Security

Security audit and hardening with Lynis on a VPS

BM BizMaC Team Jul 16, 2026 8 min read

Prerequisites

This guide assumes you have:

  • A Linux VPS running Ubuntu 24.04 LTS (commands work on Debian 12 and AlmaLinux 9 with minor package name changes).
  • Root access or a sudo user with full privileges.
  • Outbound internet access to download packages from the official repository.
  • Basic familiarity with the command line, you will run commands, read output, and edit config files.

If you need a VPS to practice on, you can rent a Linux VPS with full root access and a dedicated Vietnam IPv4, the whole point of this audit is to lock it down properly from day one.

Why regular security audits matter, the sysadmin's reality

You just provisioned a fresh VPS. You install a LAMP stack, copy over a few websites, and move on. A month later you notice an unknown outbound connection in `ss -tlnp`. That is your wake-up call.

Most VPS compromises are not zero-days, they are known vulnerabilities that nobody patched, default SSH configurations with password login enabled, or open ports that should have been firewalled. A systematic security audit catches these before an attacker does. Lynis is the open-source tool that automates this audit. It runs over 300 tests against your system, SSH config, file permissions, kernel parameters, open ports, package updates, malware presence, and gives you a Hardening Index score. Think of it as a pentest lite that you run every month.

Step 1, Installing Lynis on Ubuntu 24.04

Lynis is in the official Ubuntu repositories, but the version there can be months old. The maintainer (CISOfy) provides an up-to-date repository. We use that.

sudo apt update
sudo apt install -y curl gnupg

# Add the CISOfy repository key
sudo curl -fsSL https://packages.cisofy.com/keys/cisofy-software-public.key | sudo gpg --dearmor -o /usr/share/keyrings/cisofy-software-archive-keyring.gpg

# Add the repository
echo "deb [signed-by=/usr/share/keyrings/cisofy-software-archive-keyring.gpg] https://packages.cisofy.com/community/lynis/deb/ stable main" | sudo tee /etc/apt/sources.list.d/cisofy-lynis.list

# Install Lynis
sudo apt update
sudo apt install -y lynis

Verify the installation:

lynis --version

Expected output: 2.x.x (current stable as of 2025 is 3.1.x, if you see <3.0, the repository did not update; double-check the apt sources entry).

Step 2, Running your first Lynis audit

Run Lynis in audit mode as root (it requires root to read /etc/shadow, check kernel parameters, and evaluate systemd services).

sudo lynis audit system

This command takes 30-90 seconds. Lynis will output a stream of tests to the terminal. Do not interrupt it. When it finishes, you will see a report summary that includes:

  • Hardening Index, a score between 0 and 100 (higher is better).
  • Number of tests performed, typically 250-350.
  • Suggestions, items marked [SUGGESTION] with a severity label (low/medium/high).
  • Warnings, items marked [WARNING] that need immediate attention.

The full report is saved to /var/log/lynis.log and /var/log/lynis-report.dat.

On a default Ubuntu 24.04 install, expect a Hardening Index around 55-65. That is not terrible but it means 35%+ of the checks either failed or were not tested. The goal is to push it above 80.

Step 3, Interpreting the most critical findings

Not all suggestions are equal. Focus on the ones marked [high] or [medium] priority. Here are the most common high-priority items on a stock install and how to fix them.

3.1, Disable root SSH login and password authentication

Lynis will flag SSH-7408 (allow root login) and SSH-7410 (password authentication). Both are high severity. Fix them by editing /etc/ssh/sshd_config:

sudo sed -i 's/^#PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
sudo sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config

Then reload the SSH service:

sudo systemctl reload sshd

Before you close your current session, open a second terminal and verify that key-based login still works:

ssh -i ~/.ssh/your_key user@your_vps_ip

If it fails, you still have the first session open to revert the change. Test it first, this is the step that locks out most people.

3.2, Enable and configure a firewall (UFW)

Lynis checks whether a firewall is active. A default Ubuntu server has none. Enable UFW with a minimal rule set:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

This blocks all inbound ports except SSH (22), HTTP (80), and HTTPS (443). Adjust the HTTP/HTTPS ports if you run a web server on non-standard ports.

Verify:

sudo ufw status verbose

Expected output shows Status: active with your rules listed.

3.3, Install and configure fail2ban

Lynis detects whether fail2ban is installed and whether the SSH jail is active. Install it:

sudo apt install -y fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo systemctl enable --now fail2ban

Verify:

sudo fail2ban-client status sshd

Expected output: Status for the jail: sshd with |- Currently banned: 0 (or a number if you already have failed login attempts).

3.4, Set a strong password policy and lock inactive accounts

Lynis checks for password aging. At minimum, enforce expiry for user accounts:

sudo chage -M 90 your_user

Also lock any system accounts that are not in use. Lynis will flag users without a shell or with empty passwords. Review /etc/passwd and lock unused accounts:

sudo usermod -L username_here
sudo usermod -s /sbin/nologin username_here

Do not touch root, www-data, nobody, or system accounts needed by your stack.

Step 4, Re-run the audit and track the improvement

After applying the fixes above, run the audit again:

sudo lynis audit system

Compare the Hardening Index. A jump from 55-65 to 75-85 is realistic. The goal is 85+ for a production VPS. If you did not reach 80, check the remaining suggestions, they are usually about kernel hardening (sysctl parameters) and file permission tightening.

Lynis also writes a log file at /var/log/lynis.log. You can grep for SUGGESTION to extract all actionable items:

grep SUGGESTION /var/log/lynis.log | grep -i high

This gives you a clean list of only the high-priority items, no noise.

Troubleshooting

Trouble: Lynis exits with "no tests executed" or "could not read /proc"

You are not running as root, or the VPS container does not expose /proc in a standard way. Run with sudo as shown above. If running inside a Docker container, some kernel checks are intentionally blocked, this is expected; Lynis works best on a full KVM virtual machine, which is what a standard thueVPS Linux VPS provides.

Trouble: After disabling password authentication, SSH says "Permission denied (publickey)"

Your SSH key is not loaded, or you are trying to connect as root on a system that now enforces PermitRootLogin prohibit-password. Connect with your non-root user and the correct key: ssh -i /path/to/key user@vps_ip. If you still cannot connect, use the out-of-band console (VNC/SPICE) from your VPS control panel to revert the change.

Trouble: fail2ban does not start, journal says "ERROR Failed during configuration: No file(s) found for glob"

The SSH log path in the jail configuration does not match your system. On Ubuntu 24.04, the SSH log is /var/log/auth.log. Check /etc/fail2ban/jail.local and make sure logpath = %(sshd_log)s is present, or set it explicitly to /var/log/auth.log.

FAQ

How often should I run a Lynis audit on my VPS?

Run it monthly on a production VPS, and always after a major OS update or software installation. Lynis takes under two minutes, it is a quick check to run on a weekend morning.

Does Lynis automatically fix vulnerabilities?

No. Lynis is a scanner, not an auto-patch tool. It detects issues and gives you a clear suggestion to fix each one. You need to apply the changes manually. This is intentional, you should never let an automated tool modify kernel parameters or SSH config without your review.

Can I use Lynis on a Windows VPS?

No. Lynis is Linux/Unix only. For Windows Servers, you would need Microsoft Defender for Cloud or a third-party tool like OpenVAS. If you run a Windows VPS, focus on Windows Update, RDP hardening, and firewall rules instead.

What is a good Hardening Index score?

Above 80 is acceptable for most use cases. Above 85 is good. Above 90 is excellent but requires additional hardening like kernel parameters (sysctl), file permission audits, and AppArmor/SELinux profiles. Do not chase 100, some tests are informational and cannot be "fixed" without breaking functionality.

Will Lynis break my running services?

Running the audit itself does not modify anything. It only reads configuration files, checks running processes, and inspects kernel parameters. The only risk is if you blindly apply all suggestions without understanding the impact, always test one change at a time.

Does Lynis check for web application vulnerabilities (SQL injection, XSS)?

No. Lynis audits the OS layer, SSH, firewall, passwords, file permissions, kernel, services. It does not scan web applications. For that, you need a dedicated scanner like OWASP ZAP or Nikto.

Related articles

Note: This guide is for general reference. Every system and infrastructure has its own specifics, so test each step in a safe environment and consult a qualified engineer before applying it in production.