How to Install and Use Lynis on Ubuntu 24.04 LTS to Perform System Security Auditing and Hardening Scans

Maintaining security compliance and proactive hardening on production Linux infrastructure requires automated vulnerability scanning that extends beyond simple package updates. While package managers notify administrators of outdated binaries, they do not evaluate firewall policies, file permission masks (umask), SSH authentication constraints, or kernel sysctl parameters. Lynis is an established, open-source battle-tested security auditing and compliance engine designed specifically for Linux and Unix-based distributions, including Ubuntu 24.04 LTS.

Understanding Lynis Security Auditing

Unlike network vulnerability scanners like Nessus or OpenVAS that probe open ports remotely from the outside, Lynis executes locally with root privileges. It scans from the inside out, inspecting:

• Boot loader security and password protection (GRUB).
• Kernel parameters, memory protections (ASLR), and core dump restrictions.
• System authentication, PAM configuration, and password aging policies.
• Installed compilers, debugging tools, and vulnerable software packages.
• Systemd service integrity, listening daemon ports, and firewall rules (UFW/iptables).
• File system mount attributes (e.g., nodev, nosuid, noexec on /tmp).

Installing Lynis on Ubuntu 24.04 LTS

While Ubuntu repositories bundle a version of Lynis, configuring the official CISOfy software repository guarantees immediate access to the latest security tests and compliance definitions:

# Import CISOfy repository public GPG key
sudo apt update
sudo apt install -y curl apt-transport-https ca-certificates gnupg
curl -fsSL https://packages.cisofy.com/keys/cisofy-software-public.key | sudo gpg --dearmor -o /etc/apt/trusted.gpg.d/cisofy-software-public.gpg

# Add the official Lynis software repository
echo "deb [arch=amd64,arm64 signed-by=/etc/apt/trusted.gpg.d/cisofy-software-public.gpg] https://packages.cisofy.com/community/lynis/deb/ stable main" | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list

# Update package cache and install Lynis
sudo apt update
sudo apt install -y lynis

Verify that your system detects the current release by checking the installed version:

lynis --version

Running a Full System Security Audit

To perform a complete local security scan of your Ubuntu system, execute Lynis with administrative permissions:

sudo lynis audit system

Lynis steps sequentially through more than 300 automated security tests, displaying colour-coded status indicators (OK, WARNING, SUGGESTION) across your terminal. At the conclusion of the audit, Lynis generates a comprehensive summary comprising:

• Hardening Index: A numerical rating (0 to 100) reflecting the overall security posture and configuration maturity of your operating system.
• Tests Performed: Total number of executed plugin checks.
• Warnings: Critical misconfigurations or security exposures requiring immediate remediation.
• Suggestions: Proactive hardening steps to fortify defences against lateral movement and privilege escalation.

Automating Unattended Audits and Cron Jobs

For headless Ubuntu servers, run Lynis in batch mode to suppress interactive keyboard prompts, outputting results directly to log files:

# Run non-interactively with quiet output
sudo lynis audit system --quick --quiet

Lynis persists two files in your filesystem for post-scan analysis:

• /var/log/lynis.log: Comprehensive diagnostic trace containing verbose test output.
• /var/log/lynis-report.dat: Structured key-value data report suited for ingestion into SIEM dashboards or log forwarders.

Reviewing and Remediating Security Suggestions

To inspect warnings and actionable suggestions without scrolling through thousands of lines of terminal output, query the log file using grep:

# Extract high-priority warnings
sudo grep -E "Warning" /var/log/lynis.log

# Extract hardening suggestions with test IDs
sudo grep -E "Suggestion" /var/log/lynis.log

Every suggestion includes a unique test identifier (such as KRNL-5820 or SSH-7408). Querying CISOfy’s knowledge base reveals the precise remediation command:

# View detailed explanation for an individual test ID
lynis show details SSH-7408

Lynis Command Reference and Audit Flags

Consult the summary table below for essential operational commands:

Command	Operational Purpose	Target Use Case
lynis audit system	Interactive full-system security and compliance audit	Manual administrator review
lynis audit system --quick	Executes audit without waiting for user keypresses	Automated script pipelines
lynis show details <ID>	Explains background and remediation for specific test	Security vulnerability patching
lynis show profiles	Displays active audit configuration profiles	Custom scan rule configuration
lynis update info	Checks for database and signature updates	Weekly maintenance routines

Running Lynis audits regularly after system upgrades or configuration changes ensures your Ubuntu servers maintain strict compliance against contemporary cybersecurity baselines.