Master Linux Security Audits with Lynis: Installation, Scanning, and Reporting

Lynis is a free, open‑source security audit tool for Unix/Linux systems that discovers malware and vulnerabilities. After an audit, it provides a report with warnings and recommendations to help implement security policies.

Linux servers typically run many services (network, database, email, FTP, etc.). Lynis can automate security audits and penetration testing across all machines, simplifying administrators' work.

Environment

CentOS 8

lynis-3.0.0

Install Lynis

Lynis is lightweight and does not interfere with existing applications or services. Create a directory, navigate to it, and download the latest source:

[root@localhost ~]# mkdir /usr/local/lynis<br/>[root@localhost ~]# cd /usr/local/lynis/<br/>[root@localhost lynis]# wget https://downloads.cisofy.com/lynis/lynis-3.0.0.tar.gz

Extract the archive and enter the directory:

[root@localhost lynis]# tar xvf lynis-3.0.0.tar.gz<br/>[root@localhost lynis]# cd lynis

Run Lynis to display help information. The script must be executed by a user with administrative privileges; all logs and output are saved in /var/log/lynis.log:

[root@localhost lynis]# ./lynis

Start Audit and Find Vulnerabilities

Use the audit system parameter to scan the entire system:

[root@localhost lynis]# ./lynis audit system<br/>or<br/>[root@localhost lynis]# ./lynis audit system --wait

The --wait option pauses for user input before showing the next section of the report.

If you want to audit specific categories instead of the whole system, list all groups and select the desired ones:

[root@localhost lynis]# ./lynis show groups

For a simple audit of the "kernel" and "firewalls" groups, run:

[root@localhost lynis]# ./lynis --tests-from-group "kernel firewalls"

For a full list of Lynis command options, consult its manual page:

[root@localhost lynis]# ./lynis --man

Summary

Lynis is a security audit tool for Unix/Linux systems that can detect malware and vulnerabilities, helping administrators improve server security.