Lynis is an open-source security auditing tool for Linux and Unix. In a few minutes it checks hundreds of settings, including SSH, the firewall, kernel parameters, file permissions, installed packages, logging and authentication, then gives you a hardening index and a prioritised list of suggestions. It’s an excellent way to see what you’ve missed on a server, and to track improvements.

Install

From distribution packages (may be older):

sudo apt install lynis         # Debian/Ubuntu
sudo dnf install lynis         # RHEL family (EPEL)

For the latest checks, use the CISOfy repository or run it straight from Git:

git clone https://github.com/CISOfy/lynis
cd lynis && sudo ./lynis audit system

Run an audit

sudo lynis audit system

It takes 1–3 minutes and is read-only. It doesn’t change anything. The output is long. The important parts are at the end:

  Lynis security scan details:

  Hardening index : 64 [############        ]
  Tests performed : 268
  Plugins enabled : 0

  -[ Lynis 3.x Results ]-

  Warnings (2):
  ----------------------------
  ! Found one or more vulnerable packages. [PKGS-7392]
  ! Couldn't find 2 responsive nameservers [NETW-2705]

  Suggestions (38):
  ----------------------------
  * Consider hardening SSH configuration [SSH-7408]
      - Details  : AllowTcpForwarding (set YES to NO)
  …

Full details are in /var/log/lynis.log. The machine-readable report is /var/log/lynis-report.dat.

Reading the results

  • Hardening index (0–100) — a rough score. A fresh minimal VPS often scores 55–65. Getting into the 75–85 range is realistic for a well-maintained server. Chasing 100 isn’t the goal.
  • Warnings — act on these first.
  • Suggestions — each has a test ID (e.g. SSH-7408). Look up the details:
sudo lynis show details SSH-7408

Prioritising for a typical VPS

Not every suggestion applies to every server. Tackle these first, since they matter most on internet-facing machines:

Area Typical suggestions Guide
Updates Vulnerable packages, no automatic updates unattended upgrades
SSH Root login, password auth, MaxAuthTries, forwarding key-only SSH
Firewall No active firewall rules UFW / firewalld
Brute force No Fail2Ban or equivalent Fail2Ban
Kernel sysctl hardening (rp_filter, redirects, kptr_restrict) sysctl tuning
Logging No remote logging, no auditd rsyslog, auditd
File integrity No AIDE or Tripwire AIDE
Malware No scanner rkhunter, ClamAV
Accounts Password ageing, umask, unused accounts passwd and chage, umask

Suggestions you may reasonably skip:

  • separate partitions for /home, /tmp and /var on a single-disk VPS (a big change for limited benefit; a tmpfs /tmp with noexec is a lighter option);
  • USB and FireWire storage drivers, which are irrelevant on a VPS;
  • compiler hardening on build servers that need compilers;
  • GRUB password, when console access is already protected by your provider account.

Record skipped items as conscious decisions.

Skip tests deliberately

Create a custom profile, so known exceptions don’t distract you on every run:

sudo tee /etc/lynis/custom.prf > /dev/null <<'EOF'
# Single-disk VPS: partitioning recommendations not applicable
skip-test=FILE-6310
# USB storage not relevant on VPS
skip-test=USB-1000
EOF

Track progress

Run Lynis regularly, for example monthly or after major changes, and compare the hardening index:

sudo lynis audit system --cronjob > /dev/null
grep hardening_index /var/log/lynis-report.dat

--cronjob runs without colours or pauses, which is ideal for scheduled runs. Combine it with a systemd timer and a simple alert when warnings appear. See systemd timers.

Lynis in context

Lynis audits configuration. It doesn’t detect active intrusions, scan for malware in files or test your web application. Use it alongside:

  • vulnerability scanning of exposed services (nmap -sV, see nmap);
  • web application scanning for your own apps;
  • monitoring and log review.

Quick reference

Task Command
Audit sudo lynis audit system
Details of a test sudo lynis show details TEST-ID
Log /var/log/lynis.log
Report data /var/log/lynis-report.dat
Scheduled run lynis audit system --cronjob
Skip tests skip-test=ID in /etc/lynis/custom.prf

Related: Linux server hardening checklist.

  • Security
  • Linux
  • Hardening