false},"author":25,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"The Linux Security Auditing Tool (LSAT) is a post install security auditor for Linux\/Unix. It checks many system configurations and local network settings.","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[6,11],"tags":[8859,450],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"Darknet","author_link":"https:\/\/www.darknet.org.uk\/author\/darknet\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3933"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=3933"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/3933\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=3933"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=3933"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=3933"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}