Security Auditing: The Lynis Inspector

In this module, we've locked down SSH, mastered sudo, and explored the secrets of the shadow file. But how do you know if you missed something? Is your Kernel up to date? Are there world-writable directories you didn't notice? Are your system banners missing?

You don't have to check 1,000 files by hand. You use Lynis.

Lynis is an open-source security auditing tool. It doesn't "Automate" the fix (which could break your server), but it performs a deep, 300-point inspection and gives you a "Security Index" score, followed by a list of specific "Suggestions" on how to improve.

1. Why Audit?

Compliance: Many industries (like Finance or Health) require regular proof that your servers are secure.
Drift Detection: You might have set up the server perfectly, but a new junior admin might have accidentally changed a permission last month.
Peace of Mind: Knowing that a professional-grade tool has checked your "Blind Spots."

2. Practical: Running your First Audit

Setting up Lynis is easy—it doesn't even need to be "Installed" to run; it can run from a folder.

# Run a full system audit
sudo lynis audit system

What Lynis Checks:

Boot & Services: Is the boot loader password-protected?
Users & Groups: Are there any accounts with UID 0 other than root?
Filesystems: Are partitions mounted with security flags (nodev, nosuid)?
Networking: Is the firewall active? Are there listening ports you don't recognize?
Cryptography: Are your SSL certificates expired?

3. The Result: The Security Index

At the end of the scan, you'll see a score out of 100.

< 50: Your server is a target. Major architectural holes exist.
50 - 75: Standard secure setup. Minor hardening needed.
> 80: Professional grade. The server is well-defended.

4. Remediation: Following the Map

The most important part of the Lynis output is the "Suggestions" section.

[!] Suggestion: Install a malware scanner to perform periodic scans [test:MALW-3280]
[!] Suggestion: Consider hardening the SSH configuration [test:SSH-7408]

Each suggestion comes with a Test ID. You can search for this ID on the Lynis website to get a step-by-step guide on how to fix that specific problem.

5. Automation: The Cron Auditor

You should run an audit once a week and have the results emailed to you.

# Add to crontab to run a quiet audit every Monday
0 0 * * 1 lynis audit system --quick --cronjob > /var/log/lynis-report.txt

6. Example: An Audit Score Tracker (Python)

If you are managing 100 servers, you want to see if the overall security is improving or getting worse over time. Here is a Python script that parses the lynis-report.dat file and extracts the "Hardening Index."

import os

def check_hardening_index(report_path="/var/log/lynis-report.dat"):
    """
    Parses the machine-readable Lynis report for the security score.
    """
    if not os.path.exists(report_path):
        print("Lynis report not found. Run 'sudo lynis audit system' first.")
        return

    print(f"--- Lynis Security Score Audit ---")
    
    with open(report_path, "r") as f:
        for line in f:
            if line.startswith("hardening_index="):
                score = line.split("=")[1].strip()
                score_int = int(score)
                
                print(f"Current Security Index: {score_int}/100")
                
                if score_int < 60:
                    print("[!!!] ALERT: Security score is below enterprise standards!")
                elif score_int < 80:
                    print("[WA] Warning: Improvements recommended.")
                else:
                    print("[OK] Server is professionally hardened.")

if __name__ == "__main__":
    check_hardening_index()

7. Professional Tip: Use 'lynis show options'

Lynis is highly customizable. You can create a "Profile" that skips specific tests you don't care about (like "Email server tests" on a database server) or adds custom tests for your own applications.

8. Summary

Security is a process, not a one-time product.

Lynis is the inspector that finds the holes you missed.
The Security Index is the metric of your success.
Suggestions and IDs are the roadmap to a harder system.
Regular Auditing prevents "Security Drift" over time.

This concludes Module 14: Linux Security Fundamentals. You now have the skills to build, verify, and maintain a high-security Linux server.

In the next module, we move to the cutting edge of Linux: Advanced Linux Security—SELinux, AppArmor, and Intrusion Detection.

Quiz Questions

Why does Lynis give you a "Suggestion" instead of just fixing the security hole automatically?
What is the benefit of running a Lynis audit in "Cron mode"?
How can you find more information about a specific failure ID like SSH-7408?

End of Module 14. Proceed to Module 15: Advanced Linux Security.

The Inspector: Auditing with Lynis