/PLAYBOOK · 2026-08-04

Lynis Security Audit in Practice: Linux System Hardening Guide

Install Lynis, run a system audit, parse the report, and cron it. Fast Linux hardening checkup; track Hardening Index for baseline/compliance.

Scope

Lynis fits pre-prod baseline checks, periodic compliance audits (MLPS, CIS), and daily ops inspection. It auto-detects weaknesses in config, packages, network services, and user permissions, then emits actionable fixes. Covers Linux, Unix, and macOS.

Prerequisites

Linux distro (this guide: Ubuntu 22.04 / CentOS 7+)
root or sudo
Access to official repos or GitHub

Mechanism

Lynis is an open-source security auditor. It runs 200+ static checks: reads configs (e.g. /etc/ssh/sshd_config), scans installed packages, inspects file perms and user policy, then rolls up a Hardening Index. Higher index = better hardening. Findings are graded Warning/Suggestion with fix guidance.

Procedure

Step 1: Install Lynis

Ubuntu/Debian:

`sudo apt update && sudo apt install -y lynis`

CentOS/RHEL (official repo):

`sudo curl -fsSL https://packages.cisofy.com/keys/cisofy-software-rpms-public.key -o /etc/pki/rpm-gpg/RPM-GPG-KEY-CISOFY
sudo tee /etc/yum.repos.d/cisofy-lynis.repo <<'EOF'
[lynis]
name=CISOfy Lynis repository
baseurl=https://packages.cisofy.com/community/lynis/rpm/
enabled=1
gpgcheck=1
gpgkey=file:///etc/pki/rpm-gpg/RPM-GPG-KEY-CISOFY
EOF
sudo yum install -y lynis`

Step 2: Run system audit

`sudo lynis audit system`

Audit takes ~1-5 minutes. Checks stream live. Report lands at `/var/log/lynis-report.dat`.

Step 3: Read the report

`sudo lynis show details --section "File Permissions"
sudo grep -E "^(hardening_index|lynis_system_scan)" /var/log/lynis-report.dat`

If Hardening Index < 70, fix Warnings first. Suggestions are listed as [Suggestion]; apply as needed.

Step 4: Cron the audit

`sudo crontab -e`

Add a daily 03:00 job:

`0 3 * * * /usr/sbin/lynis audit system --cronjob --report --logfile /var/log/lynis.log 2>/dev/null`

Verification

Version: `lynis --version`
Report exists: `ls -l /var/log/lynis-report.dat`
Index: `grep hardening_index /var/log/lynis-report.dat`
Re-audit after high-priority fixes; index should rise

FAQ

Q1: Lynis vs Nmap vs OpenVAS?

Lynis is host hardening (static config). It does not scan the network. Nmap finds ports/services. OpenVAS scans vulns. Complementary.

Q2: False positives?

Some suggestions are generic best practice and may clash with custom setup (e.g. no root SSH). Review each item against the business; don't apply blindly.

Q3: Run without root?

Kernel params and package checks need root. Always use `sudo` for a full audit.

Takeaway

Lynis is the cheapest host checkup: install and run, no agent. Structured reports map to baseline/compliance. Put it in CI/CD or a daily cron. Track Hardening Index. Close the ops loop.