https://cisofy.com/lynis/

1<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><link rel="stylesheet" href="/static/css/main.css"><link rel="stylesheet" href="https://rsms.me/inter/inter.css"><link rel="stylesheet" href="https://unpkg.com/[email protected]/css/boxicons.min.css"><link rel="icon" href="/favicon.ico"><link rel="canonical" href="https://cisofy.com/lynis/"><title>Lynis - Security auditing tool for Linux, macOS, and Unix-based systems - CISOfy</title><meta name="apple-mobile-web-app-capable" content="yes"><meta name="apple-mobile-web-app-status-bar-style" content="black-translucent"><meta name="description" content="Lynis is the popular security auditing tool for Linux, Unix, and macOS systems. It helps you run security scans and provides guidance during system hardening."><meta name="msapplication-TileColor" content="#ffffff"><meta name="msapplication-TileImage" content="/ms-icon-144x144.png"><meta name="theme-color" content="#FF5500"><meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=yes"><meta property="og:description" content="Lynis is an open source security auditing tool. Part of Lynis Enterprise Suite, its main goal is to audit and harden Unix and Linux based systems." /><meta property="og:title" content="Lynis - Security auditing and hardening tool for Linux/Unix" /><meta property="og:url" content="https://cisofy.com/lynis/" /><meta property="og:type" content="product"><meta property="og:image" content="https://cisofy.com/static/lynis-screenshot-769.png" /><meta property="og:image:height" content="769" /><meta property="og:image:width" content="769" /></head><body><header><a class="logo" href="/"><img src="/static/logo.svg" alt="Logo of CISOfy, a company specialized in Linux security solutions" width="360"></a><!-- Hamburger icon --><input class="side-menu" type="checkbox" id="side-menu"><label class="hamb" for="side-menu"><span class="hamb-line"></span></label><nav class="mainmenu" aria-label="Main navigation"><ul class="menu"><li><a href="/lynis/">Lynis</a></li><li><a href="/lynis-enterprise/">Lynis Enterprise</a></li><li><a href="/downloads/">Downloads</a></li><li><a href="/pricing/">Pricing</a></li><li><a href="/demo/">Demo</a></li><li><a href="/trial/request/">Request a Trial</a></li><li><a href="/support/">Documentation</a></li><li><a href="/about/">About</a></li></ul></nav></header><main><nav class="breadcrumbs" aria-label="breadcrumbs"><ul><li><a href="https://cisofy.com/">Home</a></li><li><strong>Lynis</strong></li></ul></nav><div style="width:90%;font-size:1rem;position:relative;margin-top:2rem;display:block;background-color:#1976D2;color:white; border:1px solid gray;border-radius:4px; padding:1rem;"><i class="bx bx-hard-hat"></i> Our website is currently getting an overhaul. Something not working correctly? <i class='bx bx-envelope'></i>&nbsp;<a style="color:white;text-decoration:underline;" href="/contact/">Let us know!</a></div><article><header><h1 class="speakable">Lynis</h1></header><div id="lynis-container" class="container"><div class="max33 inline left s-t"><nav class="m-t"><ul class="squares"><li><a href="#introduction">Introduction</a><ul><li><a href="#use-cases">Audience and use-cases</a></li><li><a href="#operating-systems">Supported operating systems</a></li></ul></li><li><a href="#how-it-works">How it works</a><ul><li><a href="#lynis-tests">Lynis tests (controls)</a></li><li><a href="#lynis-plugins">Plugins</a></li><li><a href="#supported-standards">Supported standards</a></li></ul></li><li><a href="#demo">Demo</a></li><li><a href="#comparison">Comparison with other tools</a></li><li><a href="#installation">Installation</a></li><li><a href="#download">Download</a></li><li><a href="/lynis-enterprise/">Lynis Enterprise</a></li></ul><p><a class="button-small button-green" href="/documentation/lynis/get-started/">Get Started</a></p></nav></div><div class="max66 inline left p-32"><div id="introduction"><section><h2>Lynis, an introduction</h2><h3>Auditing, system hardening, compliance testing</h3><p>Lynis is a battle-tested security tool for systems running Linux, macOS, or Unix-based operating system. It performs an extensive health scan of your systems to support system hardening and compliance testing. The project is open source software with the <abbr title="GNU Public License">GPL</abbr> license and available since 2007.</p><figure class="m-0 m-t"><img class="max-width" src="/static/lynis-screenshot.png" alt="Example screenshot of a Linux security scan with Lynis" title="Example output of a security audit with Lynis" width="800" height="600"><figcaption>Security scan with Lynis</figcaption></figure><h3>Project goals</h3><p>Since Lynis is flexible, it is used for several different purposes. Typical use cases for Lynis include:</p><ul class="squares"><li>Security auditing</li><li>

1Compliance testing (e.g. PCI, HIPAA, SOx)</li><li>Penetration testing</li><li>Vulnerability detection</li><li>System hardening</li></ul><div id="use-cases" class="m-t"><h3>Audience and use cases</h3><ul><li><strong>Developers</strong>: Test that Docker image, or improve the hardening of your deployed web application.</li><li><strong>System administrators</strong>: Run daily health scans to discover new weaknesses.</li><li><strong>IT auditors</strong>: Show colleagues or clients what can be done to improve security.</li><li><strong>Penetration testers</strong>: Discover security weaknesses on systems of your clients, that may eventually result in system compromise.</li></ul></div><div id="operating-systems" class="m-t"><h3>Supported operating systems</h3><p>Lynis runs on almost all UNIX-based systems and versions, including:</p><ul><li>AIX</li><li>FreeBSD</li><li>HP-UX</li><li>Linux</li><li>macOS</li><li>NetBSD</li><li>NixOS</li><li>OpenBSD</li><li>Solaris</li><li>and others</li></ul><p>It even runs on systems like the Raspberry Pi, IoT devices, and QNAP storage devices.</p></div></section></div><div id="how-it-works" class="m-t"><section><h2>How it works</h2><p>Lynis scanning is modular and <em>opportunistic</em>. This means it will only use and test the components that it can find, such as the available system tools and its libraries. The benefit is that no installation of other tools is needed, so you can keep your systems clean.</p><p>By using this scanning method, the tool can run with almost no dependencies. Also, the more components it discovers, the more extensive the audit will be. In other words: Lynis will always perform scans that are tailored to your system. No audit will be the same!</p><p><strong>Example</strong>: When Lynis detects that you are running Apache, it will perform an initial round of Apache related tests. Then when it performs the specific Apache tests, it may also discover a SSL/TLS configuration. It then performs additional auditing steps based on that. A good example is collecting any discovered certificates, so that they can be scanned later as well.</p><h3>Audit steps</h3><p>This is what happens during a typical scan with Lynis:</p><ol><li>Initialization</li><li>Perform basic checks, such as file ownership</li><li>Determine operating system and tools</li><li>Search for available software components</li><li>Check latest Lynis version</li><li>Run enabled plugins</li><li>Run security tests per category</li><li>Perform execution of your custom tests (optional)</li><li>Report status of security scan</li></ol><p>Besides the report and information displayed on screen, all technical details about the scan are stored in a log file (lynis.log). Findings like warnings and suggestions are stored in a separate report file (lynis-report.dat).</p><div id="lynis-tests"><h3>Lynis tests (controls)</h3><p>Lynis performs hundreds of individual tests. Each test will help to determine the security state of the system. Most tests are written in shell script and have a unique identifier (e.g. KRNL-6000).</p><p>Interested in learning more about the tests? Have a look at the <a href="/lynis/controls/">Lynis controls</a> and individual tests.</p><h4>Flexibility</h4><p>With the unique identifiers it is possible to tune a security scan. For example, if a test is too strict for your scanning appetite, simply disable it. This way you get an optimal system audit for your environment.</p><p>Lynis is modular and allows to run your self-created tests. You can even create them in other scripting or programming languages.</p></div><div id="lynis-plugins"><h3>Lynis Plugins</h3><p>Plugins are modular extensions to Lynis. With the help of the plugins, Lynis will perform additional tests and collect more system information.</p><p>Each plugin has the objective to collect specific data. This data is stored in the Lynis report file (lynis-report.dat). Depending on your usage of Lynis, the collected data might provide valuable insights between systems or between individual scans.</p><p>The plugins provide the most value in environments with more than 10 systems. Some plugins are available in the downloads section.</p><h4>Extra plugins</h4><p>As part of our <a href="/lynis-enterprise/">Lynis Enterprise</a> offering, the core developers maintain a set of plugins for our customers. The data that is collected centrally (SaaS or self-hosted), provide additional insights, such as available users, processes, and network details. Another important area is compliance testing, where the data points help to test against common standards and hardening guides.</p><a class="button button-green button-small" href="/lynis/plugins/" style="width:200

1px;">Lynis plugins overview</a></div><div id="supported-standards"><h3>Supported standards</h3><p>Other tools typically use the same data files to perform tests. Lynis is not limited to a specific Linux distribution, therefore it uses the knowledge of 10+ years from a wide range of sources. It may help you to automate or test against security best practices from sources like:</p><ul class="squares"><li>CIS benchmarks</li><li>NIST</li><li>NSA</li><li>OpenSCAP data</li><li>Vendor guides and recommendations (e.g. Debian Gentoo, Red Hat)</li></ul></div></section></div><div id="demo" class="m-t"><section><h2>Demo (in 30 seconds!)</h2><p>Time is precious. So look how quick you can install Lynis and have it perform a security scan. That is hard to beat, right?</p><link rel="stylesheet" href="/static/asciinema-player.css" integrity="sha256-iujxXj6n0O2Rkqm5VeKMlq1MO3j0VCR8ANVFbmY8D8w=" crossorigin="anonymous"><asciinema-player src="/static/asciinema-18690.json" cols="78" rows="22"></asciinema-player>

1<script src="/static/asciinema-player.js" integrity="sha256-/oilw+7xUMTalFau3LOfP/jv+Rjv1ZYu0x4+tu33LlY=" crossorigin="anonymous" async></script>

1</section></div><div id="comparison" class="m-t"><section><h2>Comparison with other tools</h2><p>Lynis has a different way of doing things, so you gain more flexibility. After all, you should be the one deciding what security controls make sense for your environment. Here are some comparisons with some other well-known tools.</p><h3>Bastille Linux</h3><p>Bastille was for a long time the best known utility for hardening Linux systems. It focuses mainly on automatically hardening the system.</p><h4>Differences with Bastille</h4><p>Automated hardening tools are helpful, but at the same time might give a false sense of security. Instead of just turning on some settings, Lynis perform an in-depth security scan. You are the one to decide what level of security is appropriate for your environment. After all, not all systems have to be like <a href="http://en.wikipedia.org/wiki/Fort_Knox" title="Fort Knox Wikipedia page">Fort Knox</a>, unless you want it to be.</p><h4>Benefits of Lynis</h4><ul><li>Supports more operating systems</li><li>Won't break your system</li><li>More in-depth audit</li></ul><h3>OpenVAS and Nessus</h3><p>These products focus primarily on vulnerability scanning. They do this via the network by searching for discoverable services. Optionally, they will log in to a system and gather data.</p><h4>Differences with Nessus or OpenVAS</h4><p>Lynis runs on the host itself. Therefore it can perform a deeper analysis compared with network-based scans. This means less risk to impact your business processes and log files remain clean from connection attempts and incorrect requests.</p><p>Although Lynis is an auditing tool, it will discover vulnerabilities as well. It does so by using existing tools and analyzing configuration files.</p><p>Lynis and OpenVAS are both open source and free to use. Nessus is proprietary software and only available as part of a commercial offering.</p><h4>Benefits of Lynis</h4><ul class="squares"><li>Much faster</li><li>No pollution of log files</li><li>Much lower risk of disruption to business services</li><li>Host-based scans provide a more in-depth audit</li></ul><h3>Tiger</h3><p><a href="https://www.nongnu.org/tiger/">Tiger</a> was one of the first tools for testing the security of Linux systems. It was created by CIS Network group of the A&M campus of the Texas University.</p><p>Lynis and Tiger are similar, with one big difference: Lynis is still maintained, Tiger is not.</p><h4>Benefits of Lynis</h4><ul class="squares"><li>Maintained</li><li>Supports newer technologies</li></ul></section></div><div id="installation" class="m-t"><section><h2>Installation</h2><p>Lynis is light-weight and easy to use. Although most users will install Lynis via a package, installation is not required! Just extract the archive (tarball) and run <code>./lynis audit system</code></p><h3>Installation options</h3><ul class="squares"><li>Clone via GitHub</li><li>Software package</li><li>Tarball</li><li>Homebrew</li><li>Ports (BSD)</li></ul><p>First time user to Lynis? We suggest to follow the <a href="/documentation/lynis/get-started/">Get Started</a> guide.</p></section></div><div id="download" class="m-t"><section><h2>Download</h2><h3>Download tarball</h3><p>If you prefer to use a tarball to test and deploy, see details on the <a href="/downloads/lynis/"><img src="/static/icons/download-cloud.png" height="16" width="16" alt="Download Lynis">download page</a></p><h3>GitHub</h3><p>The Lynis project can be easily cloned via <img src="/static/github.png" alt="GitHub" height="16" width="16" class="m-r"><a href="https://github.com/CISOfy/Lynis" target="_blank" rel="noopener" title="GitHub project page">GitHub</a></p><h3>Install as package</h3><p>Rather use a package to install? Most distributions already have a package version available. They might be outdated, so we provide the latest software packages via our <a href="https://packages.cisofy.com">software repository</a>.</p></section></div><div class="border border-radius max-width p-8"><section><h2>Background information</h2><ul class="none font14"><li>&raquo; Open Source (<a href="http://www.gnu.org/copyleft/gpl.html" title="GPL license page on GNU website" target="_blank" rel="noopener">GPL</a>)</li><li>&raquo; Free to use</li><li>&raquo; Well-known and mature software</li><li>&raquo; Big community of users</li><li>&raquo; Packages and ports available</li><li>&raquo; Used by individuals, businesses, government departments, and multinationals</li></ul></section></div><div class="background border border-radius max-width p-16 m-t"><section><h2>Upgrade to Lynis Enterprise</h2><p>The Lynis Enterprise Suite uses Lynis as a core component. Lynis can run as a standalone security tool. When used together with the suite, it become a data collection client.</p><h3>Continuous auditing</h3><p>Security is not a one-time event. For companies who want to do continuous auditing, we provide Lynis Enterprise. This security suite provides central management, plugins, reporting, hardening snippets, and more.</p><p>Read more about <a href="/lynis-enterprise/">Lynis Enterprise</a>

1 and discover all benefits.</p></section></div></div></div></article><br></main><footer><div><h3 style="border-bottom:1px solid #FF3D00;">Solutions</h3><strong class="font-small">Software</strong><ul class="none"><li><a href="/lynis/">Lynis</a><ul><li><a href="/downloads/">Downloads</a></li><li><a href="/documentation/lynis/">Documentation</a></li></ul></li><li><a href="/lynis-enterprise/">Lynis Enterprise</a><ul><li><a href="/lynis-enterprise/features/">Features</a></li><li><a href="/demo/">Demo</a></li></ul></li></ul><strong class="font-small">Topics</strong><ul class="none"><li><a href="/compliance/">Compliance</a></li></ul></div><div><h3 style="border-bottom:1px solid #FF3D00;">Community</h3><ul><li><a href="https://github.com/CISOfy/lynis/">Lynis on GitHub</a></li><li><a href="https://packages.cisofy.com">Software packages</a></li><li><a href="https://linux-audit.com/">Security audit blog</a></li></ul><strong class="font-small">Documentation and Questions</strong><ul><li><a href="/support/">Support</a></li><li><a href="/faq/">Frequently Asked Questions</a></li></ul></div><div><h3 style="border-bottom:1px solid #FF3D00;">About CISOfy</h3><ul><li><a href="/about/">About Us</a></li><li><a href="/contact/">Contact</a></li><li><a href="/legal/">Legal</a></li><li><a href="/privacy/">Privacy</a></li><li><a href="/security/">Security</a></li><li><a href="/sitemap/">Sitemap</a></li></ul><strong class="font-small">Our privacy promises</strong><ul><li>No tracking code on our website</li><li>Limited external scripts</li><li>Reduced data collection</li></ul></div></footer>

1<script type="application/ld+json">{"@context":"http://schema.org","@type":"SoftwareApplication","applicationCategory":"http://schema.org/SecurityApplication","author":{"@type":"Organization","name":"CISOfy","url":"https://cisofy.com/"},"description":"Security auditing tool for Linux, macOS, and other Unix-based systems.","name":"Lynis","operatingSystem":["AIX","FreeBSD","Linux","macOS","NetBSD","OpenBSD","Solaris"],"offers":{"@type":"Offer","availability":"http://schema.org/InStock","price":"0","priceCurrency":"USD"},"url":"https://cisofy.com/lynis/","sameAs":["https://github.com/CISOfy/lynis","https://www.wikidata.org/wiki/Q6708869"]}</script>

1<script type="application/ld+json">{"@context":"http://schema.org","@type":"WebPage","url":"https://cisofy.com/lynis/","speakable":{"@type":"SpeakableSpecification","cssSelector":".sp"}}</script>

1<script type="application/ld+json">{"@context":"http://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"item":{"@id":"https://cisofy.com/","name":"CISOfy"}},{"@type":"ListItem","position":2,"item":{"@id":"https://cisofy.com/lynis/","name":"Lynis"}}]}</script>

1</body></html>