Lynis

Lynis is an open-source security auditing and hardening tool for Linux, macOS, and BSD systems. It performs hundreds of individual tests covering file permissions, kernel parameters, authentication settings, firewall rules, service configurations, network settings, and installed software against known security baselines. Lynis checks compliance against CIS benchmarks, ISO 27001, PCI DSS, and HIPAA requirements, generating a detailed report with a hardening index score and specific remediation suggestions. Unlike vulnerability scanners that look for known CVEs, Lynis focuses on configuration hygiene — finding weak SSH settings, world-readable files, unpatched software, unnecessary services, and missing security controls. The tool runs entirely locally with no network dependencies, making it suitable for air-gapped environments and systems where agents cannot be installed. With over 15,000 GitHub stars, Lynis is the most widely used open-source system hardening tool, commonly run as part of deployment validation and periodic security reviews.