Lynis is an open source security auditing tool. Used by system administrators, security professionals, and auditors, to evaluate the security defenses of their Linux and UNIX-based systems. It runs on the host itself, so it performs more extensive security scans than vulnerability scanners. It is also the client in our Lynis Enterprise offering.
Supported operating systems
Lynis runs on almost all UNIX-based systems and versions, including:
- AIX
- FreeBSD
- HP-UX
- Linux
- MacOS
- NetBSD
- OpenBSD
- Solaris
- and others
It even runs on systems like the Raspberry Pi or QNAP storage devices.
Installation optional
Lynis is light-weight and easy to use. Installation is optional: just copy it to a system, and use “./lynis audit system” to start the security scan. It is written in shell script and released as open source software (GPL). Software packages are available from our software repository.
How it works
performs hundreds of individual tests. Each helps to determine the security state of the system. This is what happens during a scan with Lynis:
Steps
- Determine the operating system
- Search for available tools and utilities
- Check for Lynis update
- Run tests with enabled plugins
- Run security tests per category
- Report the status of security scan
Besides the data displayed on the screen, all technical details about the scan are stored in a log file. Any findings (warnings, suggestions, data collection) are stored in a report file.
Changelog
Lynis 2.7.4 (2019-04-21)
Added
- FILE-6324 – Discover XFS mount points
- INSE-8000 – Installed inetd package
- INSE-8100 – Installed xinetd package
- INSE-8102 – Status of xinet daemon
- INSE-8104 – xinetd configuration file
- INSE-8106 – xinetd configuration for inactive daemon
- INSE-8200 – Usage of TCP wrappers
- INSE-8300 – Presence of rsh client
- INSE-8302 – Presence of rsh server
- Detect equery binary detection
- New ‘generate’ command
Changed
- AUTH-9278 – Test LDAP in all PAM components on Red Hat and other systems
- PKGS-7410 – Add support for DPKG-based systems to gather installed kernel packages
- PKGS-7420 – Detect toolkit to automatically download and apply upgrades
- PKGS-7328 – Added global Zypper option –non-interactive
- PKGS-7330 – Added global Zypper option –non-interactive
- PKGS-7386 – Only show warning when vulnerable packages were discovered
- PKGS-7392 – Skip test for Zypper-based systems
- Minor changes to improve text output, test descriptions, and logging
- Changed CentOS identifiers in end-of-life database
- AIX enhancement for IsRunning function
- Extended PackageIsInstalled function
- Improve text output on AIX systems
- Corrected lsvg binary detection
Download
Copyright (C) 2014
