================================================================================
  Lynis Security Audit Report
  Host: webprod-03.internal.corp
  OS: Ubuntu 22.04.3 LTS (Jammy Jellyfish)
  Kernel: 5.15.0-91-generic
  Date: 2026-04-08 14:32:07 UTC
  Lynis version: 3.1.1
================================================================================

  Hardening Index: 42 / 100  [########....................]

================================================================================
  FINDINGS (34 total: 11 warnings, 23 suggestions)
================================================================================

--- WARNINGS ---

[W-001] SSH: PermitRootLogin is set to 'yes'
  Severity: HIGH
  File: /etc/ssh/sshd_config (line 14)
  Impact: Remote attackers can target the root account directly via brute-force.
  Recommendation: Set PermitRootLogin to 'no' or 'prohibit-password'.

[W-002] SSH: PasswordAuthentication is enabled
  Severity: HIGH
  File: /etc/ssh/sshd_config (line 18)
  Impact: Accounts with weak passwords are vulnerable to brute-force attacks.
  Recommendation: Disable PasswordAuthentication and enforce SSH key-based login.

[W-003] Firewall: No active firewall detected (ufw inactive, iptables default ACCEPT)
  Severity: CRITICAL
  Impact: All ports are reachable from any network. No ingress or egress filtering.
  Recommendation: Enable ufw or configure iptables with a default-deny policy.

[W-004] File permissions: /etc/shadow is world-readable (mode 0644)
  Severity: CRITICAL
  File: /etc/shadow
  Impact: Password hashes are accessible to all local users, enabling offline cracking.
  Recommendation: Set permissions to 0640 (root:shadow) or 0600 (root only).

[W-005] File permissions: /etc/passwd is world-writable (mode 0666)
  Severity: CRITICAL
  File: /etc/passwd
  Impact: Any user can modify user accounts, add root-level users, or change shells.
  Recommendation: Set permissions to 0644 (root:root).

[W-006] File permissions: /home/*/.ssh directories have mode 0755
  Severity: HIGH
  Path: /home/deploy/.ssh, /home/appuser/.ssh
  Impact: Other users can read authorized_keys and potentially access private keys.
  Recommendation: Set .ssh directories to 0700 and key files to 0600.

[W-007] Kernel: IP forwarding is enabled (net.ipv4.ip_forward = 1)
  Severity: MEDIUM
  Impact: This server may route traffic between interfaces, enabling pivot attacks.
  Recommendation: Set net.ipv4.ip_forward = 0 unless this host is a router.

[W-008] Automatic updates: unattended-upgrades is not installed
  Severity: HIGH
  Impact: Security patches are not applied automatically. Known vulnerabilities persist.
  Recommendation: Install and configure unattended-upgrades for security patches.

[W-009] Password policy: No password complexity requirements configured
  Severity: HIGH
  File: /etc/pam.d/common-password
  Impact: Users can set trivially weak passwords (e.g., "123456", "password").
  Recommendation: Install libpam-pwquality and enforce minlen=14, dcredit, ucredit, lcredit, ocredit.

[W-010] SUID binary: /usr/bin/pkexec has SUID bit set (CVE-2021-4034 Pwnkit)
  Severity: CRITICAL
  File: /usr/bin/pkexec (mode 4755, owner root)
  Impact: Unpatched pkexec allows any local user to escalate to root.
  Recommendation: Apply latest policykit-1 patch or remove SUID bit: chmod 0755 /usr/bin/pkexec.

[W-011] Disk encryption: No LUKS volumes detected
  Severity: MEDIUM
  Impact: Physical access or stolen disks expose all data in plaintext.
  Recommendation: Encrypt data partitions with LUKS. For cloud instances, enable provider-level encryption.

--- SUGGESTIONS ---

[S-001] Open ports: 22 listening services detected on public interfaces
  Detail: tcp/22 (sshd), tcp/80 (apache2), tcp/443 (apache2), tcp/3306 (mysql),
          tcp/5432 (postgresql), tcp/6379 (redis), tcp/8080 (tomcat),
          tcp/8443 (tomcat), tcp/9090 (prometheus), tcp/3000 (grafana),
          tcp/27017 (mongod), tcp/11211 (memcached), tcp/25 (postfix),
          tcp/110 (dovecot), tcp/143 (dovecot), tcp/21 (vsftpd),
          tcp/2049 (nfs), tcp/111 (rpcbind), tcp/5900 (vnc),
          tcp/8888 (jupyter-notebook), tcp/9200 (elasticsearch), tcp/5601 (kibana)
  Recommendation: Close unnecessary ports. Bind internal services to 127.0.0.1.

[S-002] Service: FTP server (vsftpd) is running
  Severity: LOW
  Impact: FTP transmits credentials in plaintext. Superseded by SFTP/SCP.
  Recommendation: Disable vsftpd and migrate to SFTP.

[S-003] Service: Telnet socket is active
  Severity: LOW
  Impact: Telnet transmits all data including passwords in plaintext.
  Recommendation: Disable telnet.socket and use SSH exclusively.

[S-004] Service: VNC server is running on tcp/5900
  Severity: MEDIUM
  Impact: VNC traffic may be unencrypted. Exposed to brute-force on public interface.
  Recommendation: Disable VNC or tunnel through SSH. Bind to 127.0.0.1.

[S-005] Service: Jupyter Notebook on tcp/8888 with no authentication token
  Severity: HIGH
  Impact: Unauthenticated code execution via web browser.
  Recommendation: Disable or require token/password authentication.

[S-006] Service: Redis on tcp/6379 with no authentication (protected-mode off)
  Severity: HIGH
  Impact: Unauthenticated access to in-memory data store. Known RCE vector.
  Recommendation: Set requirepass, bind to 127.0.0.1, enable protected-mode.

[S-007] Service: MongoDB on tcp/27017 with no authentication
  Severity: HIGH
  Impact: Unauthenticated access to database. Data theft and ransomware risk.
  Recommendation: Enable --auth and create database users.

[S-008] Service: Elasticsearch on tcp/9200 with no authentication
  Severity: HIGH
  Impact: Unauthenticated access to indexed data. Common target for data leaks.
  Recommendation: Enable X-Pack security or deploy behind a reverse proxy with auth.

[S-009] Service: Memcached on tcp/11211 bound to 0.0.0.0
  Severity: MEDIUM
  Impact: Can be abused for DDoS amplification attacks.
  Recommendation: Bind to 127.0.0.1 and restrict with firewall rules.

[S-010] Service: NFS (nfs/rpcbind) is running
  Severity: MEDIUM
  Impact: NFS shares may be accessible without authentication.
  Recommendation: Disable NFS if unused. If needed, restrict exports and use NFSv4 with Kerberos.

[S-011] Service: avahi-daemon is running
  Severity: LOW
  Impact: mDNS service discovery exposes host information on local network.
  Recommendation: Disable avahi-daemon on servers.

[S-012] Service: cups (print server) is running
  Severity: LOW
  Impact: Unnecessary attack surface on a server without printers.
  Recommendation: Disable cups.

[S-013] Kernel: ICMP redirects are accepted (net.ipv4.conf.all.accept_redirects = 1)
  Severity: MEDIUM
  Recommendation: Set net.ipv4.conf.all.accept_redirects = 0.

[S-014] Kernel: Source routing is accepted (net.ipv4.conf.all.accept_source_route = 1)
  Severity: MEDIUM
  Recommendation: Set net.ipv4.conf.all.accept_source_route = 0.

[S-015] Kernel: SYN cookies are disabled (net.ipv4.tcp_syncookies = 0)
  Severity: MEDIUM
  Impact: Server is vulnerable to SYN flood denial-of-service attacks.
  Recommendation: Set net.ipv4.tcp_syncookies = 1.

[S-016] Kernel: Core dumps enabled for SUID binaries (fs.suid_dumpable = 2)
  Severity: MEDIUM
  Impact: Core dumps of privileged programs may leak sensitive data.
  Recommendation: Set fs.suid_dumpable = 0.

[S-017] Kernel: Reverse path filtering disabled (net.ipv4.conf.all.rp_filter = 0)
  Severity: MEDIUM
  Recommendation: Set net.ipv4.conf.all.rp_filter = 1 to prevent IP spoofing.

[S-018] Users: Accounts with UID 0 besides root detected
  Detail: toor:x:0:0:alt root:/root:/bin/bash
  Recommendation: Remove duplicate UID 0 accounts.

[S-019] Users: User 'deploy' has NOPASSWD sudo access for ALL commands
  Severity: HIGH
  Detail: deploy ALL=(ALL) NOPASSWD: ALL
  Recommendation: Restrict sudo to specific commands needed for deployment.

[S-020] Cron: World-readable crontab files found
  Detail: /etc/crontab (mode 0644), /var/spool/cron/crontabs/root (mode 0644)
  Recommendation: Set crontab permissions to 0600.

[S-021] Logging: No remote syslog destination configured
  Severity: MEDIUM
  Impact: An attacker who gains root can erase all local logs.
  Recommendation: Forward logs to a remote SIEM or syslog server.

[S-022] PAM: No account lockout after failed login attempts
  Severity: MEDIUM
  File: /etc/pam.d/common-auth
  Recommendation: Configure pam_faillock with deny=5, unlock_time=900.

[S-023] Audit: auditd is not installed
  Severity: MEDIUM
  Impact: No kernel-level audit trail for file access, privilege escalation, or process creation.
  Recommendation: Install auditd and configure rules per CIS benchmark.

================================================================================
  SCAN COMPLETE
  Warnings: 11  |  Suggestions: 23  |  Hardening Index: 42/100
  Next steps: Address all CRITICAL and HIGH findings before production use.
================================================================================