Do you like this software? Star the project and become a stargazer.
Lynis - Security auditing and hardening tool, for UNIX-based systems.
Lynis is a security auditing tool for systems based on UNIX like Linux, macOS, BSD, and others. It performs an in-depth security scan and runs on the system itself. The primary goal is to test security defenses and provide tips for further system hardening. It will also scan for general system information, vulnerable software packages, and possible configuration issues. Lynis was commonly used by system administrators and auditors to assess the security defenses of their systems. Besides the "blue team," nowadays penetration testers also have Lynis in their toolkit.
We believe software should be simple, updated on a regular basis, and open. You should be able to trust, understand, and have the option to change the software. Many agree with us, as the software is being used by thousands every day to protect their systems.
The main goals of Lynis include:
- Automated security auditing
- Compliance testing (e.g. ISO27001, PCI-DSS, HIPAA)
- Vulnerability detection
The software (also) assists with:
- Configuration and asset management
- Software patch management
- System hardening
- Penetration testing (privilege escalation)
- Intrusion detection
Typical users of the software:
- System administrators
- Auditors
- Security officers
- Penetration testers
- Security professionals
git clone https://github.com/jr1machado/lynis-plus
cd lynis && ./lynis audit system
If you want to run the software as root (or sudo), we suggest changing the ownership of the files. Use chown -R 0:0 to recursively alter the owner and group and set it to user ID 0 (root). Otherwise Lynis will warn you about the file permissions. After all, you are executing files owned by a non-privileged user.
This repository is lynis-plus, a fork of upstream Lynis, currently at version 4.0. It adds a CIS Benchmark compliance, hardening-report, and guided remediation layer on top of the standard Lynis audit engine. See RELEASE_NOTES_4_0.md and NEW_FEATURES_4_0.MD for details.
CIS Benchmark compliance scoring engine (include/compliance), scoring Lynis test results against CIS controls per category and per CIS Level (L1/L2). CIS rule catalog (include/rules_cis/) covering Ubuntu 22.04/24.04 LTS, Oracle Linux 9, RHEL 9, and Rocky Linux 9 (L1 + L2), with every mapped test-no validated against real Lynis tests. Offline HTML/Markdown hardening dashboard generator (include/report_hardening). New --hardening / --hardening-l2 CLI flags, fully opt-in and backwards compatible with the standard lynis audit system flow. Backup Engine (include/backup) — timestamped snapshot of any file before it's modified, tracked in a plain-text manifest. Remediation Engine (include/remediation) — applies a single CIS control fix with mandatory human approval, then auto-verifies and auto-rolls-back on failure. Rollback Engine (include/rollback) — restores a file to its last backed-up state, on demand or automatically. New lynis apply / lynis rollback commands, with fix/verify metadata currently shipped for SSH-001 (disable root login) and AUTH-005 (default umask) across all 5 supported distros; every other control reports "no automated fix available yet" instead of guessing. Usage guide
./lynis audit system --hardening # score the audit against CIS Level 1 controls ./lynis audit system --hardening-l2 # also score CIS Level 2 controls (audit-only, separate score) Requires root (or sudo) for a full scan, same as a normal Lynis audit. Output:
On-screen: overall + per-category score, right after the normal Lynis summary. /var/log/lynis-report.dat: raw finding[]= / cis_*= entries. /var/log/lynis-hardening-report.html: standalone offline dashboard (dark theme, color-coded PASS/FAIL/SKIP). /var/log/lynis-hardening-report.md: same data as a Markdown table, good for CI/PRs. Supported OS: Ubuntu 22.04/24.04 LTS, Oracle Linux 9, RHEL 9, Rocky Linux 9. Other OSes just skip the compliance step (audit still runs normally).
./lynis apply --test-no SSH-7408 # disable root SSH login (with approval prompt) ./lynis apply --test-no AUTH-9328 # set a strict default umask (027) ./lynis apply --test-no --dry-run # preview impact + commands, no changes made, no prompt is the Lynis test-no shown in finding[]= entries or the hardening report table (e.g. SSH-7408); the CIS rule ID (e.g. SSH-001) also works. Flow, always in this order:
Shows the rule's title, CIS section, severity, target file, and the exact fix/verify commands. If no fix is defined for that control yet, says so and stops — nothing is touched. Prompts Apply this fix? [y/N] — nothing happens without an explicit y. Backs up the target file (backups//...bak, indexed in backups/manifest.log). Runs the fix, then the verify command. If verification fails, automatically restores the backup and reports the failure. Logs the outcome to history/remediation.log (timestamp|rule|test-no|status|hostname). Only CIS Level 1 rules can be applied — Level 2 controls are intentionally audit-only (higher risk of breaking things) and are never targeted by apply.
./lynis rollback --test-no SSH-7408 Restores the target file from its most recent backup for that rule, regardless of whether the last apply succeeded, failed, or was applied a while ago. Safe to run even if nothing was ever applied — it just reports there's no backup to restore.
Any global Lynis flag (--no-colors, --quiet, --verbose, ...) must be placed before the subcommand, same as with lynis show or lynis configure:
./lynis --no-colors audit system --hardening Lynis is a security auditing tool for systems based on UNIX like Linux, macOS, BSD, and others. It performs an in-depth security scan and runs on the system itself. The primary goal is to test security defenses and provide tips for further system hardening. It will also scan for general system information, vulnerable software packages, and possible configuration issues. Lynis was commonly used by system administrators and auditors to assess the security defenses of their systems. Besides the "blue team," nowadays penetration testers also have Lynis in their toolkit.
We believe software should be simple, updated on a regular basis, and open. You should be able to trust, understand, and have the option to change the software. Many agree with us, as the software is being used by thousands every day to protect their systems.
Have a look at the Lynis documentation to learn more about the configuration and usage of Lynis. When you are interested in reading more articles about Linux security, then check out the Linux security blog named Linux Audit. For some suggestions by Lynis, this is also the source used to learn more about specific findings.
If you want to create your own tests, have a look at the Lynis software development kit.
We participate in the CII best practices badge program of the Linux Foundation.
Lynis is collecting some awards along the way and we are proud of that.
-
2016
- Best of Open Source Software Awards 2016.
- Article by TechRepublic, considering Lynis a "must-have" tool: How to quickly audit a Linux system from the command line
-
2015
-
2014
-
2013
We love contributors.
Do you have something to share? Want to help out with translating Lynis into your own language? Create an issue or pull request on GitHub, or send us an e-mail: lynis-dev@cisofy.com.
More details can be found in the Contributors Guide.
You can also simply contribute to the project by starring the project and show your appreciation that way.
Thanks!
GPLv3
This software component is also part of an enterprise solution and focuses on companies. Same quality, yet with more functionality.
Focus areas include compliance (PCI DSS, HIPAA, ISO27001, and others). The Enterprise version comes with:
- a web interface;
- dashboard and reporting;
- hardening snippets;
- improvement plan (based on risk);
- commercial support.