How to use Lynis

This article explains in a few quick steps how to start with using Lynis. A more extensive explanation can be found in the documentation of Lynis.

Download Lynis


Unpack tarball

tar xfvz lynis-version.tar.gz

This will unpack the tarball with a Lynis directory.

Run Lynis

Go to the newly created directory named lynis.

cd lynis

When running Lynis for the very first time, use the audit system command. It will start the audit process and pauses after every batch of tests.

./lynis audit system

After reading the section, press ENTER to perform the next batch. Items which show up in white, can be considered to be normal. Green usually indicates a common, preferred or safe value.

Yellow or red might indicate an unexpected result, a suggestion or serious security weakness.

Dealing with findings

At the end of the Lynis scan a report is displayed with the findings, a hardening index and the location of several related files.

This audit overview can be used to determine what items are discovered and need more investigation. This might include serious vulnerabilities which were discovered, but also minor items. It’s even possible that some value is discovered, which is configured “weak” on purpose (e.g. depending on the role the system has).

Each finding can be found in the log file as well. The related test ID is displayed at the end of the line. For example:

  • Add a legal banner to /etc/issue, to warn unauthorized users [test:BANN-7126]

Search for the related line in the log file:

# grep BANN-7126 /var/log/lynis.log  
[20:11:04] Performing test ID BANN-7126 (Check issue banner file contents)  
[20:11:04] Suggestion: Add a legal banner to /etc/issue, to warn unauthorized users [test:BANN-7126]

While this does give us positive search results, there is more information available. Therefore it’s better to open up the logfile (e.g. with less) and search for the first line matching. This will be the first line as shown in the example, as this is also the start of the test.

The log file might also provide hints on what has been checked and where to fix them. Still, we advise to carefully read the documentation about every configuration file or parameter.

Lynis Enterprise Suite

For companies and people who need more than just vulnerability checking, there is the Lynis Enterprise Suite. This includes Lynis, management reporting, dashboards, detailed explanation on fixing vulnerabilities and improve system security. To help with automation, the enterprise version also includes snippets.

Take the next step!

Want to learn more about Linux security? Have a look at the open source tool Lynis and become a Linux security expert yourself.

Lynis is a battle-tested technical security audit tool. It is open source, freely available, and used by system administrators all over the world. Other users include IT auditors, security professionals, like pentesters.

Tool Information

Visit project page
Screenshot of Lynis security tool