Integration with Lynis

[Sabbat-cloud]

I am uploading some tools for network and system administration that I use every day in my work to GitHub.

https://github.com/Sabbat-cloud/sabbat-tools

I have been thinking about integrating a common output to read Lynis reports.
The idea is to output in JSON.
The structure would be as follows:.......
.......
if not path.is_file():
raise FileNotFoundError(f"Report not found: {path}")

raw: Dict[str, str] = {}
warnings: List[str] = []
suggestions: List[str] = []
tests: List[str] = []

with path.open("r", encoding="utf-8", errors="replace") as f:
    for line in f:
        line = line.strip()
        if not line or "=" not in line:
            continue
        k, v = line.split("=", 1)
        k = k.strip()
        v = v.strip()
        raw[k] = v
        lk = k.lower()
        if lk.startswith("warning"):
            warnings.append(v)
        elif lk.startswith("suggestion"):
            suggestions.append(v)
        elif lk.startswith("test"):
            tests.append(v)

out = {
    "schema_version": SCHEMA_VERSION,
    "generated_at": datetime.utcnow().isoformat() + "Z",
    "source": str(path),
    "hardening_index": raw.get("hardening_index") or raw.get("hardening_index_system"),
    "system": {
        "hostname": raw.get("hostname"),
        "os": raw.get("os"),
        "kernel": raw.get("kernel"),
        "profile": raw.get("profile"),
    },
    "warnings": warnings,
    "suggestions": suggestions,
    "tests": tests,
    "raw": raw,  #Audit
}
return out

def main() -> int:
p = argparse.ArgumentParser(
description="sabbat-lynis — Optional wrapper for Lynis: run (optional) and normalize report to JSON."
)
p.add_argument("--run", action="store_true", help="Run 'lynis audit system' before parsing")
p.add_argument("--report-file", default=DEFAULT_REPORT, help=f"Report path (default: {DEFAULT_REPORT})")
p.add_argument("--json", action="store_true", help="JSON output")
p.add_argument("--timeout", type=int, default=900, help="Timeout for Lynis execution (seconds)")
args = p.parse_args()

if args.run:
    rc = run_lynis(timeout=args.timeout)
    # No abortamos por códigos no-0: continuamos a parsear el reporte si existe.
    if rc != 0:
        print(f"Warning: lynis returned code {rc}", file=sys.stderr)

try:
    report = parse_report(Path(args.report_file))
except Exception as e:
    if args.json:
        print(json.dumps({"error": str(e)}, indent=2, ensure_ascii=False))
    else:
        print(f"Error: {e}", file=sys.stderr)
    return 1

if args.json:
    print(json.dumps(report, indent=2, ensure_ascii=False))
else:
    idx = report.get("hardening_index") or "?"
    host = (report.get("system") or {}).get("hostname") or "unknown"
    print(f"Lynis report for {host} — hardening index: {idx}")
    print(f"Warnings: {len(report['warnings'])} | Suggestions: {len(report['suggestions'])}")

# Exit 2 si hay avisos/sugerencias (útil en CI)
if report["warnings"] or report["suggestions"]:
    return 2
return 0

def cli_main():
raise SystemExit(main())

if name == "main":
cli_main()

The question is:
Could I publish a command like sabbat-lynis-report and then process it?
Congratulations on your work!

[mboelen]

Sure, you can process the data and output into a different format.