A comprehensive security audit for AWS Linux servers

techhadoop aws, linux, security

A comprehensive security audit for AWS Linux servers requires checking two distinct layers: the AWS Cloud Infrastructure Level (EC2, IAM, VPC) and the OS / Host Level (Linux instance internals).

Phase 1: AWS Cloud Infrastructure Audit

1. Identity & Access Management (IAM)

  • Instance Profiles: Verify EC2 instances use IAM roles instead of hardcoded AWS access keys (.aws/credentials or environment variables).
  • Least Privilege: Ensure attached IAM policies grant only necessary permissions (e.g., restrict S3 write access to specific buckets).
  • AWS Systems Manager (SSM): Audit whether instances are attached to SSM Session Manager to eliminate the need for open SSH ports (22) and static SSH keys.

2. Network Security (VPC & Security Groups)

  • SSH Access: Verify port 22 is never open to 0.0.0.0/0. Restrict access to specific corporate IP ranges or access via SSM / Bastion host.
  • Public IP Exposure: Ensure backend servers reside in Private Subnets without public IPv4/IPv6 addresses attached.
  • Unused Security Groups:Audit and delete unattached security groups to avoid accidental misconfigurations.

3. Storage & Backups (EBS & S3)

  • EBS Encryption: Confirm all attached EBS volumes (and default account EBS configuration) have KMS encryption enabled at rest.
  • Backup Recovery: Check AWS Backup or Lifecycle Manager policies for regular snapshots and cross-region replication for critical instances.

Phase 2: OS-Level Linux Server Audit

1. SSH Hardening (/etc/ssh/sshd_config)

Run a quick audit of key SSH settings:

Bash

egrep -i "^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|X11Forwarding)" /etc/ssh/sshd_config
  • PermitRootLogin: Set to no or prohibit-password.
  • PasswordAuthentication: Set to no (enforce key-based or SSM authentication).
  • X11Forwarding: Set to no.

2. Account & User Privilege Audit

# Check users with superuser (UID 0) access
awk -F: '($3 == "0") {print $1}' /etc/passwd
# Check for unauthorized sudoers rules
cat /etc/sudoers /etc/sudoers.d/* | grep -v '^#' | grep -v '^$'
# Find active user SSH authorized keys
find /home /root -name "authorized_keys" -exec ls -la {} \;

3. Patching & Package Management

  • Verify system packages are updated and automated security patches are active:
    • Amazon Linux / RHEL / CentOS:
      dnf updateinfo list security
    • Ubuntu / Debian:
      apt update && apt list --upgradable

4. Listening Ports & Network Services

# Inspect all active open listening ports
ss -tulpn
  • Ensure non-essential services (e.g., RPC, telnet, test databases) are stopped and disabled (systemctl disable --now <service>).

5. File System & Storage Permissions

# Check world-writable files across the system
find / -maxdepth 3 -type f -perm -0002 -ls 2>/dev/null
  • Verify system critical directories (/etc/shadow, /etc/passwd, /etc/sudoers) have strict 0600 or 0440 permissions.

Phase 3: Automated Audit Tools

Instead of manually running commands across every server, run these industry-standard open-source audit frameworks:

  1. Lynis (Host OS Security Scanner):
    sudo apt install lynis -y # Ubuntu/Debian # OR: sudo dnf install lynis -y # Amazon Linux/RHEL sudo lynis audit system
  2. Prowler (AWS Cloud Infrastructure Scanner):
    pip install prowler prowler aws --services ec2 vpc iam
  3. AWS Inspector: Enable AWS Inspector in the AWS Console for continuous automated vulnerability assessments on EC2 instances.

Here is the implementation for all three security audit requests: the automated Lynis script, the hardened SSH configuration, and the Prowler setup for AWS IAM and EC2.

1. Automated Lynis Setup & Reporting Script

Save this script as run_lynis_audit.sh, make it executable with chmod +x run_lynis_audit.sh, and run it with sudo ./run_lynis_audit.sh.

Bash

#!/bin/bash
# Description: Automated Lynis installation, audit execution, and report generation
set -e
REPORT_DIR="/var/log/lynis-reports"
TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
REPORT_FILE="${REPORT_DIR}/audit_report_${TIMESTAMP}.txt"
echo "[+] Preparing report directory: ${REPORT_DIR}"
mkdir -p "${REPORT_DIR}"
chmod 700 "${REPORT_DIR}"
# Detect Package Manager and Install Lynis if missing
if ! command -v lynis &> /dev/null; then
    echo "[+] Lynis not found. Installing..."
    if command -v dnf &> /dev/null; then
        dnf install -y lynis
    elif command -v apt-get &> /dev/null; then
        apt-get update && apt-get install -y lynis
    else
        echo "[-] Supported package manager (apt/dnf) not found. Exiting."
        exit 1
    fi
fi
echo "[+] Running Lynis system audit..."
# --quick skips waiting for keypresses; --warnings-only keeps summary focused
lynis audit system --quick | tee "${REPORT_FILE}"
echo "[+] Verification:"
if [ -f "${REPORT_FILE}" ]; then
    echo "    Success! Audit log saved to: ${REPORT_FILE}"
    echo "    Lynis report data written to: /var/log/lynis.log"
    echo "    Lynis report details written to: /var/log/lynis-report.dat"
else
    echo "    Audit failed to generate report file."
fi

2. AWS EC2 Hardened SSH Configuration (/etc/ssh/sshd_config)

Replace or update /etc/ssh/sshd_config with the following hardened settings.

Ini, TOML

# /etc/ssh/sshd_config - Hardened AWS EC2 Configuration
Port 22
Protocol 2
# Authentication Settings
PermitRootLogin no
MaxAuthTries 3
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
HostbasedAuthentication no
# Security & Session Controls
X11Forwarding no
AllowTcpForwarding no
AllowAgentForwarding no
ClientAliveInterval 300
ClientAliveCountMax 2
LoginGraceTime 30
# Modern Safe Ciphers & MACs (Disables weak algorithms)
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com
# Logging
SyslogFacility AUTH
LogLevel VERBOSE

Testing & Applying the Configuration:

Bash

# 1. Verify syntax before restarting (MUST pass without errors)
sudo sshd -t
# 2. Restart SSH daemon
sudo systemctl restart sshd

Verification: Open a new terminal window and attempt to connect via SSH using a password or root account to confirm access is rejected, while standard key-based access works. Do not close your existing SSH session until verified.

3. Scan AWS IAM & EC2 using Prowler

To scan your cloud infrastructure layer with Prowler from a local terminal or admin server:

# Step 1: Install Python virtual environment and Prowler
python3 -m venv prowler-env
source prowler-env/bin/activate
pip install --upgrade pip
pip install prowler
# Step 2: Configure AWS credentials or ensure active IAM profile
# Must have SecurityAudit / ViewOnlyAccess permissions
aws configure
# Step 3: Run Prowler targeted scan for EC2, VPC, and IAM services
prowler aws --services ec2 vpc iam

Generating HTML Reports:

prowler aws --services ec2 vpc iam -M html

Verification: Look for generated report files in the output/ folder (e.g., output/prowler-output-*.html). Open the HTML file in a browser to review failed checks and remediation guidelines.

Leave a Reply