lynis(8)
Lynis is a security and configuration auditing tool for Linux/Unix systems that scans for vulnerabilities, misconfigurations, and compliance issues.
Synopsis
lynis [OPTION]... [COMMAND]Description
Lynis performs automated security audits and hardening checks on Linux and Unix systems. It examines system configuration, installed software, security settings, and known vulnerabilities, then provides detailed reports and recommendations for improving system security and compliance.
The tool can run in interactive mode with a menu-driven interface or via command-line for automation and scripting. Results are displayed on-screen and can be saved to log files for compliance documentation and trend analysis.
Common options
| Flag | What it does |
|---|---|
audit system | Perform a full security audit of the system |
-q, --quick | Run audit in quick mode with fewer checks |
-c, --config FILE | Use alternate configuration file instead of default |
-p, --plugins-only | Run only plugin tests, skip the core tests |
-l, --logfile FILE | Write results to specified log file |
--pentest | Enable pentesting mode for non-intrusive external testing |
--quiet | Run in quiet mode with minimal screen output |
--upload | Upload results to central server (requires configuration) |
-v, --verbose | Show more detailed output during the audit |
--view-categories | Display all available audit categories |
Examples
Run a complete security audit and display results interactively
lynis audit systemRun audit silently and save detailed results to a log file for compliance review
lynis audit system --quiet --logfile /var/log/lynis-report.logPerform a quick audit with fewer checks, useful for faster scans
lynis audit system -qRun audit in pentesting mode suitable for external security assessments
lynis audit system --pentestRun audit using a custom configuration file with tailored settings
lynis -c /etc/lynis/custom.conf audit systemDisplay all available audit categories to understand what is checked
lynis show categoriesRun as root and save output to a timestamped log file for archiving
sudo lynis audit system 2>&1 | tee audit-$(date +%Y%m%d).logCheck for and display information about available Lynis updates
lynis update info