Entrevista a Michael Boelen, el creador de Lynis y rkhunter

Seguro que a quienes os ha tocado administrar y securizar máquinas Linux, tenéis a Lynis como una de las herramientas de cabecera, para poder comprobar si os habéis dejado algún agujero por tapar. De hecho, en los inicios de SbD, ya hablábamos sobre esta fantástica herramienta. Pero no Michael no sólo es conocido por Lynis, sino por haber desarrollado tiempo atrás otra herramienta que no puede faltar cuando se analiza un incidente de seguridad en Linux, en el que hay una máquina comprometida: RKHunter.

Pues hoy os traigo una entrevista al padre de ambas criaturas: Michael Boelen. Holandés y un auténtico experto en Linux. Sin duda una persona de la que aprender, tanto a nivel técnico como por desarrollar Lynis, su proyecto personal, y potenciarlo hasta dedicarse profesionalmente en cuerpo y alma a él.

La entrevista está en inglés. Pensé en traducirla al español, pero creo que así como lo he hecho en otras, el resultado ha perdido su esencia. Creo que es mejor dejarla en el idioma original y, a no ser que me lo pidáis en los comentarios, la dejamos así.

SbD - Michael, you are the developer or Lynis, one of the main automated internal auditing tools for GNU/Linux systems. What did make you to start developing this useful tool?

Michael Boelen The best tools or apps are usually created because of a specific need. I needed a quick way to replace hardening guides (like the CIS benchmarks) during my years as a system administrator. Reading the documents simply take too much time. And instead of just checking the boxes, I wanted a tool that could test systems on a daily basis and tell me what could be improved.

- I guess you use CIS Benchmarks Guides to adjust the checks they recommend to improve your tool. Which any other sources do you have in mind?

That is the beauty of a tool like Lynis. It is not limited to one single standard or a set of best practices. Instead, we take the most important best practices and combine them into a set of smaller tests. We group them by their focus area, like cryptography, database, mail, web, etc.

- Lynis also has plugins developed by the community, can you talk us about them?

The plugin system of Lynis extends the normal set of tests. Where normal tests have a clear outcome (good, bad, or could be better), plugins are mainly focused on collecting data. This data could then be used during the tests later on, or their output could be stored in a data report. This data report could then be fed into a SIEM, or a management interface.

- Have you ever thought about creating profiles to be able to measure a

system security level depending on the checks that standards like PCI-DSS requires?

We definitely have. In 2013 we started actually a company (CISOfy) to put more development into Lynis. For companies that have specific requirements (like being compliant with PCI-DSS, HIPAA, or ISO27001), we offer a management interface. It leverages the Lynis client tool and adds a web-based interface where all data is stored. And when you have all data in one place, the sum and value of all data from all individual systems become much higher. For example finding the questions to how do systems compare? Are similar systems also similarly configured? And for those with a need of compliance checking, the Enterprise version can do a quick scan in this area. Simply add a machine and add a compliance standard, and it will be checked.

- Although Lynis is free, you have this Enterprise version you mentioned. Do you earn your life with this project or do you work somewhere else and Lynis is a hobby or a complementary job for you?

Lynis started as a hobby project in 2007. With the business support from CISOfy in 2013, the project has seen a great increase in number of users and contributors. I'm full-time involved with business and software development, and that is for us our main stream of income.

- There are other tools that says to do the same as Lynis, like Linux Check list or LSAT. Why is Lynis better than the rest?

During the last 10 years, several tools have seen the light. The big problem with all the tools: they are badly maintained. Still, I see occasionally new projects show up and after 6-12 months stop. With Lynis celebrating its 10th anniversary, you can be assured that it is well-known and still being maintained. Compared to commercial solutions, Lynis is open-source and vendor-neutral. That is another important aspect of our tool. The last one might be surprising, but Lynis is written in shell script. Not in bash, but bourne shell (/bin/sh). This makes it perfect for people to create their own tests, even if you would use something like Python. Simply fetch the output of your script and embed into your own test. Another benefit is that Lynis runs on AIX, FreeBSD, OpenBSD, Linux, macOS, and others. As long as you have that basic /bin/sh shell available.

- Do you have any tips for people that like to contribute to open source projects?

Maybe the most important tip is that your involvement with a project could result in the most unbelievable things. Think of finding a job, a mentor, or a friendship. Even if you can't program, you can help making any project better by contributing to the documentation by sharing areas that could be improved. Even if you find a small typo, that is already worth sharing.

- For those who can do programming, any tips?

If you have the gift of being a developer, then I suggest valuing your time. In my opinion, it is better to make one very good tool, than three mediocre tools. Focus on easy of use, documentation, design, sane defaults, contributor guidelines and regular program updates. Last but not least, learn the skill of marketing. Even the best open source tools need marketing.

- Besides Lynis, are there any projects that you are involved in?

People might know me from my first big project in the past, named rkhunter (Rootkit Hunter). While I still read about malware, I don't do as much research nowadays. The time of dissecting rootkits is over. Instead, I put in a lot of time to share knowledge regarding Linux security (like 'The state of Linux security' --> https://linux-audit.com/the-state-of-linux-security/). The blog Linux Audit is one of these places where I share such knowledge. As a technical founder, I find it important to help making the digital world a little bit more secure. By sharing tips and ideas, we can inspire others to take action. Another area includes giving presentations at meetups and conferences. Last year about 10 presentations, of which most are available online. Speaking about conferences, I help to organize one in The Netherlands. It is a Dutch UNIX user group (NLUUG), focused on open standards like open source and GNU/Linux. Besides being a board member, I provide my guidance in the program committee to select the right speakers. And another small side project I'm running, is the Twitter handle @infosec_cfp. It helps security specialists to get involved in call for papers/proposals of any security conference they like to speak.

- If we like to know more about you, what is a good place to look?

Searching my name would be a good start. You will find I'm on Twitter (@mboelen), LinkedIn, and have a personal website (michaelboelen.com). And don't forget to read the blog [https://linux-audit.com] :)