Lynis: Linux Security Auditing and Hardening Tool

Introduction #

Lynis is a security auditing tool for Unix/Linux systems that analyzes operating system configuration, identifies misconfigurations, recommends hardening, and verifies compliance. In penetration testing, it is used in two contexts: post-exploitation to map the weaknesses of a compromised host and identify privilege escalation paths, or in white-box assessments where you have legitimate access to the system.

Lynis checks hundreds of tests: file permissions, SSH configuration , firewall, kernel parameters, running services, account policies, encryption, and much more. The output is a hardening index (0-100) and a list of findings categorized by severity.

Kill chain: Discovery / Privilege Escalation (MITRE ATT&CK T1082).

1️⃣ Setup and Installation #

sudo apt install lynis

Or from the official repository:

git clone https://github.com/CISOfy/lynis.git
cd lynis
./lynis audit system

Verify: lynis --versionVersion: 3.1.1.

2️⃣ Basic Use #

sudo lynis audit system

Output (extract):

[+] Boot and services
  - Checking presence GRUB2                       [ FOUND ]
  - Checking UEFI boot                            [ ENABLED ]

[+] Kernel
  - Checking default runlevel                     [ RUNLEVEL 5 ]
  - Checking kernel version and release           [ DONE ]

[+] Users, Groups and Authentication
  - Checking user password aging                  [ CONFIGURED ]
  - Query accounts without password               [ NONE ]
  - Checking sudo configuration file              [ FOUND ]

[+] SSH Support
  - Checking SSH configuration                    [ FOUND ]
  - SSH option: PermitRootLogin                   [ NO ]
  - SSH option: StrictModes                       [ YES ]

Hardening index : 72 [##############      ]
Tests performed : 283

Quick audit:

sudo lynis audit system --quick

Skip interactive prompts.

3️⃣ Operational Techniques #

Specific profile audit #

sudo lynis audit system --profile custom.prf

Detailed report #

sudo lynis audit system --report-file /tmp/lynis_report.dat
cat /tmp/lynis_report.dat | grep "warning\|suggestion"

Specific checks only #

sudo lynis audit system --tests-from-group "firewalls kernel ssh"

Remote audit (via SSH) #

ssh root@target "cd /opt/lynis && ./lynis audit system --quick --no-colors" > remote_audit.txt

4️⃣ Advanced Techniques #

Post-exploitation — Finding privilege escalation vectors #

After getting shell:

./lynis audit system --quick 2>/dev/null | grep -E "WARNING|SUGGESTION|SUID"

Focus on: Unusual SUID binaries, sudo misconfiguration, services with excessive permissions, vulnerable kernel.

Custom test plugins #

Lynis supports custom plugins /usr/share/lynis/plugins/. Write tests specific to the target environment.

5️⃣ Practical Pentest Scenarios #

Scenario 1: White-box audit of a server #

sudo lynis audit system --quick

Expected output: hardening index, warning and suggestion. Timeline: 1-2 minutes.

Scenario 2: Post-exploitation private recon #

curl -sO https://raw.githubusercontent.com/CISOfy/lynis/master/lynis
chmod +x lynis
./lynis audit system --quick --no-colors 2>/dev/null | grep -i "warning"

Scenario 3: Compliance check #

sudo lynis audit system --profile /etc/lynis/default.prf

6️⃣ Toolchain Integration #

Post-exploitation flow: Shell → Lynis (system audit) → linPEAS (privesc enum) → Exploit privesc

7️⃣ Complete Attack Chain #

Step 1: Shell as www-data → upload Lynis (30 sec). Phase 2: Lynis finds SUID on custom binary (2 min). Phase 3: Exploit SUID → root (5 min). Timeline: ~8 min.

8️⃣ Detection & Evasion #

Blue Team: process monitoring sees lynis Running. File access audit. Evasion: rename binary, run from /tmp, remove after.

9️⃣ Performance & Scaling #

Single host: 1-2 minutes. Consumption: <50MB RAM.

🔟 Technical Tables #

11️⃣ Troubleshooting #

12️⃣ FAQ #

Lynis finds privesc? Indirectly — it reports misconfigurations that can be exploited.

Does it work on macOS? Yes, partially.

13️⃣ Cheat Sheet #

Disclaimer: Lynis for authorized security assessment. Repository: github.com/CISOfy/lynis.

Want to support HackIta? Visit hackita.it/supporto to donate. For professional penetration testing and one-on-one training, check out hackita.it/servizi.