Lynis Security Auditing Tool

Lynis is a free and open-source security auditing tool for Unix and Linux systems, performing comprehensive security scans to evaluate system hardening, compliance, and vulnerability posture. Created by Michael Boelen and Patrick Hulshof (CISOfy, headquartered in the Netherlands) in 2007, Lynis is designed for blue teams, security auditors, system administrators, and penetration testers who need a quick and thorough security assessment without installation of agents or complex configuration. Key features: agentless scanning: Lynis is a single shell script that runs directly on the target system without requiring any installation or agent deployment. It audits the running system in-place by analyzing configuration files, running services, and system state. Scan categories: system binaries (checking for malicious modifications), boot loader configuration, kernel and module security, memory and process analysis, user accounts and authentication (password policy, sudo configuration, SSH keys), file permissions and ownership, shell history, cron jobs, networking (firewall, network interfaces, DNS), nameservers, ports and package management, logging and log rotation, time synchronization (NTP), cryptography (certificates, SSH), file systems (mount options, disk encryption), virtualization and container checks, web server configuration (Apache, Nginx), database configuration (MySQL, PostgreSQL), NFS, DNS server, PHP, Squid, LDAP. Compliance checking: built-in profiles for ISO 27001, PCI DSS, HIPAA, SOX, and CIS Controls, mapping scan results to compliance frameworks. Hardening index: calculates a hardening score (0-100) based on test results. Warning: potential security issue. Suggestion: recommended hardening action. Detailed logging to /var/log/lynis.log and report generation. Enterprise version adds central management and dashboards. Cross-platform: Linux, macOS, BSD, Solaris, AIX. GPL-3.0.