Linux security using Lynis
Posted: Wed Sep 02, 2026 6:36 pm
Lynis is a great tool to help you with hardening your system. It’s an open source scanner that runs a bunch of tests that checks your system and it’s configuration. After it’s finished scanning, it will give you a score from 0-100 and give you recommendations to improve your hardening of your system. It runs on Linux, macOS, and any Unix-based operating system.
It runs an extensive health scan of your system and is a great tool to use for compliance testing. It is also used for Security auditing, penetration testing, vulnerability detection, and system hardening.
Lynis is a modular scanner. This means it will only use and test the components that it can find, such as the available system tools and its libraries. The benefit is that no installation of other tools is needed, so you can keep your systems clean.
To install:
$sudo apt install lynis
Once installed, you can perform a scan on your system:
$sudo lynis audit system
The steps that Lynis takes is as follows:
1. Initialization
2. Perform basic checks, such as file ownership
3. Determine operating system and tools
4. Search for available software components
5. Check latest Lynis version
6. Run enabled plugins
7. Run security tests per category
8. Perform execution of your custom tests (optional)
9. Report status of security scan
Lynis will display a report to the screen as it goes through it’s scan; with displaying warnings and suggestions at the end. It also gives you an overall health score. Lynis will also store a separate file called lynis-report.dat. Go through and apply the recommendations to improve your overall health. You don’t have to apply all the recommendations, just the ones you feel are worth changing on your system.
It runs an extensive health scan of your system and is a great tool to use for compliance testing. It is also used for Security auditing, penetration testing, vulnerability detection, and system hardening.
Lynis is a modular scanner. This means it will only use and test the components that it can find, such as the available system tools and its libraries. The benefit is that no installation of other tools is needed, so you can keep your systems clean.
To install:
$sudo apt install lynis
Once installed, you can perform a scan on your system:
$sudo lynis audit system
The steps that Lynis takes is as follows:
1. Initialization
2. Perform basic checks, such as file ownership
3. Determine operating system and tools
4. Search for available software components
5. Check latest Lynis version
6. Run enabled plugins
7. Run security tests per category
8. Perform execution of your custom tests (optional)
9. Report status of security scan
Lynis will display a report to the screen as it goes through it’s scan; with displaying warnings and suggestions at the end. It also gives you an overall health score. Lynis will also store a separate file called lynis-report.dat. Go through and apply the recommendations to improve your overall health. You don’t have to apply all the recommendations, just the ones you feel are worth changing on your system.