What this module does #
Hardening is the work of closing doors: removing unneeded services, adjusting permissions, tightening boot and network… But knowing what's left to harden is the hard part. That's where this module comes in.
The lynis module runs a hardening audit backed by Lynis, checking your system against the best practices of the CIS standard. When it finishes it hands you an actionable report with three things: a hardening index (a score from 0 to 100 that sums up how hardened the system is), the list of warnings worth resolving, and a set of suggestions you can prioritize — each accompanied by its test id (for example SSH-7408), so you know exactly what it checks and where to act.
The audit reads system configuration, permissions and services, so it needs root privileges (use sudo). A full pass can take a couple of minutes; if you're in a hurry, there's a quick pass with --quick.
Common tasks #
Choose what you want to do. Each recipe comes with the command already written — just copy it and hit Copy.
1
Run my first audit
Measure how hardened your server is in a couple of minutes.
Connect to your server over SSH with the ubuntu user.
Run the full audit. When it finishes you'll see a summary with the hardening index and how many warnings and suggestions there are:
$ sudo imaxe lynis auditIn a hurry? The quick pass skips the longest tests and gives you a rough snapshot right away:
$ sudo imaxe lynis audit --quick2
View the latest report
Review the index, the warnings and the suggestions with their test id.
Show the report from the latest audit, with the hardening index at the top and the list of warnings and suggestions below:
$ sudo imaxe lynis reportWant it for a tool or a dashboard? Add --json and you'll get the same report in a structured format:
$ sudo imaxe lynis report --jsonSSH-7408): use it to know what it checks and to prioritize what to harden first.3
View the current status
A quick glance: when it was last audited and what score you have.
Check the date of the last audit, the current hardening index and whether a custom profile is in play:
$ sudo imaxe lynis statusAlso available in JSON, ideal for monitoring:
$ sudo imaxe lynis status --json4
See which tests are skipped
Check which checks are skipped and why.
List the skipped tests —both those from the AWS baseline and the ones you add in lynis.yml— along with the reason for each skip:
$ sudo imaxe lynis show-skipsThe report only exists after an audit. If report or status show nothing, run sudo imaxe lynis audit first and then check again.
Synopsis #
imaxe lynis <subcomando> [flags]The audit needs root privileges (use sudo) because it inspects the system's configuration, permissions and services. Add --json to report, status or show-skips to get machine-readable output suitable for scripting and dashboards.
Subcommands #
| Subcommand | What it does | Relevant flags |
|---|---|---|
| audit | Runs the hardening audit and summarizes the result (index, warnings and suggestions). | --quick |
| report | Shows the latest report: index, warnings and suggestions with their test id. | --json |
| status | Status: date of the last audit, current index and whether a custom profile is in use. | --json |
| show-skips | Lists the skipped tests (AWS baseline + lynis.yml) and their reason. | --json |
Arguments and flags #
| Flag | Type | Default | Description |
|---|---|---|---|
| --quick | bool | false | In audit: quick pass that skips the longest tests. Gives a rough snapshot in less time. |
| --json | bool | false | In report/status/show-skips: emits the result as structured JSON on stdout. |
Files and paths #
| Path | Contents |
|---|---|
| /etc/imaxe/lynis.yml | Module configuration: profile, tests to skip (skip_tests), remediation and audit defaults. |
| /var/log/lynis-report.dat | Data from the latest Lynis report: hardening index, warnings and suggestions with their test id. |
| /var/log/imaxe/lynis.log | Structured record of each audit run by the module. |
Example of lynis.yml:
profile:
deploy: true
skip_tests: []
remediation:
enabled: true
audit:
quick_default: falseExit codes and logs #
Each run returns a code you can check with echo $? — handy for chaining in scripts:
audit first.Follow the log live while you review an audit:
$ sudo journalctl -u imaxe-lynis -f
$ sudo tail -f /var/log/imaxe/lynis.logTroubleshooting #
| Symptom | Likely cause | Fix |
|---|---|---|
| You get NOAUDIT (code 3) | report or status before ever having audited. | Run sudo imaxe lynis audit and check again. |
| The report takes a long time | The full pass also runs the long tests. | Use sudo imaxe lynis audit --quick for a quick snapshot. |
| An expected check is missing | The test is on the skip list. | Review sudo imaxe lynis show-skips to see the reason. |
| The index doesn't improve after changes | The report shows the latest audit, not the live state. | Run audit again to recalculate the index. |
Stuck with the Lynis module?
Write to us with the output of «imaxe <module> status --json» and we'll get back to you fast.