What is Lynis

Lynis is a comprehensive security auditing tool for Unix-based systems, including Linux and macOS. Unlike typical antivirus solutions, Lynis focuses on system hardening by checking configuration issues, vulnerabilities, and weaknesses that could expose your server to attacks. It performs a deep analysis of system settings, file permissions, services, and installed software, helping administrators improve the overall security posture of their VPS. Lynis is widely used by security professionals, auditors, and system administrators to evaluate system health and security compliance. It generates detailed reports and provides actionable suggestions to mitigate security risks, making it an essential tool for anyone managing a VPS.

Key Features of Lynis

Installing Lynis on an Ubuntu VPS

To secure your Ubuntu VPS using Lynis, follow these steps to install and configure it.

As always, it’s important to keep your server up to date. Begin by updating the package index and upgrading the system:

Lynis is available in Ubuntu’s default repositories, so you can easily install it using the following command:

Alternatively, you can download the latest version directly from the Lynis GitHub repository if you want the most recent updates:

The installation is complete, and Lynis is ready to be used for auditing your system.

Running a Security Audit with Lynis

After installing Lynis, you can start auditing your server for security weaknesses and best practices.

To run a quick and complete system audit, execute the following command:

Lynis will begin scanning your system, checking for configuration issues, security vulnerabilities, and areas that require hardening. The scan will include categories such as:

During the audit, Lynis will display its progress in the terminal, showing warnings, suggestions, and tips.

Once the audit is complete, Lynis will generate a detailed report of its findings. This report provides critical information on system security, showing areas that need attention.

To view the audit report summary, scroll up in your terminal after the audit finishes. You can also find a detailed report stored at:

Another key output is the lynis-report.dat file, which contains all findings and suggestions. You can view this file in the following directory:

Lynis organizes its findings into categories like Warnings, Suggestions, and Hardening Index:

Lynis provides actionable recommendations in its report. Here’s how you can address some common issues:

- Update Software: If Lynis reports outdated software or packages, make sure to update them using:

- Configure Firewall: Lynis might suggest improving your firewall rules. Ensure that you have ufw (Uncomplicated Firewall) set up and configured to allow only necessary traffic:

- Secure SSH: Lynis will often recommend hardening SSH access by disabling root login and using key-based authentication:

- Edit the SSH configuration file:

- Ensure the following lines are present:

- Restart SSH:

- Check File Permissions: Lynis may report issues with file or directory permissions. Make sure that critical files (e.g., /etc/passwd) have the correct permissions and ownership:

After addressing the issues and suggestions, re-run the audit to ensure the improvements are recognized by Lynis:

This will confirm that your changes have been applied correctly and that your security posture has improved.

Automating Lynis Audits

To ensure regular system audits, you can set up a cron job that runs Lynis periodically and logs the results. Here’s how to schedule a weekly audit:

1. Open the cron configuration file:

2. Add the following line to run a Lynis audit every Monday at 3 AM:

This command will run the audit quietly and save the output to /var/log/lynis-cron.log.

Lynis is an invaluable tool for hardening your Ubuntu VPS by identifying weaknesses, vulnerabilities, and misconfigurations. By regularly running security audits with Lynis, you can ensure your server is properly secured and compliant with best practices. Its actionable recommendations and clear reports make it an essential tool for any system administrator looking to maintain a secure environment. With Lynis, you can proactively address security concerns and protect your server from potential threats before they become critical issues.