lynis, one command to score your linux hardening

hardening is a vibe until you measure it

most people "harden" a linux box by vibes. disable root login, sure. maybe set up a firewall rule, feel good about it, walk away. the problem is you have no idea what you missed, because nobody hands you a checklist when you spin up a server. that's the gap lynis fills. it's a free open source auditing tool that runs hundreds of checks against your system and spits out one number, the hardening index, plus a ranked list of exactly what to fix. no guessing, no vibes.

the one command

lynis audit system

that's it. run it as root (or with sudo) on the box you want to check, and it starts working through categories: boot process, kernel config, users and groups, file permissions, ssh config, firewall, logging, malware scanners, cron jobs, package management, you name it. it takes a few minutes depending on the system. at the end you get a summary with your hardening index score, usually out of 100, and a big list of "suggestions" and "warnings" tied to specific test ids.

lynis isn't guessing based on vague best practices either. it's actually inspecting your live config, your installed packages, your running services, and comparing that against known hardening baselines like cis benchmarks. it's read only by default, it doesn't change anything on your system, it just tells you what it found.

what it actually flags

the output reads like a "things a real attacker would love" list, which is the point. common findings on unhardened boxes:

root login allowed over ssh. if root can log in directly over ssh, one leaked password or weak key is game over. lynis flags this immediately and it's usually the first thing to fix.

a compiler sitting on a production server. gcc or similar on a box that's supposed to just run an app is a red flag. if someone gets a foothold, a compiler makes it way easier for them to build tools on the box instead of having to bring their own.

no audit daemon running. without auditd or similar, you have no record of who did what on the system. if something goes wrong, you're debugging blind. lynis calls this out because logging gaps are invisible until you desperately need the logs and they don't exist.

it also checks things like password aging policies, whether unused services are still listening, world writable files, weak file permissions on sensitive configs, missing security updates, and whether your firewall rules actually match what you think they do.

digging into a specific finding

lynis show details TEST-5122

every warning and suggestion in the report comes with a test id like this one. instead of just trusting the summary, you can pull up the full detail for that specific check, see exactly what it looked at, why it flagged it, and what the fix looks like. this matters because not every finding applies to your setup the same way. a suggestion about disabling ipv6 might be irrelevant if you actually use ipv6. reading the details before blindly applying a fix keeps you from breaking something that was intentional.

fix, rerun, repeat

the workflow is simple. run the audit, sort the findings by severity, knock out the top five, run lynis audit system again, and watch your hardening index go up. it turns hardening into an iterative loop instead of a one time project you do once and forget about. you can also schedule it to run periodically, maybe weekly via cron, so config drift or a new insecure service someone installed doesn't sit unnoticed for months.

the takeaway

you can't fix what you haven't measured, and hardening by memory or by "best practices i read once" always leaves gaps. lynis gives you a real, current, test by test picture of your own system's exposure, with a score you can watch improve over time. run lynis audit system on every box you're responsible for, whether it's a homelab server, a self hosted app, or something in prod. read the details on anything flagged, fix what applies to your setup, and rerun it regularly. hardening isn't a checkbox you tick once, it's a number you keep pushing up.