Linux Vulnerability Scanners & Rootkit Scanners for Linux and Ubuntu

Classification of Vulnerability Scanning Methods

Security scans are categorized based on the scope and objective of the analysis:

• Database-based scanners: These tools focus specifically on vulnerabilities in databases to prevent the unauthorized extraction of sensitive information.
• Network-based scanners: These operate in real time across various devices within a network and cover both local area networks (LAN) and wireless networks (WLAN).
• Host-based scanners: These are deployed directly on the local host to analyze the internal state of the system. Examples include Lynis and OpenVAS.
• Cloud-based scanners: These tools examine web resources, cloud services, and other Internet-connected resources for security vulnerabilities.

Container Security and Orchestration Analysis

Anchore

Anchore is an open-source solution designed for containerized environments. It analyzes the security status of containers and the applications running within them. Once activated, the tool scans the entire environment and provides detailed reports, including an analysis of container images. Since it can be integrated into CI/CD pipelines, it is already used during the development phase of containerized applications.

Clair

Clair is available via GitHub and is an Apache project focused on Docker and similar container environments. It offers real-time monitoring to ensure that vulnerabilities are detected immediately. Clair aggregates vulnerability data from multiple sources to scan both the active environment and stored container images. It is fully compatible with Kubernetes orchestration.

Web Application Security Frameworks

Burp Suite

Burp Suite is used to test for vulnerabilities in web applications and to analyze HTTP/HTTPS requests. Although it can examine local operating systems, its primary function is to identify SQL injection and XSS vulnerabilities. It is included in the Kali Linux distribution. On Ubuntu systems, it is installed as follows:

sudo apt install burpsuite

System Scanning and Host Analysis

Lynis

Lynis is a security scanning tool compatible with Linux and macOS. Its scope includes local system scans, network-wide scans, and the analysis of Dockerfiles and container images. It identifies both direct vulnerabilities and general system misconfigurations.

It is installed using:

sudo apt install lynis

To perform a local system audit, use the following command:

lynis audit system

OpenVAS

The OpenVAS Vulnerability Assessment System is a comprehensive framework for network security. It is used for penetration testing of workloads and web applications and generates detailed reports on the current security status of the network infrastructure.

Rootkit Scanners: Tools for Rootkit Detection

chkrootkit

This terminal-based tool identifies rootkits on local systems or remote computers within a network. To install it, use:

sudo apt install chkrootkit

To start the scan, use the following command:

chkrootkit

Rkhunter

Rkhunter is a specialized tool for detecting rootkits on the local system.

Install it using:

sudo apt install rkhunter

To start a system check, use the following command:

sudo rkhunter --check

Questions and Answers About Vulnerability Scanners

How does the database’s up-to-date status affect the scan results?

Vulnerability scanners compare system signatures against a database of known vulnerabilities. If the database is out of date, the scanner will fail to detect recently discovered vulnerabilities (zero-day or recently patched vulnerabilities), leading to a false sense of security.

What is the main difference between host-based and network-based scanning?

Host-based scanning takes place internally on a specific computer and provides detailed insight into local configurations, installed software, and kernel versions. Network-based scanning examines the system from the outside, identifying open ports and services that are visible on the network and potentially exploitable.

How does CI/CD integration improve container security?

By integrating tools like Anchore into CI/CD pipelines, security scans can be performed before the image is deployed to production. This “shift-left” approach ensures that vulnerabilities are detected and remedied during the build process, rather than only after the application goes live.

Which tools are best suited for detecting unauthorized changes at the kernel level?

To detect rootkits designed to hide their presence at the kernel level, specialized tools such as chkrootkit and Rkhunter are required, as standard vulnerability scanners can be fooled by the rootkit’s obfuscation techniques.

Can Lynis be used for automated compliance checks?

Lynis provides system audit results and suggests security hardening measures. By reviewing the terminal output and the generated reports, administrators can adjust their system configurations to meet specific security standards and correct misconfigurations.