Lynis alternatives

Looking for an alternative tool to replace Lynis? During the review of Lynis we looked at other open source tools. Based on their category, tags, and text, these are the ones that have the best match.

Top 3

  1. YASAT (local security scanner)
  2. OpenSCAP (suite with tools and security data)
  3. Zeus (AWS auditing and hardening tool)

These tools are ranked as the best alternatives to Lynis.

Alternatives (by score)

70

YASAT

Introduction

The YASAT tool performs a system scan to detect configuration issues and possible improvements for hardening the system. Typically you would use this on new and existing systems.

Project details

YASAT is written in shell script.

Strengths and weaknesses

  • + Used language is shell script
  • - No updates for a while

Typical usage

  • IT audit
  • Configuration audit
  • Security assessment

YASAT review

88

OpenSCAP

Introduction

The OpenSCAP project provides a wide variety of hardening guides, configuration baselines, and tools to test for vulnerabilities and configuration issues. It uses SCAP as the protocol to store the underlying data.

Project details

OpenSCAP is written in C.

Strengths and weaknesses

  • + More than 25 contributors
  • + The source code of this software is available
  • + Supported by a large company

    Typical usage

    • Security assessment
    • Vulnerability scanning

    OpenSCAP review

    64

    Zeus

    Introduction

    Zeus is a tool to perform a quick security scan of an AWS environment. It helps to find missing security controls, so additional system hardening measures can be applied to systems.

    Project details

    Zeus is written in shell script.

    Strengths and weaknesses

    • + Used language is shell script
    • + The source code of this software is available
    • - No releases on GitHub available

    Typical usage

    • Configuration audit
    • Security assessment
    • Self-assessment
    • System hardening

    Zeus review

    64

    JShielder

    Introduction

    JShielder is a security tool for Linux systems to make them more secure by adding system hardening measures.

    Project details

    JShielder is written in Python, shell script.

    Strengths and weaknesses

    • + Used language is shell script
    • + The source code of this software is available

      Typical usage

      • System hardening

      JShielder review

      52

      Nix Auditor

      Introduction

      This fairly new tool is written in shell script to scan Linux systems with the focus on security auditing.

      Project details

      Nix Auditor is written in shell script.

      Strengths and weaknesses

      • + Used language is shell script
      • - Full name of author is unknown
      • - Unknown project license

      Nix Auditor review

      85

      Prowler

      Introduction

      Prowler is a security tool to check systems on AWS against the related CIS benchmark. This benchmark provides a set of best practices for AWS. The primary usage for this tool is system hardening and compliance checking.

      Project details

      Prowler is written in shell script.

      Strengths and weaknesses

      • + More than 25 contributors
      • + More than 500 GitHub stars
      • + The source code of this software is available

        Typical usage

        • Compliance testing
        • Security assessment
        • System hardening

        Prowler review

        60

        otseca

        Introduction

        Tools like otseca help with data collection. This could be useful for system administrators to collect data on a regular interval. This data then can be compared with a future data capture. Another possibility is to use it during pentesting. In that case one should have already obtained root access, as the tool requires this as well.

        Project details

        otseca is written in shell script.

        Strengths and weaknesses

        • + The source code is easy to read and understand
        • + Tool is modular and extendable
        • + The source code of this software is available

          Typical usage

          • Configuration audit
          • Penetration testing
          • Security assessment

          otseca review

          60

          orthrus

          Introduction

          Orthrus is a security framework and auditing tool. It allows monitoring and analyzing security configurations across multiple environments.

          Project details

          orthrus is written in Golang.

          Strengths and weaknesses

          • + The source code of this software is available
          • - Project is in early phase and may be unstable

          Typical usage

          • Security assessment
          • Self-assessment
          • System hardening
          • Vulnerability scanning

          orthrus review

          64

          LUNAR

          Introduction

          LUNAR is short for Lockdown UNix Auditing and Reporting and runs on the system itself.

          Project details

          LUNAR is written in shell script.

          Strengths and weaknesses

          • + The source code of this software is available

            Typical usage

            • Security assessment
            • Self-assessment
            • System hardening

            LUNAR review

            68

            Cloud Security Suite (CS Suite)

            Introduction

            Cloud Security Suite (CS Suite) is a security toolkit that allows scanning Amazon, Google, and Azure cloud platforms. It leverages tools like Lynis, Prowler, and Scout2 to collect all information. The promise of the tool is to simplify the installation of the tools, their configuration, and the data collection.

            Project details

            Cloud Security Suite is written in Python.

            Strengths and weaknesses

            • + The source code of this software is available
            • - No releases on GitHub available

            Typical usage

            • IT audit
            • Configuration audit
            • Penetration testing
            • System hardening

            Cloud Security Suite review

            60

            sysechk (System Security Checker)

            Introduction

            System Security Checker, or sysechk, is a tool to perform a system audit against a set of best practices. It uses a modular approach to test the system.

            Project details

            sysechk is written in shell script.

            Strengths and weaknesses

            • + Used language is shell script
            • + The source code of this software is available

              Typical usage

              • IT audit
              • System hardening

              sysechk review

              60

              SSHsec

              Introduction

              SSHsec scans a system running the SSH protocol and retrieves its configuration, host keys, and Diffie-Hellman groups.

              Project details

              SSHsec is written in Python.

              Strengths and weaknesses

              • + The source code of this software is available

                Typical usage

                • Information gathering
                • Penetration testing
                • Security assessment

                SSHsec review

                60

                ssh_scan

                Introduction

                This tool is light on its dependencies, as it only uses Ruby and BinData. The scanner is simple to use, as it is limited in the number of parameters and options. There is also the ability to show the results on the screen or export the data to a JSON file. The latter is great if you want to do further processing of the details, or simply store them for later comparison.

                Project details

                ssh_scan is written in Ruby.

                Strengths and weaknesses

                • + More than 10 contributors
                • + Many releases available
                • + The source code of this software is available
                • + Supported by a large company

                  Typical usage

                  • Penetration testing
                  • Security assessment
                  • System hardening
                  • Vulnerability scanning

                  ssh_scan review

                  64

                  Anchore Engine

                  Introduction

                  Anchore is a tool to help with discovering, analyzing and certifying container images. These images can be stored both on-premises or in the cloud. The tooling is mainly focused on developer so that perform analysis on their container images. Typical actions include running queries, creating reports, or set up policies for a continuous integration and deployment pipeline.

                  Project details

                  Anchore Engine is written in Python.

                  Strengths and weaknesses

                  • + More than 10 contributors
                  • + Commercial support available
                  • + More than 1000 GitHub stars
                  • + The source code of this software is available

                    Typical usage

                    • System hardening

                    Anchore Engine review

                    60

                    Dagda

                    Introduction

                    The main reasons to use Dagda is the detection of vulnerable or malicious components within your containerized environment.

                    Project details

                    Dagda is written in Python.

                    Strengths and weaknesses

                    • + The source code of this software is available

                      Typical usage

                      • Malware detection
                      • Malware scanning
                      • Vulnerability management
                      • Vulnerability scanning

                      Dagda review

                      60

                      GGRC (Google Governance, Risk and Compliance)

                      Introduction

                      The GGRC project has the goal to provide a solution to manage the challenges that come with complying with regulations. It provides a system to record information and capture the relationships between all the pieces.

                      Project details

                      GGRC is written in Python.

                      Strengths and weaknesses

                      • + More than 50 contributors
                      • + Many releases available
                      • + The source code of this software is available
                      • + Supported by a large company

                        Typical usage

                        • Compliance testing

                        GGRC review

                        60

                        VHostScan

                        Introduction

                        Tools like VHostScan are powerful to perform reconnaissance and discover configuration defaults. This can be useful during penetration tests or security testing, to see if a system has been stripped from default pages. If not, this tool might discover them and provide valuable information about the system.

                        Project details

                        VHostScan is written in Python.

                        Strengths and weaknesses

                        • + The source code of this software is available

                          Typical usage

                          • Penetration testing
                          • Reconnaissance

                          VHostScan review

                          74

                          testssl.sh

                          Introduction

                          Key features of testssl.sh include:

                          • Clear output: you can tell easily whether anything is good or bad
                          • Ease of installation: It works for Linux, Darwin, FreeBSD, NetBSD and MSYS2/Cygwin out of the box: no need to install or configure something, no gems, CPAN, pip or the like.
                          • Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not only webservers at port 443
                          • Toolbox: Several command line options help you to run YOUR test and configure YOUR output
                          • Reliability: features are tested thoroughly
                          • Verbosity: If a particular check cannot be performed because of a missing capability on your client side, you'll get a warning
                          • Privacy: It's only you who sees the result, not a third party
                          • Freedom: It's 100% open source. You can look at the code, see what's going on and you can change it.

                          Project details

                          testssl.sh is written in shell script.

                          Strengths and weaknesses

                          • + Used language is shell script
                          • + The source code of this software is available

                            Typical usage

                            • Application testing
                            • Configuration audit

                            testssl.sh review

                            100

                            Archery

                            Introduction

                            Archery is a tool that helps to collect data about vulnerabilities within an environment. Instead of focusing on the actual scanning, it allows managing findings in a web-based interface. This includes options like reporting, searching, and dashboards. It can interact with other tools, including the well-known vulnerability scanners.

                            Project details

                            Archery is written in Python.

                            Strengths and weaknesses

                            • + More than 500 GitHub stars
                            • + The source code of this software is available

                              Typical usage

                              • Penetration testing
                              • Vulnerability management
                              • Vulnerability scanning
                              • Vulnerability testing

                              Archery review

                              60

                              ssh-audit

                              Introduction

                              The ssh-audit tool is of great help when scanning SSH servers to discover possible improvements. It is written in Python and with a simple 'git clone' it can already be started. You typically would use a tool like this to improve your own SSH configurations or as part of a security assignment.

                              Project details

                              ssh-audit is written in Python.

                              Strengths and weaknesses

                              • + The source code is easy to read and understand
                              • + Tool is easy to use
                              • + More than 2000 GitHub stars
                              • + Very low number of dependencies
                              • + The source code of this software is available

                                Typical usage

                                • Application security
                                • Penetration testing
                                • Security assessment

                                ssh-audit review

                                97

                                CloudSploit scans

                                Introduction

                                CloudSploit scans is an open source software project to test security risks related to an AWS account. It runs tests against your Amazon account and aims to discover any potential misconfigured setting or other risks.

                                Project details

                                CloudSploit scans is written in Node.js.

                                Strengths and weaknesses

                                • + More than 10 contributors
                                • + More than 500 GitHub stars
                                • + The source code of this software is available
                                • - No releases on GitHub available

                                Typical usage

                                • IT audit
                                • Configuration audit
                                • Security assessment

                                CloudSploit scans review

                                85

                                Kube-Bench

                                Introduction

                                Tools like Kube-Bench help with quickly checking configuration weaknesses or discovering bad defaults.

                                Project details

                                Kube-Bench is written in Golang.

                                Strengths and weaknesses

                                • + The source code of this software is available

                                  Kube-Bench review

                                  60

                                  iniscan

                                  Introduction

                                  Iniscan scans a given php.ini file and tests it against security best practices. It reports back the results by showing a Pass or Fail for each related test. As it is a command-line utility, it can be used in automated testing.

                                  Project details

                                  iniscan is written in PHP.

                                  Strengths and weaknesses

                                  • + More than 25 contributors
                                  • + More than 1000 GitHub stars
                                  • + The source code of this software is available

                                    Typical usage

                                    • Configuration audit
                                    • Security assessment

                                    iniscan review

                                    60

                                    BDA (Big Data Audit)

                                    Introduction

                                    BDA is a vulnerability scanner for big data tools like Hadoop and Spark. It searches for configuration weaknesses and reports them. Hadoop and Spark are one of the few applications that encounter a lot of data. So by securing these applications, a big leap can be made as it covers a lot of data.

                                    Project details

                                    BDA is written in Python.

                                    Strengths and weaknesses

                                    • + The source code of this software is available

                                      Typical usage

                                      • Application testing
                                      • Vulnerability scanning
                                      • Vulnerability testing

                                      BDA review

                                      60

                                      Bash Scanner

                                      Introduction

                                      Bash Scanner is a security tool that does a quick scan to see if there are vulnerable packages. It uses an external service to validate.

                                      Project details

                                      Bash Scanner is written in shell script.

                                      Strengths and weaknesses

                                      • + Used language is shell script
                                      • + The source code of this software is available

                                        Typical usage

                                        • Security assessment
                                        • Security monitoring

                                        Bash Scanner review

                                        Some relevant tool missing as an alternative to Lynis? Please contact us with your suggestion.