How to use Lynis

This article explains in a few quick steps how to start with using Lynis. A more extensive explanation can be found in the documentation of Lynis.

Download Lynis:

wget http://cisofy.com/files/lynis-version.tar.gz

Unpack tarball:

Screenshot of a security scan performed with Lynis.

tar xfvz lynis-version.tar.gz

This will unpack the tarball with a Lynis directory. Go into this directory:

cd lynis-version

When running Lynis for the very first time, just just the -c parameter. It will start the audit process and pauses after every batch of tests.

./lynis -c

After reading the section, press ENTER to perform the next batch. Items which show up in white, can be considered to be normal. Green usually indicates a common, preferred or safe value.

Yellow or red might indicate an unexpected result, a suggestion or serious security weakness.

Dealing with findings

Lynis screenshot with hardening index.

At the end of the Lynis scan a report is displayed with the findings, a hardening index and the location of several related files.

This audit overview can be used to determine what items are discovered and need more investigation. This might include serious vulnerabilities which were discovered, but also minor items. It’s even possible that some value is discovered, which is configured “weak” on purpose (e.g. depending on the role the system has).

Each finding can be found in the log file as well. The related test ID is displayed at the end of the line. For example:

– Add a legal banner to /etc/issue, to warn unauthorized users [test:BANN-7126]

Search for the related line in the log file:

root@host:~/lynis# grep BANN-7126 /var/log/lynis.log
[20:11:04] Performing test ID BANN-7126 (Check issue banner file contents)
[20:11:04] Suggestion: Add a legal banner to /etc/issue, to warn unauthorized users [test:BANN-7126]

While this does give us positive search results, there is more information available. Therefore it’s better to open up the logfile (e.g. with less) and search for the first line matching. This will be the first line as shown in the example, as this is also the start of the test.

The log file might also provide hints on what has been checked and where to fix them. Still, we advise to carefully read the documentation about every configuration file or parameter.

Lynis Enterprise Suite

For companies and people who need more than just vulnerability checking, there is the Lynis Enterprise Suite. This includes Lynis, management reporting, dashboards, detailed explanation on fixing vulnerabilities and improve system security. To help with automation, the enterprise version also includes snippets.