Lynis Security Audit for VPS Linux servers

VPS Security Audit with Lynis: Complete Hardening Guide

Updated: October 10, 2026 · Security · ~12 min read

Lynis is one of the most popular open-source security auditing tools for Linux/Unix systems. It performs an in-depth local scan covering kernel parameters, file permissions, installed packages, authentication settings, and more — then calculates a Hardening Index score from 0 to 100 along with clear warnings and actionable suggestions.

Unlike Nessus or OpenVAS which require a separate scanning server, Lynis runs directly on the host without any agents. It is ideal for sysadmins who want to audit their VPS before going live or set up scheduled monthly audits.

Why Use Lynis?

A freshly installed Ubuntu or Debian VPS typically starts with a hardening index of just 55–65 out of 100. That means there are still many vulnerabilities to close, such as:

Note: Lynis does not exploit your system — it is a read-only audit tool only. Safe to run on production servers.

Install Lynis on Ubuntu/Debian

Install from the CISOfy repository to always get the latest version (the Ubuntu apt package is often outdated):

# Add GPG key and repository
curl -fsSL https://packages.cisofy.com/keys/cisofy-software-public.key | \
  sudo gpg --dearmor -o /etc/apt/keyrings/cisofy.gpg

echo "deb [signed-by=/etc/apt/keyrings/cisofy.gpg] \
  https://packages.cisofy.com/community/lynis/deb/ stable main" | \
  sudo tee /etc/apt/sources.list.d/cisofy-lynis.list

sudo apt update
sudo apt install lynis -y

# Check version
lynis --version

Install on CentOS/AlmaLinux/Rocky Linux

# Add CISOfy repo
cat <

Running Your First Security Audit

The main command is lynis audit system — must be run as root:

sudo lynis audit system

Lynis will run through 200+ tests in approximately 2–5 minutes. Results are color-coded in the terminal:

Reading the Hardening Index and Report

At the end of the output you will see a summary like this:

================================================================================
  Lynis security scan details:

  Hardening index : 67 [#############       ]
  Tests performed : 247
  Plugins enabled : 0

  Components:
  - Firewall               [V]
  - Malware scanner        [X]
  - File integrity tool    [X]
================================================================================

The full report is saved to /var/log/lynis.log and /var/log/lynis-report.dat:

# View all warnings
grep "^warning\[\]" /var/log/lynis-report.dat

# View suggestions
grep "^suggestion\[\]" /var/log/lynis-report.dat

# View hardening index
grep "hardening_index" /var/log/lynis-report.dat

Fixing Common Warnings

1. SSH Root Login Is Allowed

Warning: SSH root login is allowed

sudo sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

2. SSH Password Authentication Is Enabled

Warning: SSH password authentication is enabled

sudo sed -i 's/^#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd
Warning: Before disabling password auth, make sure your SSH key is working. Otherwise you will lock yourself out of the server.

3. No Malware Scanner Installed

Suggestion: Install a file integrity tool

sudo apt install rkhunter -y
sudo rkhunter --update
sudo rkhunter --check --sk

4. auditd Is Not Running

Warning: auditd not running

sudo apt install auditd -y
sudo systemctl enable auditd
sudo systemctl start auditd

5. Kernel Hardening Parameters Incomplete

Suggestion: Consider hardening sysctl settings

cat <

Schedule Weekly Automated Audits

Set up a cron job to run Lynis weekly and save reports:

# Create script
cat <<'EOF' | sudo tee /usr/local/bin/lynis-weekly.sh
#!/bin/bash
REPORT_DIR=/var/log/lynis-reports
mkdir -p $REPORT_DIR
DATE=$(date +%Y-%m-%d)
lynis audit system --no-colors > $REPORT_DIR/lynis-$DATE.log 2>&1
# Keep reports for 30 days
find $REPORT_DIR -name "lynis-*.log" -mtime +30 -delete
EOF

sudo chmod +x /usr/local/bin/lynis-weekly.sh

# Add cron job every Sunday at 02:00
echo "0 2 * * 0 root /usr/local/bin/lynis-weekly.sh" | \
  sudo tee /etc/cron.d/lynis-audit

Non-Interactive Mode for CI/CD

Run Lynis in pipelines without any interactive prompts:

sudo lynis audit system --quick --no-colors 2>&1 | \
  tee /tmp/lynis-ci.log

# Extract hardening index
SCORE=$(grep "hardening_index" /var/log/lynis-report.dat | cut -d'=' -f2)
echo "Hardening Index: $SCORE"

# Fail pipeline if score is below 70
[ "$SCORE" -lt 70 ] && echo "FAIL: Score too low" && exit 1 || echo "PASS"

Custom Profiles for Compliance

Lynis supports custom profiles to skip irrelevant tests or add company-specific hardening rules:

# Copy default profile
sudo cp /etc/lynis/default.prf /etc/lynis/custom.prf

# Skip a known false-positive test
echo "skip-test=AUTH-9308" >> /etc/lynis/custom.prf

# Run with custom profile
sudo lynis audit system --profile /etc/lynis/custom.prf

Verify Lynis Is Working Correctly

# Check version and database integrity
sudo lynis show version
sudo lynis show dbdir

# Run tests for a specific category only (e.g. authentication)
sudo lynis audit system --tests-from-category "authentication"

# Run specific test IDs
sudo lynis audit system --tests "AUTH-9328 SSH-7408"

# View recent warnings
sudo grep "^warning" /var/log/lynis-report.dat | tail -20

# Confirm report files exist
ls -lh /var/log/lynis*.log /var/log/lynis-report.dat
Tip: After fixing warnings, re-run sudo lynis audit system to verify your Hardening Index improved. Iterate until you reach 75+ for production servers.

Troubleshooting Common Issues

Error: "lynis: command not found" after installation

The /usr/sbin directory may not be in the regular user's PATH. Always run with sudo or use the full path:

sudo /usr/sbin/lynis audit system
# Or check where it was installed
which lynis
ls -la /usr/sbin/lynis /usr/bin/lynis 2>/dev/null

Error: "Lynis is outdated" warning in output

Lynis has a built-in version check. If you installed from the Ubuntu apt repository, it may be outdated. Update from the CISOfy repo:

sudo apt update && sudo apt upgrade lynis -y
lynis show version

Error: "No suitable home directory found for user" in report

This usually refers to system service accounts without real home directories — typically not a real threat. Confirm they are service accounts:

# Check details for this test
sudo lynis show details AUTH-9234

# Verify these are service accounts
grep "^nobody\|^www-data\|^daemon" /etc/passwd

Warning: "AIDE not installed" — file integrity monitoring needed

AIDE (Advanced Intrusion Detection Environment) is a file integrity checker that Lynis recommends. Install it:

sudo apt install aide -y
sudo aideinit
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# Run integrity check
sudo aide --check

Frequently Asked Questions

What is the difference between Lynis and OpenVAS?

Lynis is a local audit tool — it runs directly on the target machine to check system hardening and compliance. OpenVAS is a network vulnerability scanner that probes from the outside to find open ports and network-level vulnerabilities. Both tools complement each other and should ideally be used together for complete coverage.

What hardening index score is considered "secure"?

There is no magic number — but generally 70+ is considered acceptable for typical production servers, 80+ for servers storing sensitive data, and 85+ for compliance-driven environments (PCI-DSS, HIPAA). A freshly installed Ubuntu 22.04 server typically scores around 60–65.

Can I run Lynis inside a Docker container?

Yes, but results will be limited because containers do not have full kernel access — many tests will be automatically skipped. Lynis is best suited for auditing host operating systems. For container-specific security auditing, use docker bench or trivy instead.

Related Articles