A periodic security audit systematically reviews your server's actual configuration against best practices, catching drift and gaps that accumulate over time. This guide provides a comprehensive checklist and automated tooling to help.
Why Regular Audits Matter
Servers change over time — new software installed, temporary firewall rules never removed, configuration drift from manual fixes made during past incidents. A periodic audit catches this drift before it becomes a genuine vulnerability.
Automated Auditing with Lynis
sudo apt install lynis -y
sudo lynis audit systemLynis performs hundreds of automated checks across authentication, firewall, kernel hardening, and more, producing a hardening index score and specific, actionable suggestions.
Reviewing Lynis Output
Focus first on items marked as warnings, then work through suggestions relevant to your specific environment — not every suggestion applies to every server (e.g. some are specifically relevant to servers running particular services you may not have).
Manual Audit Checklist
Authentication & Access
- SSH key-based authentication only, root login disabled — see SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys
- 2FA enabled on administrative access
- No unnecessary user accounts
- Sudo access limited to those who genuinely need it
Network
sudo ufw status
sudo ss -tulpn- Firewall active with deny-by-default policy
- No unexpected services listening on public interfaces
- Database ports not publicly exposed
Software & Updates
apt list --upgradable- System fully updated
- Automatic security updates enabled — see How to Enable Automatic Security Updates on Ubuntu & Debian
- Application dependencies free of known vulnerabilities — see How to Audit and Secure Your Application's Dependencies
Monitoring & Detection
- Fail2Ban active and correctly configured
- Log monitoring in place
- File integrity monitoring configured — see How to Set Up File Integrity Monitoring with AIDE
Data Protection
- Backups automated, tested, and encrypted — see Backup Strategy 101: The 3-2-1 Rule Explained
- SSL/TLS certificates valid and auto-renewing
- Database access properly restricted — see Database Security Checklist: Protecting MySQL, PostgreSQL & MongoDB
Checking for Unnecessary Running Services
systemctl list-units --type=service --state=runningReview each and disable anything not genuinely required for this server's purpose.
Checking for World-Writable Files (Potential Security Risk)
sudo find / -xdev -type f -perm -0002 2>/dev/nullChecking for Files with No Owner
sudo find / -xdev -nouser -o -nogroup 2>/dev/nullScheduling Regular Audits
sudo crontab -e0 6 1 * * lynis audit system --cronjob > /var/log/lynis-$(date +\%Y\%m).logMonthly automated audits, with results archived for trend comparison over time.
Tracking Improvement Over Time
Lynis provides a hardening index score — track this month over month to confirm your security posture is trending in the right direction, not just checking a single point-in-time snapshot.
Common Errors
Lynis reports many warnings on a fresh system — normal for a default installation; work through them systematically, prioritizing authentication and network-facing issues first.
Best Practices
- Run automated audits on a regular schedule, not just once
- Track your hardening score over time to confirm continuous improvement
- Combine automated tooling (Lynis) with manual review, since no tool catches everything
Continue Reading
- VPS Security Checklist for Beginners
- How to Install and Configure auditd for System Auditing
- How to Audit and Secure Your Application's Dependencies
Browse more articles in Advanced Security & Compliance.
