Lynis(8) Unix System Administrator's Manual Lynis(8)NAME
Lynis - Run an system and security audit on the system
SYNOPSISlynis --check-all(-c) [other options]
DESCRIPTION
Lynis is a security auditing tool for Linux and Unix systems. It checks
the system and software configurations, to determine any improvements.
All details are logged in a log file. Findings and other data is stored
in a report file, which can be used to create auditing reports. Lynis
can be run as a cronjob, or from the command line. Lynis prefers root
permissions (or sudo), so it can access all parts of the system, how‐
ever it not required (see pentest mode).
The following system areas may be checked:
- Boot loader files
- Configuration files
- Files part of software packages
- Directories and files related to logging and auditing
OPTIONS--auditor <full name>
Define the name of the auditor/pen-tester. When a full name is
used, add double quotes, like "Your Name".
--checkall (or -c)
Lynis performs a full check of the system, printing out the
results of each test to stdout. Additional information will be
saved into a log file (default is /var/log/lynis.log).
In case the outcome of a scan needs to be automated, use the
report file.
--cronjob
Perform automatic scan with cron safe options (no colors, no
questions, no breaks).
--debug
Display debug information to screen for troubleshooting pur‐
poses.
--dump-options
Show all available parameters.
--logfile </path/to/logfile>
Defines location and name of log file, instead of default
/var/log/lynis.log.
--no-colors
Do not use colors for messages, warnings and sections.
--no-log
Redirect all logging information to /dev/null, prevent sensitive
information to be written to disk.
--pentest
Run a non-privileged scan, usually for penetration testing. Some
of the tests will be skipped if they require root permissions.
--plugin-dir </path/to/plugins>
Define location where plugins can be found.
--profile </path/to/profile>
Provide alternative profile to perform the scan.
--quick (-Q)
Do a quick scan (don't wait for user input).
--quiet (-q)
Try to run as silent as possible, showing only warnings. This
option activates --quick as well.
--report-file </path/to/report>
Provide an alternative name for report file.
--reverse-colors
Optimize screen output for light backgrounds.
--tests TEST-IDs
Only run the specific test(s). When using multiple tests, add
quotes around the line.
--tests-category <category>
Only perform tests from particular tests. Use --view-categories
to determine valid options.
--upload
Upload data to Lynis Enterprise server.
--view-categories
Display all available test categories.
Multiple parameters are allowed, though some parameters can only be
used together with others. When running Lynis without any parameters,
help will be shown and the program will exit.
HELPERS
Lynis has special helpers to do certain tasks. This way the framework
of Lynis is used, while at the same time storing most of the function‐
ality in a separated file. This speeds up execution and keeps the code
clean.
audit Run audit on the system or on other targets
update Run updater utility
To use a helper, run Lynis followed by the helper name
BUGS
Discovered a bug? Please report them via GitHub:
https://github.com/CISOfy/lynis
Documentation
Supporting documentation can be found via https://cisofy.com/documenta‐
tion/lynis/
LICENSING
Lynis is licensed as GPL v3, written by Michael Boelen and supported by
CISOfy. Plugins may have their own license.
CONTACT INFORMATION
Support requests and project related questions can be addressed via e-
mail: lynis-dev@cisofy.com.
1.18 30 April 2015 Lynis(8)
