Lynis

Why this tool?

Lynis can detect vulnerabilities and configuration flaws. Where a typical vulnerability scanner will just point out vulnerabilities, Lynis aims for an in-depth audit and continuous improvement. For this reason, it needs to be executed on the host system itself. By seeing the system from the inside out, it can provide more specific details than the average vulnerability scanner.

How it works

Lynis starts with an initialization phase in where it detects the operating system. After that part is finished, the discovery of binaries and tools is done. This collecting of tools is the base for the scanning engine, that performs hundreds of individual tests. Every system will have a different set of performed tests. After completing the scan, a report with findings and suggestions is displayed.

Background information

The tool is typically used by system administrators, security professionals, and auditors. Occasionally a pentester will also use it during a security assignment to discover vulnerabilities or find possible flaws in the system to exploit.

The tests performed by Lynis are a combination of advice found in hardening guides, tips by Linux distributions and vendors, and other best practices within the field.

Lynis was originally written by Michael to automate security scans of systems he managed for his employer at the time. He devoted his spare time to replace printed hardening guides at his desk with the tool. In 2013, Michael went to full-time development on Lynis and the commercial Lynis Enterprise version.