Lynis is a comprehensive, open-source security auditing tool that scans your system and provides specific, actionable hardening recommendations — an excellent way to get a broad security health check.
What Lynis Checks
Hundreds of individual security-relevant items — system configuration, installed software versions, firewall rules, SSH configuration, file permissions, and much more — producing a scored report with specific recommendations.
Step 1 — Install Lynis
sudo apt install lynis -yStep 2 — Run a Full System Audit
sudo lynis audit systemStep 3 — Review the Hardening Index Score
Lynis provides an overall hardening index (a rough score out of 100) — useful as a general indicator, though the specific individual findings matter more than chasing a perfect score in isolation.
Step 4 — Review Individual Warnings and Suggestions
The report categorizes findings into warnings (more significant issues) and suggestions (improvements worth considering) — each includes a specific test ID you can look up for more detailed remediation guidance.
Step 5 — Address Findings Systematically
Don't try to fix everything at once — prioritize based on actual risk relevant to your specific server's role and exposure; not every generic suggestion applies equally to every server's specific context.
Example Common Findings and Fixes
| Common Finding | Typical Fix |
|---|---|
| SSH root login not disabled | See SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys |
| No automatic security updates configured | See How to Enable Automatic Security Updates on Ubuntu & Debian |
| Weak file permissions on sensitive files | See How to Audit and Fix File and Directory Permissions on a Linux VPS |
| No firewall configured or overly permissive rules | See How to Configure UFW Firewall on a Linux VPS |
Reviewing the Detailed Log File
sudo cat /var/log/lynis.logContains more detailed technical output than the summary report, useful for deeper investigation of specific findings.
Running Lynis Regularly
sudo crontab -e0 4 1 * * /usr/bin/lynis audit system --cronjob >> /var/log/lynis-monthly.log 2>&1Monthly audits catch configuration drift or newly-relevant recommendations as Lynis itself is updated with new checks over time.
Comparing Reports Over Time
Save reports with timestamps and compare periodically — a declining hardening index or new warnings can indicate configuration drift or newly-introduced issues worth investigating.
Lynis as One Tool Among Several
Lynis provides excellent broad coverage but isn't a complete security solution alone — combine with the specific, deeper practices covered throughout this Security & Hardening category (Fail2Ban, file integrity monitoring, proper firewall configuration) for genuinely comprehensive coverage.
Common Errors
Overwhelmed by the number of findings — a fresh, unhardened system can generate many findings; work through them systematically over time rather than expecting to resolve everything in one session.
Continue Reading
- VPS Security Checklist for Beginners
- How to Harden a Fresh Linux VPS in 15 Minutes
- How to Audit Installed Packages for Known Vulnerabilities
Browse more articles in Server Security & Hardening.
