A Lynis security audit is an automated check that analyzes the operating system, active services, and configurations to uncover weaknesses and misconfigurations. It runs in minutes and returns a hardening index with corrective actions you can implement immediately.
| Command | Purpose |
|—|—|
| sudo apt install lynis | Installs the tool on Ubuntu/Debian |
| sudo lynis audit system | Launches the full scan |
| sudo lynis audit system --quick | Fast scan without slow tests |
| sudo lynis show warnings | Lists only critical issues |
| sudo lynis show details KRNL-5820 | Shows details and solution for a specific test |
When I had to secure 80 VMs for a public healthcare organization, the biggest risk was not zero-day vulnerabilities. It was default configurations. 65% of breaches exploit infrastructure misconfigurations, not software flaws (IBM Cost of a Data Breach 2025). Manually checking SSH, firewalls, permissions, and the kernel on each machine takes hours. Lynis turns this process into a fast, repeatable operation, giving you a clear metric: the hardening index. In this guide, we will install it, interpret the results, and fix the most common issues.
Prerequisites for Your Lynis Security Audit
You need a Linux machine with root access. I tested this procedure on Ubuntu 22.04 and 24.04 LTS, but Lynis supports all major distributions. You need at least 50 MB of disk space for logs. It requires no agents or background daemons. It executes and exits.
Installing Lynis
Lynis is available in the official repositories of major distributions. To install Lynis on Ubuntu or Debian, run the command directly.
sudo apt install lynisVerify the installation by checking the version.
lynis show versionIf the repository version is outdated, download the latest release directly from the official GitHub or the CISOfy website. For production environments, the repository version is fine to start, but keep an eye on updates.
Running Your First Lynis Audit
Launch the first full system audit. This command runs over 300 tests covering the OS, kernel, network services, filesystem, authentication, and firewall.
sudo lynis audit systemThe output scrolls in the terminal showing results in real time. At the end, you will see a summary with the hardening index, a score from 0 to 100 indicating the server security level. A score below 70 requires immediate intervention.
If you are short on time or want to skip resource-intensive tests, use the quick mode.
sudo lynis audit system --quickThe quick scan skips some deep filesystem and log tests, but gives you a snapshot of your security status in under two minutes.
Interpreting the Report
Lynis output divides results into three main categories.
WARNINGs indicate critical security issues. They require immediate action. A classic example is a missing malware scanner or allowing root login via SSH.
SUGGESTIONs are recommendations to improve configuration. They are not critical, but they reduce the attack surface. For example, enabling process accounting or tightening permissions on specific files.
The hardening index is the final score. It is not a simple grade. It is an indicator of your risk exposure. Organizations that monitor and improve this index reduce remediation time by 40% after an incident (Ponemon Institute 2025).
To see only WARNINGs after a scan, use the dedicated command.
sudo lynis show warningsTop 10 Issues Found by Lynis
After running hundreds of audits on Linux servers, these are the issues I find almost every time:
- Outdated kernel or pending reboot (KRNL-5820)
- Root login via SSH enabled (SSH-7408)
- Firewall active but without restrictive policies (FIRE-4512)
- No malware scanner installed (MALW-3280)
- Permissions too loose on sensitive files like /etc/shadow (FILE-6410)
- Password aging not configured (AUTH-9228)
- NTP not synchronized or not configured (TIME-3120)
- Unnecessary network services listening (NETW-3200)
- Bootloader without password (BOOT-5122)
- No accounting for user processes (ACCT-9626)
These problems create the shortest path for an attack. An attacker tries SSH access with root, exploits a vulnerable kernel to gain privileges, or reads sensitive files if permissions are wrong.
Resolving Critical Warnings
For every WARNING, Lynis provides a unique test code. You do not have to guess the solution. Use the show details command followed by the code to get the explanation and the suggested fix.
sudo lynis show details KRNL-5820This command shows exactly which parameter is out of spec, the associated risk, and the configuration file to modify. For WARNING KRNL-5820, the issue is almost always an updated kernel requiring a reboot. The solution is scheduling a reboot.
For WARNING SSH-7408, Lynis suggests setting PermitRootLogin no in the /etc/ssh/sshd_config file and restarting the SSH service. After applying the fixes, run the audit again to verify the WARNING disappeared and the hardening index increased.
Automating Lynis with Cron and Email Reports
Checking security once a year is useless. Configurations change, services get installed, patches are applied. You need continuous monitoring. Automate Lynis with cron.
0 3 * * 0 lynis audit system > /var/log/lynis_$(date +\%Y\%m\%d).logThis crontab line launches a full scan every Sunday at 03:00 AM. It saves the output to a dated file in the /var/log directory. To receive the report via email, you can pipe a mail command or use a tool like mutt to send the output directly to your SOC or IT team mailbox.
Tracking Hardening Progress Over Time
Separate logs by date allow you to compare the hardening index over time. If after a month of work the index dropped from 82 to 74, you know someone introduced misconfigurations. Use a simple bash script to extract the index from logs and track the trend, or integrate Lynis logs into your SIEM to get automatic alerts if the score drops below a critical threshold. I don’t have a definitive answer on which SIEM integration works best, as it depends on your stack, but sending the logs via syslog usually works well for Splunk or Elastic.
Common Errors and Troubleshooting
The most frequent error is running Lynis without root privileges. The tool works, but it skips over 50% of the tests that require access to protected system files. Always use sudo.
Another issue is an outdated version in the repositories. If Lynis does not detect a specific test you know should be there, check the version and update it from the official channel if necessary.
If the output seems stuck on a network test, it might be a timeout caused by an external firewall. Use the –quick flag to skip slow network tests or verify local firewall rules.
Frequently Asked Questions
Is Lynis free and open source?
Yes, the community version is completely free and open source. There is a paid enterprise version that offers additional plugins and centralized management, but for auditing single servers, the community version is more than enough.
How long does a full scan take?
It depends on the hardware and the number of active services. On a server with 4 vCPUs and 8 GB of RAM, a full scan takes between 3 and 5 minutes. The –quick mode often finishes in under 60 seconds.
Does Lynis modify my system?
No. Lynis is a read-only tool. It analyzes configurations, checks permissions, and verifies services without making any changes to the system. It is up to you to apply the fixes suggested in the report.
How can I improve the hardening index quickly?
Focus on WARNINGs before SUGGESTIONs. Fixing root SSH access, updating the kernel, and tightening permissions on sensitive files gains you 10 to 15 points in a few hours of work.
Do I need to install Lynis on every server?
Yes, it must be installed on every machine you want to test. It does not have a client-server architecture in the free version. For environments with many servers, automate the installation and execution via Ansible.
Conclusions with Operational Takeaways
A Linux server left with default configurations is an open door. Lynis gives you the map to close the vulnerabilities. It does not just report the problem, it provides the exact command or file to modify. The three operational steps to take today: install Lynis, run your first audit, and resolve the WARNINGs. Schedule automation with cron to maintain control in the following months.
[Read also: SSH Hardening on Linux: Practical Guide 2026]
For the official documentation and the complete list of tests, refer to the manual at Lynis documentation.
