While configuring firewalls, managing SSH keys, and installing intrusion detection systems are critical steps in hardening your server, security is an ongoing process rather than a one-time setup. To ensure your defenses remain robust over time, you need a way to objectively score your server's security posture and identify potential misconfigurations that may have slipped through the cracks.

Lynis is an industry-standard, open-source security auditing tool tailored for Linux systems. Unlike antivirus scanners or rootkit detectors (which look for active malware), Lynis evaluates your system's underlying configuration. It checks for weak cryptography, outdated packages, improper file permissions, and missing firewall rules, providing you with a customized hardening index and actionable advice.

Installing Lynis from the Official Repository

While many Linux distributions include Lynis in their default repositories, these versions are often severely outdated. Security auditing tools rely on the latest tests to detect modern misconfigurations. It is highly recommended to install Lynis directly from the CISofy (the developers behind Lynis) software repository.

• Connect to your server via SSH as a user with sudo privileges.

• Import the repository's cryptographic signing key to ensure the software is authentic: wget -O - [https://packages.cisofy.com/keys/cisofy-software-public.key](https://packages.cisofy.com/keys/cisofy-software-public.key) | sudo apt-key add -

• Add the official repository to your system's package sources: echo "deb [https://packages.cisofy.com/community/lynis/deb/](https://packages.cisofy.com/community/lynis/deb/) stable main" | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list

• Update your local package lists to recognize the new repository: sudo apt update.

• Install the latest version of the auditing tool: sudo apt install lynis.

Running a Full System Audit

Because Lynis inspects deep system configurations, kernel parameters, and daemon settings, it must be run with administrative privileges to yield accurate results.

• Initiate a comprehensive scan of your entire VPS by executing: sudo lynis audit system.

• The tool will begin outputting its progress in the terminal. It groups its tests into categories, such as Boot and Services, Kernel, Memory and Processes, and SSH Support.

• Next to each test, you will see a color-coded result: [ OK ] (green) means the configuration is secure, [ WARNING ] (red) indicates a severe vulnerability that needs immediate attention, and [ SUGGESTION ] (yellow) highlights an area for potential improvement.

Understanding the Hardening Index

At the very end of the terminal output, Lynis provides a summary of the scan. The most important metric here is the Hardening Index, a score out of 100 that reflects your server's overall defensive posture.

Do not be alarmed if your initial score is lower than expected (often between 60 and 70 for a standard VPS). Achieving a perfect 100 is rarely practical for a production web server, as it often requires locking down the system so tightly that standard applications cannot function. Your goal should be to steadily increase this score over time by addressing the specific warnings and suggestions.

Reviewing Actionable Advice

Lynis does not automatically change any settings on your server—it strictly reports its findings. It is up to you to implement the fixes.

• Scroll up in your terminal to view the generated list of Warnings and Suggestions, or view the detailed report file by running sudo cat /var/log/lynis-report.dat.

• Each suggestion includes a specific control identifier (e.g., SSH-7408).

• You can request detailed information on exactly how to fix a specific issue by using the show details command followed by the control ID. For example: sudo lynis show details SSH-7408.

• Address the critical warnings first, re-run the audit (sudo lynis audit system), and watch your Hardening Index improve as you manually apply the recommended configurations.