Lynis alternatives

Looking for an alternative tool to replace Lynis? During the review of Lynis we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. YASAT (local security scanner)
  2. Zeus (AWS auditing and hardening tool)
  3. JShielder (Linux hardening tool)

These tools are ranked as the best alternatives to Lynis.

Alternatives (by score)

70

YASAT

Introduction

The YASAT tool performs a system scan to detect configuration issues and possible improvements for hardening the system. Typically you would use this on new and existing systems.

Project details

YASAT is written in shell script.

Strengths and weaknesses

  • + Used language is shell script
  • - No updates for a while

Typical usage

  • Configuration audit
  • IT audit
  • Security assessment

YASAT review

64

Zeus

Introduction

Zeus is a tool to perform a quick security scan of an AWS environment. It helps to find missing security controls, so additional system hardening measures can be applied to systems.

Project details

Zeus is written in shell script.

Strengths and weaknesses

  • + Used language is shell script
  • + The source code of this software is available
  • - No releases on GitHub available

Typical usage

  • Configuration audit
  • Security assessment
  • Self-assessment
  • System hardening

Zeus review

64

JShielder

Introduction

JShielder is a security tool for Linux systems to make them more secure by adding system hardening measures.

Project details

JShielder is written in Python, shell script.

Strengths and weaknesses

  • + Used language is shell script
  • + The source code of this software is available

    Typical usage

    • System hardening

    JShielder review

    52

    Nix Auditor

    Introduction

    This fairly new tool is written in shell script to scan Linux systems with the focus on security auditing.

    Project details

    Nix Auditor is written in shell script.

    Strengths and weaknesses

    • + Used language is shell script
    • - Full name of author is unknown
    • - Unknown project license

    Nix Auditor review

    68

    Prowler

    Introduction

    Prowler is a security tool to check systems on AWS against the related CIS benchmark. This benchmark provides a set of best practices for AWS. The primary usage for this tool is system hardening and compliance checking.

    Project details

    Prowler is written in shell script.

    Strengths and weaknesses

    • + More than 25 contributors
    • + More than 500 GitHub stars
    • + The source code of this software is available

      Typical usage

      • Compliance testing
      • Security assessment
      • System hardening

      Prowler review

      60

      otseca

      Introduction

      Tools like otseca help with data collection. This could be useful for system administrators to collect data on a regular interval. This data then can be compared with a future data capture. Another possibility is to use it during pentesting. In that case one should have already obtained root access, as the tool requires this as well.

      Project details

      otseca is written in shell script.

      Strengths and weaknesses

      • + The source code is easy to read and understand
      • + Tool is modular and extendable
      • + The source code of this software is available

        Typical usage

        • Configuration audit
        • Penetration testing
        • Security assessment

        otseca review

        64

        LUNAR

        Introduction

        LUNAR is short for Lockdown UNix Auditing and Reporting and runs on the system itself.

        Project details

        LUNAR is written in shell script.

        Strengths and weaknesses

        • + The source code of this software is available

          Typical usage

          • Security assessment
          • Self-assessment
          • System hardening

          LUNAR review

          60

          orthrus

          Introduction

          Orthrus is a security framework and auditing tool. It allows monitoring and analyzing security configurations across multiple environments.

          Project details

          orthrus is written in Golang.

          Strengths and weaknesses

          • + The source code of this software is available
          • - Project is in early phase and may be unstable

          Typical usage

          • Security assessment
          • Self-assessment
          • System hardening
          • Vulnerability scanning

          orthrus review

          68

          Cloud Security Suite (CS Suite)

          Introduction

          Cloud Security Suite (CS Suite) is a security toolkit that allows scanning Amazon, Google, and Azure cloud platforms. It leverages tools like Lynis, Prowler, and Scout2 to collect all information. The promise of the tool is to simplify the installation of the tools, their configuration, and the data collection.

          Project details

          Cloud Security Suite is written in Python.

          Strengths and weaknesses

          • + The source code of this software is available
          • - No releases on GitHub available

          Typical usage

          • Configuration audit
          • IT audit
          • Penetration testing
          • System hardening

          Cloud Security Suite review

          60

          sysechk (System Security Checker)

          Introduction

          System Security Checker, or sysechk, is a tool to perform a system audit against a set of best practices. It uses a modular approach to test the system.

          Project details

          sysechk is written in shell script.

          Strengths and weaknesses

          • + Used language is shell script
          • + The source code of this software is available

            Typical usage

            • IT audit
            • System hardening

            sysechk review

            88

            OpenSCAP

            Introduction

            The OpenSCAP project provides a wide variety of hardening guides, configuration baselines, and tools to test for vulnerabilities and configuration issues. It uses SCAP as the protocol to store the underlying data.

            Project details

            OpenSCAP is written in C.

            Strengths and weaknesses

            • + More than 25 contributors
            • + The source code of this software is available
            • + Supported by a large company

              Typical usage

              • Security assessment
              • Vulnerability scanning

              OpenSCAP review

              60

              SSHsec

              Introduction

              SSHsec scans a system running the SSH protocol and retrieves its configuration, host keys, and Diffie-Hellman groups.

              Project details

              SSHsec is written in Python.

              Strengths and weaknesses

              • + The source code of this software is available

                Typical usage

                • Information gathering
                • Penetration testing
                • Security assessment

                SSHsec review

                100

                Anchore

                Introduction

                Anchore is a tool to help with discovering, analyzing and certifying container images. These images can be stored both on-premises or in the cloud. The tooling is mainly focused on developer so that perform analysis on their container images. Typical actions include running queries, creating reports, or set up policies for a continuous integration and deployment pipeline.

                Project details

                Anchore is written in Python.

                Strengths and weaknesses

                • + More than 10 contributors
                • + Commercial support available
                • + The source code of this software is available

                  Typical usage

                  • System hardening

                  Anchore review

                  85

                  ssh_scan

                  Introduction

                  This tool is light on its dependencies, as it only uses Ruby and BinData. The scanner is simple to use, as it is limited in the number of parameters and options. There is also the ability to show the results on the screen or export the data to a JSON file. The latter is great if you want to do further processing of the details, or simply store them for later comparison.

                  Project details

                  ssh_scan is written in Ruby.

                  Strengths and weaknesses

                  • + More than 10 contributors
                  • + Many releases available
                  • + The source code of this software is available
                  • + Supported by a large company

                    Typical usage

                    • Penetration testing
                    • Security assessment
                    • System hardening
                    • Vulnerability scanning

                    ssh_scan review

                    85

                    GGRC (Google Governance, Risk and Compliance)

                    Introduction

                    The GGRC project has the goal to provide a solution to manage the challenges that come with complying with regulations. It provides a system to record information and capture the relationships between all the pieces.

                    Project details

                    GGRC is written in Python.

                    Strengths and weaknesses

                    • + More than 50 contributors
                    • + Many releases available
                    • + The source code of this software is available
                    • + Supported by a large company

                      Typical usage

                      • Compliance testing

                      GGRC review

                      96

                      testssl.sh

                      Introduction

                      Key features of testssl.sh include:

                      • Clear output: you can tell easily whether anything is good or bad
                      • Ease of installation: It works for Linux, Darwin, FreeBSD, NetBSD and MSYS2/Cygwin out of the box: no need to install or configure something, no gems, CPAN, pip or the like.
                      • Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not only webservers at port 443
                      • Toolbox: Several command line options help you to run YOUR test and configure YOUR output
                      • Reliability: features are tested thoroughly
                      • Verbosity: If a particular check cannot be performed because of a missing capability on your client side, you'll get a warning
                      • Privacy: It's only you who sees the result, not a third party
                      • Freedom: It's 100% open source. You can look at the code, see what's going on and you can change it.

                      Project details

                      testssl.sh is written in shell script.

                      Strengths and weaknesses

                      • + Used language is shell script
                      • + The source code of this software is available

                        Typical usage

                        • Application testing
                        • Configuration audit

                        testssl.sh review

                        60

                        VHostScan

                        Introduction

                        Tools like VHostScan are powerful to perform reconnaissance and discover configuration defaults. This can be useful during penetration tests or security testing, to see if a system has been stripped from default pages. If not, this tool might discover them and provide valuable information about the system.

                        Project details

                        VHostScan is written in Python.

                        Strengths and weaknesses

                        • + The source code of this software is available

                          Typical usage

                          • Penetration testing
                          • Reconnaissance

                          VHostScan review

                          60

                          arch-audit

                          Introduction

                          Arch-audit is a small utility that scans the system for known vulnerabilities on Arch Linux. It can be used by users of the Linux distribution to know when to update and what packages have weaknesses. With Arch Linux being a rolling distribution, this may improve the interval or timing of software patching.

                          Project details

                          arch-audit is written in Rust.

                          Strengths and weaknesses

                          • + The source code of this software is available

                            Typical usage

                            • Software management
                            • Vulnerability scanning

                            arch-audit review

                            100

                            Archery

                            Introduction

                            Archery is a tool that helps to collect data about vulnerabilities within an environment. Instead of focusing on the actual scanning, it allows managing findings in a web-based interface. This includes options like reporting, searching, and dashboards. It can interact with other tools, including the well-known vulnerability scanners.

                            Project details

                            Archery is written in Python.

                            Strengths and weaknesses

                            • + More than 500 GitHub stars
                            • + The source code of this software is available

                              Typical usage

                              • Penetration testing
                              • Vulnerability management
                              • Vulnerability scanning
                              • Vulnerability testing

                              Archery review

                              78

                              CloudSploit scans

                              Introduction

                              CloudSploit scans is an open source software project to test security risks related to an AWS account. It runs tests against your Amazon account and aims to discover any potential misconfigured setting or other risks.

                              Project details

                              CloudSploit scans is written in Node.js.

                              Strengths and weaknesses

                              • + More than 10 contributors
                              • + More than 500 GitHub stars
                              • + The source code of this software is available
                              • - No releases on GitHub available

                              Typical usage

                              • Configuration audit
                              • IT audit
                              • Security assessment

                              CloudSploit scans review

                              60

                              iniscan

                              Introduction

                              Iniscan scans a given php.ini file and tests it against security best practices. It reports back the results by showing a Pass or Fail for each related test. As it is a command-line utility, it can be used in automated testing.

                              Project details

                              iniscan is written in PHP.

                              Strengths and weaknesses

                              • + More than 25 contributors
                              • + More than 1000 GitHub stars
                              • + The source code of this software is available

                                Typical usage

                                • Configuration audit
                                • Security assessment

                                iniscan review

                                85

                                Kube-Bench

                                Introduction

                                Tools like Kube-Bench help with quickly checking configuration weaknesses or discovering bad defaults.

                                Project details

                                Kube-Bench is written in Golang.

                                Strengths and weaknesses

                                • + The source code of this software is available

                                  Kube-Bench review

                                  60

                                  ssh-audit

                                  Introduction

                                  The ssh-audit tool is of great help when scanning SSH servers to discover possible improvements. It is written in Python and with a simple 'git clone' it can already be started. You typically would use a tool like this to improve your own SSH configurations or as part of a security assignment.

                                  Project details

                                  ssh-audit is written in Python.

                                  Strengths and weaknesses

                                  • + The source code is easy to read and understand
                                  • + Tool is easy to use
                                  • + More than 2000 GitHub stars
                                  • + Very low number of dependencies
                                  • + The source code of this software is available

                                    Typical usage

                                    • Application security
                                    • Penetration testing
                                    • Security assessment

                                    ssh-audit review

                                    60

                                    Bash Scanner

                                    Introduction

                                    Bash Scanner is a security tool that does a quick scan to see if there are vulnerable packages. It uses an external service to validate.

                                    Project details

                                    Bash Scanner is written in shell script.

                                    Strengths and weaknesses

                                    • + Used language is shell script
                                    • + The source code of this software is available

                                      Typical usage

                                      • Security assessment
                                      • Security monitoring

                                      Bash Scanner review

                                      84

                                      BDA (Big Data Audit)

                                      Introduction

                                      BDA is a vulnerability scanner for big data tools like Hadoop and Spark. It searches for configuration weaknesses and reports them. Hadoop and Spark are one of the few applications that encounter a lot of data. So by securing these applications, a big leap can be made as it covers a lot of data.

                                      Project details

                                      BDA is written in Python.

                                      Strengths and weaknesses

                                      • + The source code of this software is available

                                        Typical usage

                                        • Application testing
                                        • Vulnerability scanning
                                        • Vulnerability testing

                                        BDA review

                                        Some relevant tool missing as an alternative to Lynis? Please contact us with your suggestion.