FreeBSD hardening with Lynis

Lynis development has its roots on a FreeBSD system, therefore FreeBSD hardening is also easy and supported when using Lynis. People who want to audit and harden their FreeBSD system will discover Lynis to be a powerful tool for this purpose. In this article we will focus on how to audit your system with Lynis.

Ports

Lynis is available from the ports tree and usually the version is close or at the latest version. To install Lynis this way:

cd /usr/ports/security/lynis/ && make install clean

or to add the package:

pkg install security/lynis

In case the Lynis version from the ports tree is not up-to-date, please create a PR for the port. In the meantime you could download Lynis manually from the CISOfy website and extract the tarball in a temporary directory.

Running Lynis

Running Lynis can be as simple as using the audit command to perform a scan with all tests enabled. Any tests that are not relevant for FreeBSD will be skipped.

lynis audit system

The output might look something like this:

Screenshot showing Lynis system hardening tool

Screenshot of security scan performed with Lynis

Note: if you manually unpacked the tarball, use ./lynis audit system from the local directory instead.

Usually FreeBSD installations are already pretty well hardened out of the box, as the installation requires you to install additional software. Still, it’s worth to perform an extensive audit and check the outcome of the tests. These will be displayed at the bottom of the screen, together with a hardening index and pointers to log file and report file.

After the scan you are advised to have a look at the log file (default /var/log/lynis.log) to determine what has been checked in each test and any further suggestions. Warnings and suggestions will be displayed also on screen.

Screenshot of Lynis security tool

Take the next step!

Want to learn more about Linux security? Have a look at the open source tool Lynis and become a Linux expert yourself.

Lynis is a battle-tested technical security audit tool. It is open source, freely available, and used by system administrators all over the world. Other users include IT auditors, security professionals, like pentesters.

Tool Information

Visit project page