DocumentationVPS Linux

VPS Linux 6 min read Intermediate 25.6k

Linux security audit with Lynis

Published on May 17, 2026

Automatically audit your Linux VPS with Lynis: 200+ security checks, kernel, services, ports, permissions, and a prioritized report. Tool recognized by pro sysadmins to identify obvious server flaws in 5 minutes.

Category: VPS Linux
Level: Intermediate
Reading time: 6 min
Published: May 17, 2026

Introduction

Lynis is a security audit tool written by CISOfy, used worldwide by sysadmins and auditors. It scans your system, checks 200+ controls (SSH configurations, kernel, file permissions, exposed services, certificates, outdated packages, etc.) and provides:

A Hardening Index (score 0 to 100)
A prioritized report of points to fix
Concrete remediation suggestions

Perfect for initial audit after VPS install, or before going to production.

Prerequisites

Linux VPS (Debian, Ubuntu, CentOS, Fedora, RHEL, Arch)
Root or sudo access (for complete results)
5-10 minutes for the full scan

Step 1: Installation

Via apt (Debian/Ubuntu)

sudo apt update
sudo apt install -y lynis

The apt version may be behind. For the latest:

Via official CISOfy repo

# Add key and repo
sudo apt install -y apt-transport-https
wget -O - https://packages.cisofy.com/keys/cisofy-software-public.key | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cisofy.gpg
echo "deb https://packages.cisofy.com/community/lynis/deb/ stable main" | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list

sudo apt update
sudo apt install -y lynis

Check:

lynis show version

Step 2: First audit

sudo lynis audit system

Scan takes 2-5 minutes. Lynis will go through 50+ categories:

Boot and services
Kernel
Memory and processes
Users, groups and authentication
Shells
File systems
Storage
NFS, name services
Ports and packages
Networking
Printers and spools
Software: e-mail and messaging
Software: firewalls
Software: webserver
SSH support
SNMP support
Databases
LDAP services
PHP
Squid support
Logging and files
Insecure services
Banners and identification
Scheduled tasks
Accounting
Time and synchronization
Cryptography
Virtualization
Containers
Security frameworks
File integrity
Tooling

At the end, you get:

================================================================================
  Lynis security scan details:

  Hardening index : 72 [#############       ]
  Tests performed : 247
  Plugins enabled : 0

================================================================================

Step 3: Read the report

Lynis displays colored:

🟢 OK: all good
🟡 WARNING: to fix priority
🔵 SUGGESTION: possible improvement

Typical example:

[+] Software: file integrity
------------------------------------
  - Checking file integrity tools
    - AIDE                                                    [ NOT FOUND ]
    - OSSEC                                                   [ NOT FOUND ]
    - Samhain                                                 [ NOT FOUND ]
  - Checking presence integrity tool                          [ NOT FOUND ]

  Suggestion: Install a file integrity tool to monitor changes
              to critical and sensitive files [FINT-4350]

Step 4: Inspect detailed log

Lynis writes all results to /var/log/lynis.log:

sudo less /var/log/lynis.log

For warnings only:

sudo grep -i warning /var/log/lynis-report.dat

For suggestions:

sudo grep -i suggestion /var/log/lynis-report.dat

Step 5: Reading the Hardening Index

The Hardening Index out of 100 indicates your hardening level. Benchmarks:

0-50: insecure system (default install)
50-70: basic config, some improvements needed
70-85: well secured, acceptable for public production
85+: excellent, top 5% of servers

A freshly installed Debian VPS is often around 55-65. After hardening, aim for 80+.

Step 6: Top common warnings and fixes

"USB devices auto-mount"

[WARNING] Disable USB devices                                  [USB-1000]

On a VPS, disable USB storage:

echo "install usb-storage /bin/true" | sudo tee /etc/modprobe.d/disable-usb-storage.conf

"AIDE / file integrity"

Install AIDE:

sudo apt install -y aide
sudo aideinit
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

Run a daily check via cron:

sudo crontab -e

0 5 * * * /usr/bin/aide --check | mail -s "AIDE Report $(hostname)" [email protected]

"No password aging configured"

sudo nano /etc/login.defs

PASS_MAX_DAYS   90
PASS_MIN_DAYS   7
PASS_WARN_AGE   14

"Disable ICMP timestamp requests"

Add to /etc/sysctl.conf:

net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_timestamps = 0

sudo sysctl -p

sudo nano /etc/issue.net

Authorized access only. All activity is monitored.

Reference it in SSH:

sudo nano /etc/ssh/sshd_config

Banner /etc/issue.net

"Kernel sysctl values not hardened"

sudo nano /etc/sysctl.d/99-hardening.conf

# Anti-spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.send_redirects = 0

# Log martians
net.ipv4.conf.all.log_martians = 1

# SYN flood protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_max_syn_backlog = 2048

# Disable IP forwarding (if not router)
net.ipv4.ip_forward = 0

# ASLR
kernel.randomize_va_space = 2

# Disable kexec (loads another kernel without reboot)
kernel.kexec_load_disabled = 1

# Restrict ptrace
kernel.yama.ptrace_scope = 1

sudo sysctl --system

"rkhunter / chkrootkit not installed"

Install rootkit detectors:

sudo apt install -y rkhunter chkrootkit
sudo rkhunter --update
sudo rkhunter --propupd
sudo rkhunter --check

"Unused packages"

List and remove unused packages:

sudo apt list --installed | grep -i "old\|deprecated"
sudo apt autoremove --purge

Step 7: Custom audit

To ignore certain tests irrelevant in your context, create a profile:

sudo nano /etc/lynis/custom.prf

# Skip certain tests
skip-test=USB-1000
skip-test=BANN-7126

# Compliance
compliance=disable

Run with:

sudo lynis audit system --profile /etc/lynis/custom.prf

Step 8: Automated recurring audit

To audit weekly and receive a report:

sudo crontab -e

0 4 * * 1 /usr/sbin/lynis audit system --cronjob > /var/log/lynis-weekly-$(date +\%F).log 2>&1 && mail -s "Lynis Weekly Audit $(hostname)" [email protected] < /var/log/lynis-weekly-$(date +\%F).log

Step 9: Centralized audit with Lynis Enterprise (optional)

If you manage multiple VPS, CISOfy offers Lynis Enterprise (paid): agents on each server reporting results to a centralized console. For 1-3 servers, the free Community version is sufficient.

Step 10: Compare over time

Lynis records scan history. View evolution:

sudo lynis show details --quick

Or export each scan to a dated file to track Hardening Index progress.

Troubleshooting

"Plugins directory not found"

sudo mkdir -p /usr/share/lynis/plugins/

Hardening Index stays low despite fixes

Re-run Lynis: a new scan is needed to update the score.

sudo lynis audit system

Specific test fails by default

Some Lynis tests make assumptions (e.g. SELinux enabled). On Debian without SELinux, these tests systematically fail. Ignore them with skip-test in the custom profile.

Useful commands

# Full audit
sudo lynis audit system

# Short audit (skip slow tests)
sudo lynis audit system --quick

# Test specific group
sudo lynis audit system --tests-from-group "kernel,authentication"

# List available tests
sudo lynis show tests

# Test details
sudo lynis show details TEST-ID

# Update Lynis
sudo lynis update info
sudo apt update && sudo apt upgrade lynis -y

# Audit dockerfile
sudo lynis audit dockerfile /path/to/Dockerfile

Conclusion

Lynis is the reference tool for fast and complete audits. Run it:

After every new VPS installation
Before going to production with a new service
Periodically (monthly) to detect regressions

Combine with complementary tools: rkhunter for rootkits, AIDE for file integrity, CrowdSec for runtime protection.

Resources

Official site: https://cisofy.com/lynis/
GitHub: https://github.com/CISOfy/lynis
Documentation: https://cisofy.com/documentation/lynis/