How to run a Lynis security audit on Linux and prioritize the results

What Lynis checks

Lynis is an open-source auditing tool that runs locally and checks hundreds of settings: boot loader, kernel parameters, authentication, file permissions, SSH, logging, firewall, malware scanners, and installed packages. It prints warnings for serious issues and suggestions for improvements, then a hardening index from 0 to 100.

It does not change anything. It reads configuration and reports, which makes it safe to run on lab machines and, with approval, on production.

Lab: audit a fresh VM

Install Lynis from your distribution or the vendor’s repository and run lynis audit system as root. It takes a minute or two. The full report goes to /var/log/lynis-report.dat and the log to /var/log/lynis.log.

Grep the report for warning and suggestion lines. Each has a test ID like SSH-7408 that links to an explanation, which helps you decide if the suggestion applies.

Snippet

sudo apt install lynis   # or dnf install lynis
sudo lynis audit system
sudo grep -E "^(warning|suggestion)" /var/log/lynis-report.dat | head -40
sudo lynis show details SSH-7408

Prioritize, do not chase the score

Start with warnings, then suggestions that reduce remote attack surface: SSH settings, unneeded listening services, missing firewall, and outdated packages. Then logging and auditing. Kernel tunables and banner text come last.

The hardening index is a rough indicator. Raising it from 62 to 80 by adding legal banners does little. Closing an exposed database port does a lot but may move the index only slightly.

Repeat and compare

Run Lynis after each round of changes and keep the reports. Diffing two report files shows exactly which tests changed. For many hosts, run it from configuration management and collect reports centrally.

Some suggestions do not fit every role, such as installing a malware scanner on a minimal container host. Record the decision so the next audit does not reopen it.

Diagram

Ordering Lynis findings

Fix in this order for the biggest risk reduction.

Warnings
Serious configuration problems. Fix first.
Remote surface
SSH, listeners, firewall, patch level.
Visibility
auditd, log forwarding, time sync.
Polish
Banners, minor kernel parameters.

Check yourself

1. Where does Lynis write its machine-readable report?

2. Which should you fix first?

3. Why not chase the hardening index?