Security Stack: Lynis + AIDE + Falco

An der Stelle gehe ich davon aus dass mail funktioniert.

apt -y install msmtp msmtp-mta mailutils

/etc/msmtprc Beispiel:

defaults
tls            on
tls_starttls off
tls_certcheck off
tls_trust_file /etc/ssl/certs/ca-certificates.crt
logfile        /var/log/msmtp.log

# University SMTP server
account        uni-bremen
host           smtp.uni-bremen.de
port           465
from           git_rot@uni-bremen.de
user           git_rot
password       REDACTED
set_from_header on
auth on

# Set a default account
account default : uni-bremen

aliases /etc/aliases

1. LYNIS

# Add official CISOfy repo (newer than Ubuntu's package)
curl -fsSL https://packages.cisofy.com/keys/cisofy-software-public.key \
  | sudo gpg --dearmor -o /usr/share/keyrings/cisofy-software.gpg

echo "deb [arch=amd64 signed-by=/usr/share/keyrings/cisofy-software.gpg] \
  https://packages.cisofy.com/community/lynis/deb/ stable main" \
  | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list

sudo apt update && sudo apt install lynis -y

# First run — full audit (read the output carefully!)
sudo lynis audit system

# Cron: daily audit at 01:00, log to file
echo "0 1 * * * root /usr/sbin/lynis audit system --cronjob --quiet \
  >> /var/log/lynis-cron.log 2>&1" \
  | sudo tee /etc/cron.d/lynis

# View results anytime
# sudo lynis show warnings
# sudo lynis show suggestions

2. AIDE

sudo apt install aide aide-common -y

Configure what to monitor — edit before initializing!

Key file: /etc/aide/aide.conf

Default covers /bin /sbin /usr /etc — good defaults for a server

Optional: exclude noisy paths (Forgejo data, letsencrypt logs)

sudo tee -a /etc/aide/aide.conf << 'EOF'
# Forgejo exclusions
!/etc/letsencrypt/archive
!/var/log
!/var/cache
!/docker
EOF

aideinit

sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# Test a manual check
sudo aide --check

# Cron: daily check at 03:00, email root on changes
echo "0 3 * * * root /usr/bin/aide --check | \
  mail -s \"[AIDE] $(hostname) - $(date +\%F)\" root" \
  | sudo tee /etc/cron.d/aide

IMPORTANT: After system updates or intentional changes, refresh the DB:

sudo aide --update && sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db