Lynis audits a Linux system and tells you what is not hardened. It is a shell script with no dependencies, which means it runs anywhere including on machines where you would rather not install a platform.

Running it

sudo lynis audit system

It works through several hundred checks covering boot configuration, kernel parameters, authentication, file permissions, installed software, network configuration, logging, and more, then prints suggestions and a hardening index.

Results are also written to /var/log/lynis-report.dat for parsing.

What makes it useful

The suggestions are specific. Not “improve SSH security” but the exact directive to change, with a reference to look up.

That turns hardening from an intention into a task list. For anyone setting up a server, running Lynis after the initial setup surfaces the things you did not think of, which is most of the value.

The hardening index

It produces a numeric score, and the score is the least useful output.

It is not comparable between systems, since a workstation and a bastion host have legitimately different configurations. Chasing a higher number leads to disabling things you need in order to satisfy a check that does not apply to you.

Read the suggestions, decide which apply, ignore the number.

Fitting it into a routine

# Non-interactive, for scheduled runs
sudo lynis audit system --cronjob --quiet

Running it monthly from a systemd timer and diffing the suggestions against last month is more useful than a one-off audit, because it catches configuration drift.

Where it sits

Lynis is a point-in-time audit of one host, run manually or on a schedule.

Wazuh is continuous monitoring with agents, file integrity checking, and central reporting, and it also does CIS benchmark scoring.

Lynis is the right first step and requires no infrastructure. Wazuh is what you graduate to when you have several machines and want continuous rather than periodic.

License

Lynis is released under the GPL-3.0 License.

Links

• Website
• Repository