Lynis

Lynis audits a Linux host against a large set of hardening checks — authentication configuration, kernel parameters, file permissions, installed services, logging setup — and reports findings with a hardening index.

It is a shell script that runs locally, requires no agent and no infrastructure, and is genuinely useful for the thing it is good at: telling you what you forgot. Hardening a system involves dozens of small settings, and nobody remembers all of them. Running Lynis after building a host reliably surfaces several things that were meant to be configured and were not.

The score is the trap

The hardening index invites optimisation, and optimising it is a mistake.

Lynis checks generic best practice against a host whose purpose it does not know. Some findings are irrelevant — a warning about a service that is deliberately running because it is what the machine is for. Some are wrong for the context. And some settings that raise the score make the system worse for its actual job.

Applying every recommendation to raise a number produces a host that scores well and works badly. I have seen this done, and undoing it is harder than the original hardening.

The right use is as a checklist to argue with. Go through the findings, decide about each one, and record why the rejected ones were rejected. The decision record is more valuable than the score, because the next person to run Lynis will otherwise re-investigate the same findings.

What it complements

It complements rather than replaces the enforcement tools. Lynis observes and reports; SELinux and AppArmor constrain; auditd records. A high Lynis score says configuration matches guidance at one moment, and says nothing about whether the host is currently compromised.

It also does not stay true. A host audited at build time drifts as it is administered, so a single run is a snapshot. Running it periodically and diffing against the last result catches drift, and that is more useful than the absolute score ever is.

For fleet-wide assessment, Wazuh does configuration assessment continuously and centrally, which is the better structure at scale. Lynis is the right tool for auditing a host you are working on now.

See also: host hardening patterns, SELinux, auditd, and Linux administration in datacenters.