Line translation question

[zaaurus]

I would like to translate the lynis output as much as possible. The problem is that some of the lines I want to translate are just missing. I can't just add the right line and its translation to the file, it won't work.

Is it even possible to translate all the lines? If so, how do I add the lines I want?

Thank you.

[mboelen]

Hi @zaaurus - Thanks, some lines can not be translated yet. If you like you can suggest the specific lines that you see in the output, then we change those into variables. For generic items (like "OK") those can be suggested as well, in case they are not implemented yet.

[zaaurus]

Hi @mboelen.

List of unrealized strings:

  Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
  welcome to redistribute it under the terms of the GNU General Public License.
  See the LICENSE file for details about using this software.

  2007-2021, CISOfy - https://cisofy.com/lynis/
  Enterprise support available (compliance, plugins, interface and tools)

  Exception found!

  Function/test:  [GetHostID]
  Message:        Can't create hostid (no MAC addresses found)

  Help improving the Lynis community with your feedback!

  Steps:
  - Ensure you are running the latest version (/usr/bin/lynis update check)
  - If so, create a GitHub issue at https://github.com/CISOfy/lynis
  - Include relevant parts of the log file or configuration file

  Thanks!

=================================================================


=================================================================

  Exception found!

  Function/test:  [GetHostID]
  Message:        Can't create HOSTID, command ip not found

  Help improving the Lynis community with your feedback!

  Steps:
  - Ensure you are running the latest version (/usr/bin/lynis update check)
  - If so, create a GitHub issue at https://github.com/CISOfy/lynis
  - Include relevant parts of the log file or configuration file

  Thanks!

Boot and services

[WARNING]: Test CORE-1000 had a long execution:

  - Service Manager
  - Checking UEFI boot
  - Checking Secure Boot
  - Checking systemd-boot presence
  - Check running services (systemctl)
        Result: found 16 running services
  - Check enabled services at boot (systemctl)
        Result: found 11 enabled services
  - Check startup files (permissions)
  - Running 'systemd-analyze security'

Kernel

  - Checking CPU support (NX/PAE)
    CPU support: PAE and/or NoeXecute supported
  - Checking kernel version and release
  - Checking kernel type
  - Checking loaded kernel modules
      Found 128 active modules
  - Checking Linux kernel configuration file
  - Checking default I/O kernel scheduler
  - Checking core dumps configuration
    - configuration in systemd conf files
    - configuration in etc/profile
    - 'hard' configuration in security/limits.conf
    - 'soft' configuration in security/limits.conf
    - Checking setuid core dumps configuration
  - Check if reboot is needed

Memory and processes

  - Checking /proc/meminfo
  - Searching for dead/zombie processes
  - Searching for IO waiting processes
  - Search prelink tooling

Users group and authentication

  - Administrator accounts
  - Unique UIDs
  - Consistency of group files (grpck)
  - Unique group IDs
  - Unique group names
  - Password file consistency
  - Password hashing methods
  - Checking password hashing rounds
  - Query system users (non daemons)
  - NIS+ authentication support
  - NIS authentication support
  - Sudoers file(s)
    - Permissions for directory: /etc/sudoers.d
    - Permissions for: /etc/sudoers
    - Permissions for: /etc/sudoers.d/pwfeedback
  - PAM password strength tools
  - PAM configuration file (pam.conf)
  - PAM configuration files (pam.d)
  - PAM modules
  - LDAP module in PAM
  - Accounts without expire date
  - Accounts without password
  - Locked accounts
  - Checking user password aging (minimum)
  - User password aging (maximum)
  - Checking expired passwords
  - Checking Linux single user mode authentication
  - Determining default umask
    - umask (/etc/profile and /etc/profile.d)
    - umask (/etc/login.defs)
  - LDAP authentication support
  - Logging failed login attempts 

Shells

  - Checking shells from /etc/shells
    Result: found 5 shells (valid shells: 5).
    - Session timeout settings/tools
  - Checking default umask values
    - Checking default umask in /etc/bash.bashrc
    - Checking default umask in /etc/profile

File systems

  - Checking mount points
    - Checking /home mount point
    - Checking /tmp mount point
    - Checking /var mount point
  - Query swap partitions (fstab)
  - Testing swap partitions
  - Testing /proc mount (hidepid)
  - Checking for old files in /tmp
  - Checking /tmp sticky bit
  - Checking /var/tmp sticky bit
  - ACL support root file system
  - Mount options of /
  - Mount options of /boot
  - Mount options of /dev
  - Mount options of /dev/shm
  - Mount options of /run
  - Mount options of /tmp
  - Total without nodev:6 noexec:11 nosuid:4 ro or noexec (W^X): 11 of total 25
  - Disable kernel support of some filesystems

USB Devices

  - Checking usb-storage driver (modprobe config)
  - Checking USB devices authorization
  - Checking USBGuard

Storage

  - Checking firewire ohci driver (modprobe config)

NFS

  - Check running NFS daemon

Name services

  - Searching DNS domain name
  - Checking /etc/hosts
    - Duplicate entries in hosts file
    - Presence of configured hostname in /etc/hosts
    - Hostname mapped to localhost
    - Localhost mapping to IP address   

Ports and packages

  - Searching package managers
    - Searching pacman package manager
      - Querying pacman package manager
    - Searching update status (checkupdates)
  - Checking package audit tool 
    Found: arch-audit

Networking

  - Checking IPv6 configuration
      Configuration method
      IPv6 only 
  - Checking configured nameservers
    - Testing nameservers
      Nameserver: 127.0.0.1
    - DNSSEC supported (systemd-resolved)
  - Checking default gateway
  - Getting listening ports (TCP/UDP)
  - Checking promiscuous interfaces
  - Checking waiting connections
  - Checking status DHCP client
  - Checking for ARP monitoring software
  - Uncommon network protocols

Printers and Spools

  - Checking cups daemon
  - Checking lp daemon

Firewalls

  - Checking iptables kernel module
  - Checking host based firewall 

SSH support

  - Checking running SSH daemon
    - Searching SSH configuration
    - OpenSSH option: AllowTcpForwarding
    - OpenSSH option: ClientAliveCountMax
    - OpenSSH option: ClientAliveInterval
    - OpenSSH option: Compression
    - OpenSSH option: FingerprintHash
    - OpenSSH option: GatewayPorts
    - OpenSSH option: IgnoreRhosts
    - OpenSSH option: LoginGraceTime
    - OpenSSH option: LogLevel 
    - OpenSSH option: MaxAuthTries
    - OpenSSH option: MaxSessions
    - OpenSSH option: PermitRootLogin
    - OpenSSH option: PermitUserEnvironment
    - OpenSSH option: PermitTunnel
    - OpenSSH option: Port
    - OpenSSH option: PrintLastLog
    - OpenSSH option: StrictModes
    - OpenSSH option: TCPKeepAlive
    - OpenSSH option: UseDNS
    - OpenSSH option: X11Forwarding
    - OpenSSH option: AllowAgentForwarding
    - OpenSSH option: AllowUsers
    - OpenSSH option: AllowGroups

SNMP support

  - Checking running SNMP daemon

LDAP Services

  - Checking OpenLDAP instance

PHP

  - Checking PHP

Squid support

  - Checking running Squid daemon

Logging and files

  - Checking for a running log daemon
    - Checking Syslog-NG status
    - Checking systemd journal status
    - Checking Metalog status
    - Checking RSyslog status
    - Checking RFC 3195 daemon status
    - Checking minilogd instances 
  - Checking logrotate presence 
  - Checking remote logging   
  - Checking log directories (static list) 
  - Checking open log files

Insecure services

  - Installed inetd package
  - Installed xinetd package 
    - xinetd status
  - Installed rsh client package 
  - Installed rsh server package 
  - Installed telnet client package 
  - Installed telnet server package  
  - Checking NIS client installation 
  - Checking NIS server installation
  - Checking TFTP client installation 
  - Checking TFTP server installation

Banners and identification

    - /etc/issue contents

Scheduled tasks

  - Checking crontab and cronjob files

Accounting

  - Checking accounting information
  - Checking sysstat accounting data
  - Checking auditd

Time and synchronization

  - Checking for a running NTP daemon or client

Cryptography

  - Checking for expired SSL certificates [0/3]
  - Found 1 LUKS encrypted block devices.
  - Found 0 encrypted and 1 unencrypted swap devices in use.
  - Kernel entropy is sufficient 
  - HW RNG & rngd           
  - SW prng                                       
  - MOR variable not found

Security frameworks

  - Checking presence AppArmor 
    - Checking AppArmor status
        Found 101 unconfined processes
  - Checking presence SELinux           
  - Checking presence TOMOYO Linux 
  - Checking presence grsecurity    
  - Checking for implemented MAC framework 

Software: file integrity

  - Checking file integrity tools
  - dm-integrity (status)
  - dm-verity (status)
  - Checking presence integrity tool

System tooling

  - Checking automation tooling
  - Automation tooling     
  - Checking for IDS/IPS tooling

File permissions

  - Starting file permissions check
    File: /etc/group 
    File: /etc/group-
    File: /etc/issue   
    File: /etc/motd       
    File: /etc/passwd            
    File: /etc/passwd-                      
    File: /etc/ssh/sshd_config

Home directories

  - Permissions of home directories
  - Ownership of home directories
  - Checking shell history files 

Kernel hardening

  - Comparing sysctl key pairs with scan profile

Hardening

    - Installed compiler(s)  
    - Installed malware scanner 
    - Non-native binary formats

Custom tests

  - Running custom tests... 

Great, no warnings

Suggestions

Follow-up:
  ----------------------------
  - Show details of a test (lynis show details TEST-ID)
  - Check the logfile for all details (less /var/log/lynis.log)
  - Read security controls texts (https://cisofy.com)
  - Use --upload to upload data to central system (Lynis Enterprise users)

Lynis security scan details:

  Hardening index : 65 [#############       ]
  Tests performed : 235
  Plugins enabled : 0

  Components:
  - Firewall               [V]
  - Malware scanner        [V]

  Scan mode:
  Normal [V]  Forensics [ ]  Integration [ ]  Pentest [ ]

  Lynis modules:
  - Compliance status      [?]
  - Security audit         [V]
  - Vulnerability scan     [V]

  Files:
  - Test and debug information      : /var/log/lynis.log
  - Report data                     : /var/log/lynis-report.dat

================================================================================

  Lynis 3.0.5

  Auditing, system hardening, and compliance for UNIX-based systems
  (Linux, macOS, BSD, and others)

  2007-2021, CISOfy - https://cisofy.com/lynis/
  Enterprise support available (compliance, plugins, interface and tools)

================================================================================

  [TIP]: Enhance Lynis audits by adding your settings to custom.prf (see /etc/lynis/default.prf for all settings)

and OUTDATED

[zaaurus]

Also, although these lines have a translation, they are displayed exclusively in English:

Initializing program
DONE
DEFAULT
WEAK
NON DEFAULT

[z36r2850o]

No progress? :(