49 System Hardening (Linux/Unix/macOS) – Lynis
Brett Theuerkauf and Mathew J. Heath Van Horn, PhD
Lynis is a free, open-source security tool for Linux, macOS, or Unix-based computers. It takes an in-depth look at the system’s setup, OS, programs, user accounts, and settings to find any weak security spots. In this exercise, we’ll install Lynis on Kali Linux, run it, interpret its report, and then use some of its recommendations to make the system safer.
Phase 0 – Professional Alignment
Maintaining a secure enterprise system requires regularly assessing its security posture and correcting configuration weaknesses before they can be exploited. In this chapter, you will use Lynis to perform a comprehensive security audit of a Linux, Unix, or macOS system, analyze the findings, and remediate identified issues. These activities demonstrate how security auditing supports continuous system hardening and helps organizations maintain secure, compliant computing environments.
DCWF Work Roles
The knowledge and skills developed in this chapter align with the following Department of Defense Cyber Workforce Framework (DCWF) work roles:
- 451 – System Security Analyst
- 531 – Systems Administrator
- 541 – Cyber Defense Analyst
NICE Work Roles
This chapter supports competencies associated with the following NICE Workforce Framework for Cybersecurity work roles:
- Systems Administrator
- Cyber Defense Infrastructure Support Specialist
- Cyber Defense Analyst
Professional Skills
By completing this chapter, you will begin developing the ability to:
- Perform comprehensive security audits of Linux, Unix, and macOS systems.
- Interpret security assessment reports and prioritize remediation activities.
- Identify operating system configuration weaknesses that increase security risk.
- Implement recommended hardening measures to improve system security.
- Validate security improvements by performing follow-up assessments.
- Document security findings and remediation activities to support enterprise security management.
What You’ll Be Able to Do
After completing this chapter, you should be able to:
- Install and configure Lynis on a supported operating system.
- Perform a comprehensive security audit using Lynis.
- Interpret Lynis findings, warnings, and hardening recommendations.
- Implement selected security improvements based on the audit results.
- Reassess the system to verify that security recommendations have been successfully applied.
- Explain how continuous security auditing supports enterprise system hardening and ongoing risk management.
Learning Objectives
- Install and run Lynis
- Analyze system audit results provided by Lynis.
- Implement recommended security measures to enhance system hardening.
Prerequisites
Deliverables
- Screenshot – Initial Lynis scan results
- Screenshot – Revised Lynis scan results
Resources
Contributors and Testers
- Braedyn Case, Cybersecurity Student, ERAU-Prescott
Phase I – Installing Lynis
- Start a Kali Linux VM (GNS3 is not needed for this lab)
- Ensure you update and upgrade your system
- Update
sudo apt update
- Upgrade
sudo apt upgrade
- Update
- Open a terminal and install Lynis by typing
sudo apt-get install lynis
- Lynis is a portable shell script and doesn’t require installation per se. You can copy the source files to a thumb drive for use on any system you have root access
- Plug a USB drive into the physical computer
- ‘Activate’ the USB drive in the Kali Linux virtual space.
- At the top of the Kali Linux VM click on Devices
- Click on the USB submenu to open it
- Click on the USB drive you plugged in (in this example, it is the Samsung Flash Drive)
NOTE: When you do this, the USB drive will no longer appear in the host OS (Windows 11)
Figure 1 – Activating USB in Kali VM
- In the Kali Terminal, find the USB folder by typing
lsblk
- The device should appear as the newest hard drive (in this example, sdb-sdb1
- If you are uncertain, repeat step 2 to deselect the USB drive, run lsblk, then select the USB drive and run lsblk again, and compare the results.
Figure 2 – Activating USB in Kali VM - Create a mount point for your USB by typing
sudo mkdir -p /media/usb
- Mount the USB to the mountpoint by typing
sudo mount /dev/sdb1 /media/usb
- Navigate to the USB
cd/media/usb
- Download the Lynis package
sudo wget https://downloads.cisofy.com/lynis/lynis-3.1.7.tar.gz
- Extract the files to the USB
sudo tar xfvz lynis-*
Phase II – Performing a Scan
Lynis is not a program; it is a collection of shell scripts. It actively detects which programs are running on your system and runs tests on them. It performs the following:
- System Discovery – Identifies the operating system, kernel version, and hardware
- Security Checks – Runs hundreds of individual tests by category (firewall, permissions, processes, etc.)
- Validation – For every test, it displays an OK or WARNING with color codes:
- Green – passes checks or is properly disabled
- Yellow – needs improvement, but no immediate danger
- Red – critical warning
- White – informational message
- To run a Lynis scan on your system, type sudo lynis audit system
- The scan can take a while, 2- 10 minutes
Figure Zzzzzz - Once it finishes, you can see the scan results and take action
Figure 3 – scan results - Feel free to scroll up and see the suggestions made. In this case, we have 48 suggestions
Figure 4 – list of recommendations - Scroll back to the bottom, and you can see that the Malware scanner is disabled (indicated by X)
Phase III – Resolving warnings.
Lynis will certainly tell you about issues with your system, but you still need to actually take action to resolve them.
- Kali Linux does not usually come with a real-time malware scanner like other operating systems, so we are going to add one
- Install ClamAV by typing
sudo apt install clamav clamtk
- Make sure you update your system by typing
sudo apt update
- Install ClamAV by typing
- Run another full scan of your system and review the new results
Figure 5 – rescan is complete - If you scroll up, you should have fewer suggestions. In our example, we now only have 47 suggestions
Figure 6 – fewer suggestions
Career Connection
Enterprise organizations routinely perform security audits to evaluate system configurations, identify vulnerabilities, and verify compliance with organizational security standards. Systems administrators, cybersecurity analysts, and security engineers use tools such as Lynis to establish security baselines, identify misconfigurations, prioritize remediation efforts, and measure improvements over time. The skills developed in this chapter reflect a continuous improvement approach to system security, where regular assessments help organizations reduce risk, maintain compliance, and strengthen the resilience of their infrastructure.
End of Lab
Deliverables
2 Screenshots are recommended to receive credit for completing the guided walk-through:
- Initial Lynis scan results
- Revised Lynis scan results
Homeworks
Assignment 1 – Resolve 3 warnings. Each warning includes details about the warning and usually a web reference. Select three warnings and take the appropriate action to resolve them so they no longer are an issue in a Lynis scan.
RECOMMENDED GRADING CRITERIA:
- Screenshot of initial scan results (similar to figure 4 above)
- Screenshot of resolved actions taken (similar to figure 5 above)
Assignment 2 – Add a new VM and resolve 3 warnings. Start another Linux distribution (Ubuntu, Alpine, Raspberry PI, etc.). Install Lynis and perform a full scan. Select three warnings and take the appropriate action to resolve them so they no longer are an issue in a Lynis scan.
RECOMMENDED GRADING CRITERIA:
- Screenshot of initial scan results (similar to figure 4 above)
- Screenshot of resolved actions taken (similar to figure 5 above)
