FreeBSD hardening with Lynis

Lynis development has its roots on a FreeBSD system, therefore FreeBSD hardening is also easy and supported when using Lynis. People who want to audit and harden their FreeBSD system will discover Lynis to be a powerful tool for this purpose. In this article we will focus on how to audit your system with Lynis.


Lynis is available from the ports tree and usually the version is close or at the latest version. To install Lynis this way:

cd /usr/ports/security/lynis/ && make install clean

or to add the package:

pkg install security/lynis

In case the Lynis version from the ports tree is not up-to-date, please create a PR for the port. In the meantime you could download Lynis manually from the CISOfy website and extract the tarball in a temporary directory.

Running Lynis

Running Lynis can be as simple as using the audit command to perform a scan with all tests enabled. Any tests that are not relevant for FreeBSD will be skipped.

lynis audit system

The output might look something like this:

Screenshot showing Lynis system hardening tool

Screenshot of security scan performed with Lynis

Note: if you manually unpacked the tarball, use ./lynis audit system from the local directory instead.

Usually FreeBSD installations are already pretty well hardened out of the box, as the installation requires you to install additional software. Still, it’s worth to perform an extensive audit and check the outcome of the tests. These will be displayed at the bottom of the screen, together with a hardening index and pointers to log file and report file.

After the scan you are advised to have a look at the log file (default /var/log/lynis.log) to determine what has been checked in each test and any further suggestions. Warnings and suggestions will be displayed also on screen.


Small picture of Michael Boelen

This article has been written by our Linux security expert Michael Boelen. With focus on creating high-quality articles and relevant examples, he wants to improve the field of Linux security. No more web full of copy-pasted blog posts.

Discovered outdated information or have a question? Share your thoughts. Thanks for your contribution.

Mastodon icon