مرکز آموزش

A periodic security audit systematically reviews your server's actual configuration against best practices, catching drift and gaps that accumulate over time. This guide provides a comprehensive checklist and automated tooling to help.

Why Regular Audits Matter

Servers change over time — new software installed, temporary firewall rules never removed, configuration drift from manual fixes made during past incidents. A periodic audit catches this drift before it becomes a genuine vulnerability.

Automated Auditing with Lynis

sudo apt install lynis -y
sudo lynis audit system

Lynis performs hundreds of automated checks across authentication, firewall, kernel hardening, and more, producing a hardening index score and specific, actionable suggestions.

Reviewing Lynis Output

Focus first on items marked as warnings, then work through suggestions relevant to your specific environment — not every suggestion applies to every server (e.g. some are specifically relevant to servers running particular services you may not have).

Manual Audit Checklist

Authentication & Access

• SSH key-based authentication only, root login disabled — see SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys
• 2FA enabled on administrative access
• No unnecessary user accounts
• Sudo access limited to those who genuinely need it

Network

sudo ufw status
sudo ss -tulpn

• Firewall active with deny-by-default policy
• No unexpected services listening on public interfaces
• Database ports not publicly exposed

Software & Updates

apt list --upgradable

• System fully updated
• Automatic security updates enabled — see How to Enable Automatic Security Updates on Ubuntu & Debian
• Application dependencies free of known vulnerabilities — see How to Audit and Secure Your Application's Dependencies

Monitoring & Detection

• Fail2Ban active and correctly configured
• Log monitoring in place
• File integrity monitoring configured — see How to Set Up File Integrity Monitoring with AIDE

Data Protection

• Backups automated, tested, and encrypted — see Backup Strategy 101: The 3-2-1 Rule Explained
• SSL/TLS certificates valid and auto-renewing
• Database access properly restricted — see Database Security Checklist: Protecting MySQL, PostgreSQL & MongoDB

Checking for Unnecessary Running Services

systemctl list-units --type=service --state=running

Review each and disable anything not genuinely required for this server's purpose.

Checking for World-Writable Files (Potential Security Risk)

sudo find / -xdev -type f -perm -0002 2>/dev/null

Checking for Files with No Owner

sudo find / -xdev -nouser -o -nogroup 2>/dev/null

Scheduling Regular Audits

sudo crontab -e

0 6 1 * * lynis audit system --cronjob > /var/log/lynis-$(date +\%Y\%m).log

Monthly automated audits, with results archived for trend comparison over time.

Tracking Improvement Over Time

Lynis provides a hardening index score — track this month over month to confirm your security posture is trending in the right direction, not just checking a single point-in-time snapshot.

Common Errors

Lynis reports many warnings on a fresh system — normal for a default installation; work through them systematically, prioritizing authentication and network-facing issues first.

Best Practices

• Run automated audits on a regular schedule, not just once
• Track your hardening score over time to confirm continuous improvement
• Combine automated tooling (Lynis) with manual review, since no tool catches everything

Continue Reading

• VPS Security Checklist for Beginners
• How to Install and Configure auditd for System Auditing
• How to Audit and Secure Your Application's Dependencies

Browse more articles in Advanced Security & Compliance.