Lynis: a security audit of a Linux or Unix host with hardening suggestions

Lynis (about 16,000 stars on GitHub) is a host security auditing tool that has been in development since 2007. Its author, Michael Boelen, maintains it through his company CISOfy, and contributors add tests and distribution support. Unlike scanners that look at a system from the network, Lynis runs on the host itself with the privileges of the administrator, which lets it read configuration files, kernel parameters, installed packages, running services and file permissions, and compare them with hardening guidance.

What an audit covers

A run works through a few hundred tests grouped by area: boot and kernel settings, authentication and password policies, file systems and mounts, storage encryption, installed packages and pending updates, name resolution, firewall and network settings, SSH daemon options, database and web server configurations, logging, cryptographic libraries, and malware scanners. Each test records a status; failures become warnings (a problem to fix) or suggestions (an improvement to consider), each with an identifier that links to a page on the project’s site with more context. At the end Lynis prints a hardening index between 0 and 100, meant as a rough indication of progress rather than a certification.

Who it is for

• Administrators who have just installed a server and want a checklist of what to tighten before it goes into service.
• Operators who run the audit periodically and compare reports to see whether a system has drifted.
• People preparing for a compliance review who want to find the obvious gaps first.
• Learners, because the suggestion texts and linked pages explain why each setting matters.

How to install and try it

Lynis is a portable shell script with no dependencies beyond the standard Unix tools, so it runs on most Linux distributions, the BSDs, macOS, Solaris and AIX. Many distributions package it, CISOfy publishes its own repository with current versions, and cloning the repository and running the script in place also works.

git clone --depth 1 https://github.com/CISOfy/lynis.git
cd lynis
sudo ./lynis audit system

The full report is written to /var/log/lynis-report.dat and the screen output ends with the warnings and suggestions. Running without sudo is possible but skips the tests that need root. The project site documents the options, including profiles that disable tests which do not apply to a given host.

Credit

Lynis is created and maintained by Michael Boelen and CISOfy, with community contributions. It is published under the GNU GPL version 3. CISOfy also sells an enterprise version with central reporting; the open source script is complete on its own.