How to Audit Your Linux Server’s Security with Lynis

After hardening SSH, setting up a firewall, and configuring Fail2Ban, it’s easy to wonder what else might still be misconfigured or overlooked. Running a Lynis security audit on Linux answers that question directly, systematically checking your entire system against hundreds of hardening best practices and giving you a concrete list of what to improve next.

What Is Lynis?

Lynis is a free, open-source security auditing tool for Linux and Unix-based systems. It performs an extensive automated scan covering system configuration, installed software versions, file permissions, authentication settings, and dozens of other security-relevant areas, then produces a detailed report highlighting specific weaknesses along with suggestions for addressing each one.

Why Run a Security Audit Beyond Manual Hardening

Manual hardening guides (like the SSH hardening and firewall guides covered earlier) address well-known, common issues, but every system has its own specific combination of installed software, configuration choices, and edge cases that a generic guide can’t fully anticipate. Lynis examines your actual running system directly, catching issues specific to your particular setup that a general checklist would miss.

Installing Lynis

On Debian or Ubuntu-based systems:

sudo apt update
sudo apt install lynis -y

For the most current version with the latest test definitions, installing directly from the official Lynis repository rather than your distribution’s default package repository is often recommended, since security auditing tools benefit especially from staying current.

Running Your First Audit

sudo lynis audit system

This runs a comprehensive scan covering dozens of categories, displaying results directly in the terminal as each section completes, followed by a summary at the end.

Understanding the Hardening Index

At the end of a scan, Lynis reports a Hardening Index — a single score representing your system’s overall security posture based on the tests performed and how many passed versus flagged potential issues. This number is useful for tracking improvement over time rather than as an absolute benchmark, since the appropriate score varies significantly based on what a given server actually needs to do.

Reviewing Suggestions and Warnings

Lynis categorizes findings into warnings (more serious issues worth addressing promptly) and suggestions (improvements worth considering but generally lower priority). Each finding includes a reference identifier you can look up in Lynis’s documentation for more detailed context on why it matters and how to address it.

Common Findings on a Fresh Server

• Missing or weak password policies – suggestions to enforce stronger password complexity requirements for local accounts
• Unnecessary running services – flagging services installed but not actually needed, each representing unnecessary attack surface
• Missing kernel hardening parameters – sysctl settings that can be tightened for better protection against certain classes of attacks
• File permission issues – overly permissive permissions on sensitive configuration files

Reviewing the Full Log File

For more detail than the terminal summary provides, Lynis writes a comprehensive log file to /var/log/lynis.log and a report data file to /var/log/lynis-report.dat, both useful for deeper investigation into specific findings or for tracking exact results across repeated audits over time.

Running Audits Regularly

Rather than a one-time check, schedule Lynis to run periodically (monthly is a reasonable cadence for most homelab servers) via cron, comparing the resulting Hardening Index and warning count over time to confirm your security posture is improving or at least not silently regressing as you install new software or make configuration changes.

Prioritizing What to Fix

Not every flagged item is equally urgent. Focus first on warnings directly related to authentication, exposed services, and anything specifically relevant to services you’re actually running, rather than trying to resolve every single suggestion regardless of its real-world relevance to your particular setup.

Final Thoughts

Running a Lynis security audit on Linux gives you a systematic, comprehensive check against your entire server’s configuration, catching specific issues that generic hardening guides simply can’t anticipate for every possible setup. Combined with the manual hardening steps covered elsewhere — SSH configuration, firewall rules, Fail2Ban a regular Lynis audit rounds out a genuinely thorough approach to keeping a homelab server secure over time.