GO KALI FREE

Lynis

Vulnerability Analysis

Beginnerlow risk

Lynis is a battle-tested security auditing tool for systems running Linux, macOS, or Unix-based operating systems. It performs an in-depth local scan to discover security weaknesses, configuration flaws, and system hardening opportunities.

Installation

sudo apt install lynis

Basic Syntax

lynis audit system

Quick Facts

Full Name
Lynis Security Auditor
License
GPL
Language
Bash
Type
Read-only Audit
Category
System Audit
Platforms
Linux, macOS, Unix

Tool Overview

Lynis is a battle-tested security auditing tool for Linux, macOS, and Unix systems. It performs an in-depth local scan to discover security weaknesses, configuration flaws, and hardening opportunities.

The tool is non-intrusive and read-only, providing a hardening score and detailed recommendations without modifying the system. It supports compliance checking for CIS benchmarks and other standards.

Lynis is essential for system administrators and security professionals for verifying system hardening, preparing for compliance audits, and maintaining security baselines.

Common Commands

lynis audit systemLocal system audit - Scan the host operating system configuration for security improvements
lynis audit system --quickUnattended scan - Run the automated audit quickly without waiting for user confirmations
sudo lynis audit systemFull system audit
lynis show detailsShow test details
sudo lynis audit system --quickQuick scan
sudo lynis audit system --pentestPentest mode
lynis audit systemFull system audit
lynis audit system --quickQuick scan mode
lynis audit system --tests-from-group 'firewalls'Test specific group
lynis audit system --profile /etc/lynis/custom.prfCustom profile
lynis show detailsShow detailed scan results
lynis show groupsList available test groups
lynis show testsList all available tests
lynis update infoCheck for updates
lynis update --releaseUpdate to latest release

Step-by-Step Guide

  1. 1Execute the local audit command: lynis audit system
  2. 2Analyze the on-screen warnings and configuration suggestions
  3. 3Review the final calculated system hardening score
  4. 4Implement the recommended changes to improve local security posture
  5. 5Execute the scan again to verify the fixes were applied properly

Use Cases

System Hardening

Identify and fix security misconfigurations.

Compliance Check

Verify compliance with CIS benchmarks.

Security Baseline

Establish and maintain security baselines.

Pentest Prep

Harden systems before penetration testing.

Key Features

Related Tools

OpenVAS

Vulnerability Analysis

Network vulnerability scanner.

Nessus

Vulnerability Analysis

Commercial vulnerability scanner.

Frequently Asked Questions

What is Lynis used for?

Lynis is used for security auditing of Linux, macOS, and Unix-based systems. It performs in-depth local scans to discover security weaknesses, configuration flaws, and system hardening opportunities.

Does Lynis modify the system?

No, Lynis is non-intrusive and read-only. It does not modify system configurations or install anything. It only reports findings and recommendations.

What is the Lynis hardening score?

Lynis calculates a hardening index (0-100) based on its findings. Higher scores indicate better security configuration. The score helps track improvement over time.

Can Lynis check compliance?

Yes, Lynis includes tests for CIS benchmarks, PCI DSS, and other compliance standards. Use --tests-from-group to focus on specific compliance categories.

How do I install Lynis?

Install Lynis using: sudo apt install lynis on Kali Linux. On other systems, use your package manager or clone from GitHub: git clone https://github.com/CISOfy/lynis.git.

How do I use Lynis for a system audit?

Run sudo lynis audit system to perform a full security audit. Use --quick for a faster scan or --pentest for penetration testing mode.

What are the most common Lynis commands?

Common commands include: sudo lynis audit system (full audit), sudo lynis audit system --quick (quick audit), lynis show details (view results), lynis show groups (view test groups).

How do I view Lynis audit results?

Use lynis show details to view detailed test results, lynis show groups to see test categories, and check the log file at /var/log/lynis.log for full output.

Is Lynis legal to use?

Lynis itself is legal software. It is designed for system administrators and security professionals to audit their own systems. Always ensure you have authorization to audit the target system.

How does Lynis compare to OpenVAS?

Lynis audits local system configurations (hardening). OpenVAS scans for network vulnerabilities. Use Lynis for host hardening; OpenVAS for network vulnerability assessment.

What is the --pentest flag in Lynis?

The --pentest flag runs Lynis in penetration testing mode, performing more aggressive tests and providing additional recommendations for hardening.

How do I check specific tests with Lynis?

Use --tests-from-group to run specific test categories: sudo lynis audit system --tests-from-group firewalls for firewall tests only.

What does Lynis hardening score mean?

The hardening index (0-100) indicates overall system security. Scores above 70 are good; below 50 need improvement. Track the score over time to measure hardening progress.

How long does a Lynis audit take?

A full Lynis audit takes 5-15 minutes depending on the system. Quick audits (--quick) complete in 1-3 minutes.

How do I run Lynis without root?

Lynis can run without root but many tests require elevated privileges. Run with sudo for comprehensive results.

What is Lynis compliance mode?

Lynis includes compliance checks for CIS benchmarks, PCI DSS, and other standards. Use --tests-from-group to focus on compliance-related tests.

How do I export Lynis results?

Lynis logs results to /var/log/lynis.log. Use --logfile to specify a custom log file. The log contains detailed test results and recommendations.

What systems can Lynis audit?

Lynis supports Linux, macOS, and Unix-based systems. It works on most distributions including Ubuntu, Debian, CentOS, RHEL, and FreeBSD.

Tags

#vulnerability-analysis#host-hardening#linux-security#system-audit

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.