s0sta
EN NL عربي
Filters
How to search
  • Plain words find names, texts and examples.
  • "two words" finds the exact phrase.
  • --name or -x finds an option.
  • #word looks only inside commands.
  • @grep finds lessons and labs that use grep.
  • Filters: cat:network · in:labs · in:notes · level:rhcsa · ch:8 · root:yes. Put ! before a word to leave it out. OR between words means one of them.
  • ↑ ↓ to move · Enter to open · Esc to close · / to search

lynis

A security audit tool for Linux and Unix hosts: hundreds of checks, a hardening index and concrete suggestions.

Level
DevSecOps service
Group
Security scanning and hardening
Needs root
Yes
Package
lynis

What it does

Lynis (CISOfy, open source) runs local tests on boot, kernel, users, SSH, file systems, firewall, logging, packages, crypto, containers and more. It prints warnings and suggestions (each with a test ID like SSH-7408) and a hardening index (0–100). It needs no agent and changes nothing, so it is a quick first check on a new server and a good way to measure progress after hardening.

For formal compliance (CIS, STIG, PCI-DSS) on RHEL use OpenSCAP; Lynis is the fast general check.

How to write it

lynis audit system [OPTIONS]
lynis show details TEST-ID

Main parts

Commands

audit system
Full local audit.
show details TEST-ID
Explain one test.
show profiles / show settings
Profile and settings.
update info
Version check.

Options 7

Most used

Flags

--quick, -Q
No pauses.
--pentest
Run as a normal user (less checks).
--tests "ID ID"
Only these tests.
--tests-from-group GROUP
Only one group (ssh, firewalls, kernel …).
--profile FILE
Use a custom profile (skip tests, set values).
--cronjob
For scheduled runs (no colors, no questions).
--no-colors
Plain output.

Examples 10

$ run as a normal user# run as root (or with sudo)

  1. 1Install and run

    dnf install -y epel-release && dnf install -y lynis
lynis audit system --quick

  2. 2See the hardening index and warnings

    grep -E "hardening_index|warning\[\]" /var/log/lynis-report.dat

  3. 3List all suggestions

    grep "suggestion\[\]" /var/log/lynis-report.dat | cut -d'|' -f1,2 | sed 's/suggestion\[\]=//'

  4. 4Explain one test

    lynis show details SSH-7408

  5. 5Check only SSH and the firewall

    lynis audit system --quick --tests-from-group "ssh firewalls"

  6. 6Skip tests that do not apply

    cat /etc/lynis/custom.prf
skip-test=USB-1000
skip-test=STRG-1846
lynis audit system --quick --profile /etc/lynis/custom.prf

  7. 7Run every week and keep the reports

    cat /etc/cron.weekly/lynis
#!/bin/sh
lynis audit system --cronjob > /var/log/lynis-$(date +%F).log 2>&1

  8. 8Compare the index before and after hardening

    cp /var/log/lynis-report.dat /root/lynis-before.dat
ansible-playbook -i localhost, -c local harden.yml
lynis audit system --quick >/dev/null
grep -h hardening_index /root/lynis-before.dat /var/log/lynis-report.dat
hardening_index=63
hardening_index=81

  9. 9Run as a normal user

    lynis audit system --pentest --quick

  10. 10Read the full log of one test

    grep -A5 "Performing test ID AUTH-9230" /var/log/lynis.log

Watch out

  • A high index is not "secure"; read the warnings, and decide each suggestion for your case.
  • Reports contain details about your system — keep them private.

Files

/var/log/lynis.log
Detailed log.
/var/log/lynis-report.dat
Machine-readable report.
/etc/lynis/default.prf, custom.prf
Profiles.

Tips to remember

  • Run Lynis on the golden image in the Packer pipeline and fail the build when the index drops.

Exit codes

0Success.
1Error.
78Warnings found (with --error-on-warnings).

Full manual

This page explains the command in simple words. The original manual has every detail.

In your terminal: man 8 lynis

Open the man page (linux.die.net)