Lynis Hardening Index: Common Warnings Fixes

Linux system hardening is an ongoing process, not a single event. Among the tools available to sysadmins, Lynis stands out for its ability to perform in-depth security audits, providing a detailed report with warnings, suggestions, and a valuable ‘hardening index’. This index is a numerical indicator of your system’s robustness, but often, after the first audit, you find yourself with a low score and a lengthy list of potential improvements. The challenge is not just running Lynis, but interpreting its results and acting effectively to increase the security level without compromising functionality. Read also: Linux find Command: 20 Practical Examples

When I introduced Lynis into an enterprise environment with hundreds of servers, I noticed the initial report generated more confusion than clarity. The priority wasn’t to achieve the maximum score, but to identify and fix the most critical vulnerabilities – those that could expose the system to immediate risks. The goal was to transform a list of recommendations into a concrete, measurable action plan, improving the overall security posture of the machine fleet. This article will guide you through the most common Lynis warnings and provide operational strategies to fix them, significantly raising your hardening index.

Tested on: Ubuntu 24.04 LTS · Lynis 3.0.9 · October 2026

Prerequisites / Test Environment

To follow this guide, you will need a Linux system (preferably a Debian/Ubuntu or RHEL/CentOS-based distribution) with sudo access. Lynis is available in the repositories of most distributions, or it can be downloaded and run directly from its GitHub repository. Ensure you have an up-to-date version of Lynis to benefit from the latest security checks and definitions. Running Lynis does not require installing agents or permanent system modifications, making it a non-invasive tool for auditing.

Reading the Report: Warnings, Suggestions, and Hardening Index

The first step is always to perform a full audit and analyze the generated report. The output of lynis audit system can be voluminous, but it is organized into clear sections. The main command is:

sudo lynis audit system

Once the audit is complete, Lynis will save a detailed report to /var/log/lynis-report.dat. For a quick overview of issues, you can filter warning and suggestion entries:

sudo grep -E 'warning|suggestion' /var/log/lynis-report.dat

The hardening_index is the most important value for tracking progress. You can easily extract it:

sudo grep hardening_index /var/log/lynis-report.dat

A low hardening index (below 70-80) indicates many areas for improvement. The goal is to progressively increase this value, focusing first on warnings and then on suggestions.

Finding Details for Each Control

Every warning and suggestion in the Lynis report is associated with a unique ID (e.g., SSH-7408, PKGS-7392). This ID is crucial for understanding the specific problem and the recommended actions. To get detailed information about a particular control, you can use the lynis show details command:

sudo lynis show details SSH-7408

This command will provide a description of the control, its impact level, and possible solutions, often with references to external documentation or security standards. It’s an invaluable resource for those unfamiliar with all hardening recommendations. Read also: systemd Service Creation: Auto-Restart & Dependencies

SSH: Nearly Universal Warnings

SSH services are among the most exposed and, consequently, generate many warnings in Lynis. Correcting these points has a significant impact on the hardening index. Here are the most common ones:

• PasswordAuthentication yes: Lynis always recommends disabling password authentication in favor of much more secure SSH keys. You can do this by modifying /etc/ssh/sshd_config:

sudo sed -i 's/^#\?PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

• PermitRootLogin yes: Direct root user access via SSH is a risky practice. Disable it and use sudo for elevated privileges.

sudo sed -i 's/^#\?PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

• Standard SSH Port (22): While not an intrinsic vulnerability, using a non-standard port (e.g., 2222) reduces noise from bots scanning port 22. Change Port 22 to Port 2222 in sshd_config and ensure your firewall is configured correctly.

Updates and Vulnerable Packages

Keeping the system and its software packages updated is one of the most effective defenses against known vulnerabilities. Lynis checks for outdated packages and, in some cases, packages with specific vulnerabilities (CVEs). Warnings related to PKGS-7392 (outdated packages) or PKGS-7398 (vulnerable packages) must be addressed with priority. Read also: Proxmox Migration: VMware to Proxmox VE Guide

Regularly perform system updates:

sudo apt update && sudo apt upgrade -y  # For Debian/Ubuntu
sudo dnf update -y                   # For RHEL/CentOS

Also, consider installing tools like unattended-upgrades (on Debian/Ubuntu) to automate security updates.

Firewall and Listening Services

A well-configured firewall is crucial. Lynis will check if a firewall is active and if there are services listening on unexpected ports (FIRE-4512, NETW-2705). Ensure that only necessary services are exposed and that the firewall blocks all incoming traffic not explicitly allowed.

Example UFW (Uncomplicated Firewall) configuration on Ubuntu:

sudo ufw enable
sudo ufw default deny incoming
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https

Always verify listening services with ss -tuln or netstat -tuln to identify unauthorized processes.

Permissions and System Files

Lynis pays close attention to the permissions of critical files and directories (e.g., /etc/passwd, /etc/shadow, /var/log). Warnings like FILE-7520 (suboptimal permissions on binary files) or FILE-7524 (non-compliant directory permissions) indicate potential weaknesses. Ensure that sensitive configuration files are not writable by unprivileged users and that system directories have the correct permissions.

For example, for SSH configuration files:

sudo chmod 600 /etc/ssh/sshd_config
sudo chmod 644 /etc/ssh/ssh_host_*

Logging and Auditd

Effective logging is fundamental for incident detection and forensics. Lynis will check the configuration of rsyslog/syslog-ng (LOGG-2190) and, if present, auditd (AUDT-7600). Ensure logs are retained for an adequate period, protected from unauthorized modification, and that security messages are properly recorded. Configure auditd to monitor critical file access, permission changes, and privileged command executions.

Skipping Irrelevant Controls (custom.prf)

Not all Lynis warnings or suggestions are relevant for every environment. For example, if a server is dedicated to a single service and doesn’t need a desktop environment, warnings related to X11 or web browsers can be ignored. Lynis allows you to customize checks via the custom.prf file.

To skip a specific test, add a line like this to /etc/lynis/custom.prf:

echo 'skip-test=KRNL-5820' | sudo tee -a /etc/lynis/custom.prf

Replace KRNL-5820 with the ID of the test you want to skip. Use this feature cautiously and only after carefully evaluating why a control is not applicable to your specific use case. Excessive use can reduce the audit’s effectiveness.

Measuring Improvement Between Audits

The true value of Lynis emerges when used to measure progress over time. After applying fixes, re-run the audit and compare the new hardening_index with the previous one. This will allow you to quantify improvements and identify any regressions.

Consider integrating Lynis into a CI/CD system or an automated hardening script (e.g., with Ansible) to perform periodic audits and apply fixes consistently across your infrastructure. Read also: Oracle RMAN: Database Recovery After Failure

Common Errors and Troubleshooting

• Permission denied: Ensure you run Lynis with sudo or as the root user. Many checks require access to system files and directories.
• Overly long output: Redirect the output to a file (sudo lynis audit system > lynis_report.txt) for leisurely analysis, or use grep to filter only warnings/suggestions.
• Hardening Index not changing: After making changes, it’s essential to re-run the full audit. Also, ensure you have restarted relevant services (e.g., sshd) after modifying their configuration files.
• Skipping too many controls: An overly aggressive custom.prf can lead to an artificially high hardening index, masking real vulnerabilities. Periodically review your custom.prf.

FAQ — Frequently Asked Questions

Can Lynis break my system if I apply its recommendations?

Lynis is a passive audit tool. It does not make changes to the system. The recommendations derived from it, if applied without understanding, could potentially cause issues (e.g., blocking SSH access). Always test changes in a staging environment before applying them to production.

How often should I run a Lynis audit?

It depends on the system’s sensitivity and the frequency of changes. For critical servers or those undergoing frequent updates, a weekly or monthly audit is advisable. For less dynamic systems, a quarterly or semi-annual audit may suffice. Automation can facilitate frequent execution.

Can I integrate Lynis with other security tools?

Yes, the Lynis report (lynis-report.dat) is in an easily parsable format. It can be integrated with SIEM, monitoring tools, or automation platforms like Ansible to automate data collection and fix application. This provides a centralized view of your security posture.

Does Lynis replace a penetration test or a vulnerability scanner?

No, Lynis is a hardening audit tool. It evaluates configuration and security best practices. It is not a vulnerability scanner that actively searches for CVEs or a penetration test that simulates an attack. It is a valuable complement, but not a substitute, for other security tools and methodologies.

What does a hardening index of 100 mean?

A hardening index of 100 means the system complies with all Lynis hardening recommendations for the tests performed. It’s an ambitious goal and often requires compromises, especially in complex environments. The important thing is to aim for continuous improvement, not necessarily perfection, focusing on the most critical vulnerabilities.

Conclusions with Operational Takeaways

Lynis is a powerful tool for improving the security posture of your Linux systems. The approach to raising the hardening index must be methodical: run the audit, analyze the report focusing on warnings and suggestions, use lynis show details to understand each control, and prioritize fixes that have the greatest impact on the attack surface (SSH, firewall, updates). Don’t hesitate to use custom.prf to skip irrelevant controls, but do so with informed judgment. Automating fixes and continuously monitoring progress will transform the hardening process from an onerous task into an integral and manageable part of your security strategy. Security is a journey, not a destination, and Lynis is an excellent compass to navigate it.

Sources

• OpenSSH Manual Pages
• Ubuntu UFW Documentation

Updated: October 2026