Lynis is an agentless, GPL-3.0 security auditing and hardening tool that runs on the UNIX-based system itself, built for system administrators, auditors, security officers, and penetration testers who need to assess security defenses and test compliance against standards such as ISO27001, PCI-DSS, and HIPAA.

What it is

Lynis is a security auditing tool for systems based on UNIX, including Linux, macOS, BSD, and others. It performs an in-depth security scan and runs on the system itself rather than reaching across the network from a separate host. The primary goal is to test security defenses and provide tips for further system hardening, and it also scans for general system information, vulnerable software packages, and possible configuration issues. Installation is optional and the tool is agentless, so nothing has to be permanently deployed on the audited machine.

The concrete problem it solves is the absence of a repeatable, inspectable way to know how well a UNIX system is defended. Lynis was commonly used by system administrators and auditors to assess the security defenses of their systems, and it has since been adopted by penetration testers as well. Rather than relying on manual review of configuration files and running services, the tool automates the audit and produces hardening suggestions tied to real findings. It also serves compliance work: the topics list covers auditing, compliance, GDPR, HIPAA, and PCI-DSS alongside hardening and security scanning.

Key capabilities

• Automated security auditing through a command-line scan invoked as ./lynis audit system.
• Compliance testing for frameworks named in the goals, including ISO27001, PCI-DSS, and HIPAA, with GDPR and PCI-DSS also present in the topic list.
• Vulnerability detection, including scanning for general system information, vulnerable software packages, and possible configuration issues.
• Support for configuration and asset management and software patch management as secondary uses listed alongside the main goals.
• System hardening guidance, with the primary goal stated as providing tips for further system hardening.
• Penetration testing support focused on privilege escalation, plus intrusion detection assistance.
• Extensibility through the Lynis software development kit, lynis-sdk, for building custom tests.

Who uses it and how

• System administrators use it to assess the security defenses of servers they already operate, running the scan locally on the host.
• Auditors and security officers use it for compliance testing against ISO27001, PCI-DSS, and HIPAA, and it carries GDPR among its topics.
• Penetration testers use it in their toolkit for privilege escalation checks, a use the README names explicitly alongside the traditional blue team audience.
• Security professionals and DevOps teams, per the topic list, run it as part of hardening and scanning workflows.
• Because it is agentless and installation is optional, it suits one-off audits as well as repeated scans; the README states the software is used by thousands every day to protect their systems.

Getting started

The fastest route for the latest development code is git clone https://github.com/CISOfy/lynis, followed by cd lynis && ./lynis audit system; no compilation or installation is required. For production use, the preferred method is a software package, with the project publishing RPM and DEB packages from the CISOfy repository for CentOS, Debian, Fedora, OEL, openSUSE, RHEL, Ubuntu, and others.

How it compares

No paid products or competing tools are named in the facts provided, so Lynis stands alone in this registry. There is no basis in the available facts for contrasting it with commercial alternatives on licence, hosting model, or pricing.

When to use it — and when not to

Lynis fits teams that want a locally executed, agentless audit with no permanent footprint, and it is licensed under GPL-3.0, so the source can be read and changed. A self-hoster must accept the operational detail the README calls out: running the scan as root or with sudo means changing file ownership with chown -R 0:0, otherwise Lynis warns about file permissions because it would otherwise execute files owned by a non-privileged user. One weakness is packaging: some distributions do not provide an up-to-date version, in which case the CISOfy repository, the website tarball, or the latest GitHub release should be used instead. The repository also carries 224 open issues, so the backlog is not trivial, and documentation lives on the external CISOfy site rather than in the repository.