Lynis is a free, open-source auditing tool that checks hundreds of Linux settings and reports weaknesses with concrete suggestions. Running a Lynis security audit after setting up a VPS is a quick way to see what you missed.
Before you start
- A Linux VPS with sudo; complete first steps on a new VPS first.
- A backup or snapshot before applying many changes.
Install Lynis
sudo apt install -y lynisAlmaLinux/Rocky: install from EPEL (sudo dnf install -y epel-release && sudo dnf install -y lynis). Distribution packages can lag behind; the CISOfy repository or a Git clone gives the latest version.
Run an audit
sudo lynis audit systemThe scan takes a minute or two and prints results by section: boot, kernel, users, SSH, networking, firewall, file permissions, logging and more.
Read the results
- Hardening index: a score out of 100. Use it to track progress, not as a goal in itself.
- Warnings: important problems to fix first.
- Suggestions: improvements, each with a test ID (e.g.
SSH-7408) and a link to details.
The full report is saved to /var/log/lynis-report.dat and the log to /var/log/lynis.log. List suggestions:
sudo grep suggestion /var/log/lynis-report.datCommon findings and fixes
| Finding | Fix |
|---|---|
| SSH allows password or root login | Keys only; see SSH lockdown checklist |
| No firewall active | Enable UFW or firewalld |
| No brute-force protection | Install fail2ban |
| Pending security updates | Enable automatic security updates |
| Unused services listening | Disable with systemctl disable --now |
| No file integrity or auditing tools | Consider AIDE or auditd for sensitive servers |
| Weak kernel/sysctl settings | Review suggested sysctl values before applying |
Skip tests that do not apply
Create /etc/lynis/custom.prf and add lines like skip-test=FILE-6310 for checks that are irrelevant to your setup (for example separate partitions on a small VPS).
Schedule regular audits
0 4 * * 0 /usr/sbin/lynis audit system --cronjob > /var/log/lynis-cron.log 2>&1Add it to root's crontab and review the score weekly; see cron jobs guide.
Frequently asked questions
Does Lynis change my system?
No, it only reads and reports. You apply fixes yourself.
What score is good?
There is no universal target. Fix warnings and the suggestions relevant to your services.
Should I apply every suggestion?
No. Some conflict with your workload; understand each change first.