A comprehensive security audit for AWS Linux servers requires checking two distinct layers: the AWS Cloud Infrastructure Level (EC2, IAM, VPC) and the OS / Host Level (Linux instance internals).
Phase 1: AWS Cloud Infrastructure Audit
1. Identity & Access Management (IAM)
- Instance Profiles: Verify EC2 instances use IAM roles instead of hardcoded AWS access keys (
.aws/credentialsor environment variables). - Least Privilege: Ensure attached IAM policies grant only necessary permissions (e.g., restrict S3 write access to specific buckets).
- AWS Systems Manager (SSM): Audit whether instances are attached to SSM Session Manager to eliminate the need for open SSH ports (22) and static SSH keys.
2. Network Security (VPC & Security Groups)
- SSH Access: Verify port 22 is never open to
0.0.0.0/0. Restrict access to specific corporate IP ranges or access via SSM / Bastion host. - Public IP Exposure: Ensure backend servers reside in Private Subnets without public IPv4/IPv6 addresses attached.
- Unused Security Groups:Audit and delete unattached security groups to avoid accidental misconfigurations.
3. Storage & Backups (EBS & S3)
- EBS Encryption: Confirm all attached EBS volumes (and default account EBS configuration) have KMS encryption enabled at rest.
- Backup Recovery: Check AWS Backup or Lifecycle Manager policies for regular snapshots and cross-region replication for critical instances.
Phase 2: OS-Level Linux Server Audit
1. SSH Hardening (/etc/ssh/sshd_config)
Run a quick audit of key SSH settings:
Bash
egrep -i "^(PermitRootLogin|PasswordAuthentication|PubkeyAuthentication|X11Forwarding)" /etc/ssh/sshd_config
- PermitRootLogin: Set to
noorprohibit-password. - PasswordAuthentication: Set to
no(enforce key-based or SSM authentication). - X11Forwarding: Set to
no.
2. Account & User Privilege Audit
# Check users with superuser (UID 0) accessawk -F: '($3 == "0") {print $1}' /etc/passwd# Check for unauthorized sudoers rulescat /etc/sudoers /etc/sudoers.d/* | grep -v '^#' | grep -v '^$'# Find active user SSH authorized keysfind /home /root -name "authorized_keys" -exec ls -la {} \;
3. Patching & Package Management
- Verify system packages are updated and automated security patches are active:
- Amazon Linux / RHEL / CentOS:
dnf updateinfo list security - Ubuntu / Debian:
apt update && apt list --upgradable
- Amazon Linux / RHEL / CentOS:
4. Listening Ports & Network Services
# Inspect all active open listening portsss -tulpn
- Ensure non-essential services (e.g., RPC, telnet, test databases) are stopped and disabled (
systemctl disable --now <service>).
5. File System & Storage Permissions
# Check world-writable files across the systemfind / -maxdepth 3 -type f -perm -0002 -ls 2>/dev/null
- Verify system critical directories (
/etc/shadow,/etc/passwd,/etc/sudoers) have strict0600or0440permissions.
Phase 3: Automated Audit Tools
Instead of manually running commands across every server, run these industry-standard open-source audit frameworks:
- Lynis (Host OS Security Scanner):
sudo apt install lynis -y # Ubuntu/Debian # OR: sudo dnf install lynis -y # Amazon Linux/RHEL sudo lynis audit system - Prowler (AWS Cloud Infrastructure Scanner):
pip install prowler prowler aws --services ec2 vpc iam - AWS Inspector: Enable AWS Inspector in the AWS Console for continuous automated vulnerability assessments on EC2 instances.
Here is the implementation for all three security audit requests: the automated Lynis script, the hardened SSH configuration, and the Prowler setup for AWS IAM and EC2.
1. Automated Lynis Setup & Reporting Script
Save this script as run_lynis_audit.sh, make it executable with chmod +x run_lynis_audit.sh, and run it with sudo ./run_lynis_audit.sh.
Bash
#!/bin/bash# Description: Automated Lynis installation, audit execution, and report generationset -eREPORT_DIR="/var/log/lynis-reports"TIMESTAMP=$(date +"%Y%m%d_%H%M%S")REPORT_FILE="${REPORT_DIR}/audit_report_${TIMESTAMP}.txt"echo "[+] Preparing report directory: ${REPORT_DIR}"mkdir -p "${REPORT_DIR}"chmod 700 "${REPORT_DIR}"# Detect Package Manager and Install Lynis if missingif ! command -v lynis &> /dev/null; then echo "[+] Lynis not found. Installing..." if command -v dnf &> /dev/null; then dnf install -y lynis elif command -v apt-get &> /dev/null; then apt-get update && apt-get install -y lynis else echo "[-] Supported package manager (apt/dnf) not found. Exiting." exit 1 fifiecho "[+] Running Lynis system audit..."# --quick skips waiting for keypresses; --warnings-only keeps summary focusedlynis audit system --quick | tee "${REPORT_FILE}"echo "[+] Verification:"if [ -f "${REPORT_FILE}" ]; then echo " Success! Audit log saved to: ${REPORT_FILE}" echo " Lynis report data written to: /var/log/lynis.log" echo " Lynis report details written to: /var/log/lynis-report.dat"else echo " Audit failed to generate report file."fi
2. AWS EC2 Hardened SSH Configuration (/etc/ssh/sshd_config)
Replace or update /etc/ssh/sshd_config with the following hardened settings.
Ini, TOML
# /etc/ssh/sshd_config - Hardened AWS EC2 ConfigurationPort 22Protocol 2# Authentication SettingsPermitRootLogin noMaxAuthTries 3PubkeyAuthentication yesPasswordAuthentication noPermitEmptyPasswords noHostbasedAuthentication no# Security & Session ControlsX11Forwarding noAllowTcpForwarding noAllowAgentForwarding noClientAliveInterval 300ClientAliveCountMax 2LoginGraceTime 30# Modern Safe Ciphers & MACs (Disables weak algorithms)KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.comMACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com# LoggingSyslogFacility AUTHLogLevel VERBOSE
Testing & Applying the Configuration:
Bash
# 1. Verify syntax before restarting (MUST pass without errors)sudo sshd -t# 2. Restart SSH daemonsudo systemctl restart sshd
Verification: Open a new terminal window and attempt to connect via SSH using a password or root account to confirm access is rejected, while standard key-based access works. Do not close your existing SSH session until verified.
3. Scan AWS IAM & EC2 using Prowler
To scan your cloud infrastructure layer with Prowler from a local terminal or admin server:
# Step 1: Install Python virtual environment and Prowlerpython3 -m venv prowler-envsource prowler-env/bin/activatepip install --upgrade pippip install prowler# Step 2: Configure AWS credentials or ensure active IAM profile# Must have SecurityAudit / ViewOnlyAccess permissionsaws configure# Step 3: Run Prowler targeted scan for EC2, VPC, and IAM servicesprowler aws --services ec2 vpc iam
Generating HTML Reports:
prowler aws --services ec2 vpc iam -M html
Verification: Look for generated report files in the output/ folder (e.g., output/prowler-output-*.html). Open the HTML file in a browser to review failed checks and remediation guidelines.
