VPS Security Audit with Lynis — Improve Your Hardening Index

Most VPS administrators configure their servers and assume they're secure — but hidden misconfigurations lurk beneath the surface: overly permissive file permissions, unnecessary running services, outdated SSH ciphers, or missing kernel hardening parameters.

Lynis is an open-source security auditing tool that scans your Linux/Unix system and produces a Hardening Index score (0–100) alongside a prioritized list of hardening recommendations. Enterprise security teams have used Lynis as part of their compliance workflow since 2007, and it remains one of the most practical tools for VPS hardening.

Lynis vs. Vulnerability Scanners

Lynis is a security auditing tool, not a vulnerability scanner like Nessus or OpenVAS. Here's the key difference:

The two tools complement each other well — use Lynis to harden your configuration first, then run a vulnerability scanner to check for known CVEs.

Installing Lynis

Ubuntu / Debian

# Install from official Lynis repository (recommended — always latest version)
curl -fsSL https://packages.cisofy.com/keys/cisofy-software-public.key | sudo gpg --dearmor -o /usr/share/keyrings/cisofy-software-public.gpg
echo "deb [arch=amd64,arm64 signed-by=/usr/share/keyrings/cisofy-software-public.gpg] https://packages.cisofy.com/community/lynis/deb/ stable main" | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list
sudo apt update
sudo apt install lynis -y

# Verify installation
lynis show version

CentOS / AlmaLinux / Rocky Linux

sudo rpm --import https://packages.cisofy.com/keys/cisofy-software-public.key
cat > /etc/yum.repos.d/cisofy-lynis.repo << 'EOF'
[lynis]
name=CISOfy Software - Lynis package
baseurl=https://packages.cisofy.com/community/lynis/rpm/
enabled=1
gpgcheck=1
gpgkey=https://packages.cisofy.com/keys/cisofy-software-public.key
priority=2
EOF
sudo yum install lynis -y

Install via Git (always latest version)

cd /opt
sudo git clone https://github.com/CISOfy/lynis
cd lynis
sudo ./lynis audit system

Running Your First Security Audit

# Run a full system audit (requires root)
sudo lynis audit system

# Quiet mode — show only warnings and suggestions
sudo lynis audit system --quiet

# Save report to file
sudo lynis audit system --report-file /tmp/lynis-report-$(date +%Y%m%d).dat

Lynis scans categories including Boot/Services, Filesystem, Users, Networking, Logging, Malware, Authentication, SSH, Firewall, and Cryptography. A typical scan takes 1–3 minutes.

Understanding the Audit Results

After scanning, Lynis displays a summary like this:

================================================================================
  Lynis security scan details:

  Hardening index : 68 [##############      ]
  Tests performed : 242
  Plugins enabled : 2

  Files:
  - Test and debug information      : /var/log/lynis.log
  - Report data                     : /var/log/lynis-report.dat
================================================================================

The Hardening Index is a score from 0–100. Freshly provisioned servers typically score 50–65. A good target is 75+ for production servers.

Reading Warnings and Suggestions

# View all warnings from the report
grep "^warning\[]" /var/log/lynis-report.dat

# View all suggestions
grep "^suggestion\[]" /var/log/lynis-report.dat

# Show warnings and suggestions via lynis
sudo lynis show warnings
sudo lynis show suggestions

Common warnings and their fixes:

Applying Lynis Hardening Suggestions

Disable Root SSH Login

sudo sed -i 's/^#*PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Configure Password Aging

# Set defaults in /etc/login.defs
sudo sed -i 's/^PASS_MAX_DAYS.*/PASS_MAX_DAYS   90/' /etc/login.defs
sudo sed -i 's/^PASS_MIN_DAYS.*/PASS_MIN_DAYS   7/' /etc/login.defs
sudo sed -i 's/^PASS_WARN_AGE.*/PASS_WARN_AGE   14/' /etc/login.defs

Enable Process Accounting

sudo apt install acct -y   # Debian/Ubuntu
sudo systemctl enable acct --now

Add a Legal Warning Banner

echo "Authorized access only. Activity is monitored." | sudo tee /etc/issue.net
sudo sed -i 's/^#*Banner.*/Banner \/etc\/issue.net/' /etc/ssh/sshd_config
sudo systemctl restart sshd

Scanning Specific Categories

# Scan only SSH settings
sudo lynis audit system --tests-from-group ssh

# Scan only authentication
sudo lynis audit system --tests-from-group authentication

# List all available groups
sudo lynis show groups

# Run specific test IDs
sudo lynis audit system --tests AUTH-9262,SSH-7408

Scheduling Automated Weekly Scans

# Create automated scan script
cat > /etc/cron.weekly/lynis-audit << 'EOF'
#!/bin/bash
REPORT_DIR="/var/log/lynis-reports"
mkdir -p "$REPORT_DIR"
DATE=$(date +%Y%m%d)
sudo lynis audit system --cronjob \
  --report-file "$REPORT_DIR/lynis-report-$DATE.dat" \
  > "$REPORT_DIR/lynis-log-$DATE.txt" 2>&1
# Keep reports for 30 days
find "$REPORT_DIR" -mtime +30 -delete
EOF
chmod +x /etc/cron.weekly/lynis-audit

Tracking Progress Over Time

# Compare hardening index across scans
grep "hardening_index" /var/log/lynis-reports/lynis-report-*.dat

# Example output:
# hardening_index=68  (2026-09-01)
# hardening_index=72  (2026-09-08)
# hardening_index=76  (2026-09-15)

A rising Hardening Index week over week confirms your hardening efforts are working. The long-term goal is 80+ for production servers handling sensitive data.

Verify Lynis is Working Correctly

# 1. Check version and database directory
lynis show version
lynis show dbdir

# 2. Check for Lynis updates
sudo lynis update info

# 3. Quick check — show only warnings and suggestions
sudo lynis audit system --quick 2>&1 | grep -E "Warning|Suggestion|Hardening"

# 4. Verify log shows completed scan
sudo tail -5 /var/log/lynis.log

# 5. Check latest hardening index
grep "hardening_index" /var/log/lynis-report.dat

Troubleshooting Common Issues

Error: "Lynis requires root privileges"

Lynis needs root access to inspect file permissions and restricted configuration files.

# Run with sudo
sudo lynis audit system

# Or switch to root first
sudo su -
lynis audit system

Error: "No tests were performed" or scan stops mid-way

Usually caused by an outdated Lynis version or incomplete database.

# Update Lynis
sudo apt update && sudo apt upgrade lynis -y  # Debian/Ubuntu
sudo yum update lynis -y  # RHEL/CentOS

# If using Git version
cd /opt/lynis && sudo git pull

# Verify database integrity
sudo lynis show dbdir
ls -la $(sudo lynis show dbdir)

Error: "File permissions are not set correctly for /etc/lynis/custom.prf"

Lynis checks the permissions of its own config files. The profile must be 640 or 600.

sudo chmod 640 /etc/lynis/custom.prf
sudo chown root:root /etc/lynis/custom.prf

Many warnings about kernel parameters

Lynis recommends many sysctl settings — but some may conflict with your applications. Always test in a staging environment first.

# Review kernel-related suggestions
grep "KRNL\|sysctl" /var/log/lynis-report.dat | grep "suggestion\|warning"

# Test a sysctl value temporarily before making it persistent
sudo sysctl -w net.ipv4.conf.all.accept_redirects=0
# If no issues, persist it:
echo "net.ipv4.conf.all.accept_redirects=0" | sudo tee -a /etc/sysctl.d/99-lynis.conf

Cron job runs but no report is generated

Check that the cron script has execute permissions and uses the full path to lynis.

# Find full path of lynis
which lynis

# Use absolute path in cron script
/usr/bin/lynis audit system --cronjob

# Check cron mail for errors
sudo grep "lynis" /var/mail/root 2>/dev/null || sudo journalctl -u cron | grep lynis

Frequently Asked Questions

Which Linux distributions does Lynis support?

Lynis supports all major Linux distributions including Ubuntu, Debian, CentOS, AlmaLinux, Rocky Linux, Fedora, and Arch Linux, as well as macOS and FreeBSD. The audit automatically adapts to your distribution — for example, SSH config checks look in the correct paths for your specific OS.

Is a Hardening Index of 70 considered passing?

There's no fixed pass/fail threshold — it depends on your use case. General-purpose servers should target 65+, VPS handling sensitive data should aim for 75+, and servers requiring compliance (PCI-DSS, HIPAA) should reach 80+. Think of it as a continuous improvement baseline, not a one-time exam score.

How is Lynis different from OpenSCAP?

OpenSCAP is a framework for compliance against specific standards (CIS Benchmark, STIG) — it's more complex and requires XML policy profiles. Lynis is simpler, requires no special profiles, and provides immediately actionable recommendations. They work well together: use Lynis for quick hardening audits and OpenSCAP for formal compliance reporting.