Lynis

Lynis is a security auditing tool that scans Linux, macOS, and Unix-based systems to support system hardening and compliance testing. The maker lists security auditing, penetration testing, vulnerability detection, and compliance testing among its typical uses. It is intended for developers, system administrators, IT auditors, and penetration testers. Its modular scans examine components and tools present on a system, with almost no dependencies according to the maker. Lynis includes 300+ built-in tests and supports custom tests. Results appear on screen; technical details go to a log, while warnings and suggestions are saved separately in a report. It can help test practices based on CIS benchmarks, NIST, NSA, OpenSCAP data, and vendor guides. Supported systems include Linux, macOS, AIX, FreeBSD, HP-UX, NetBSD, NixOS, OpenBSD, and Solaris, as well as Raspberry Pi, IoT, and QNAP devices. The free GPLv3 version costs nothing and has no warranty or support. Lynis Enterprise SaaS premium costs $36 a year, billed $36.00 per system per year (= $3.00 per system/month, billed annually).

Lynis offers adaptable system scans and detailed reports for security and compliance work. The free version is available without warranty or support, while commercial support and Enterprise options are separate.

Lynis suits developers, system administrators, IT auditors, and penetration testers working with supported systems. It can support security audits, compliance checks, and hardening tasks.

Lynis is a shell-driven security auditing tool for Linux, macOS, and other Unix-like systems. It suits administrators, developers, IT auditors, and penetration testers who need adaptable checks on systems they control. Its strongest case is local hardening and compliance work; centralized fleet reporting and vendor support are reserved for Enterprise users.

Overview

Lynis audits systems for security weaknesses and hardening opportunities, with uses that include compliance testing, vulnerability detection, penetration testing, and configuration review. Its modular, opportunistic approach examines the components and tools it finds, so the same utility can work across varied installations without a large dependency stack. The trade-off is operational: the download requires a shell and basic utilities, and scans need normal-user or preferably root permissions.

Results are shown on screen and written to a technical log, while warnings and suggestions are stored in a separate report file. That split is practical for investigating one machine or retaining audit evidence, but it does not by itself provide a central dashboard for a fleet. Lynis can upload scan data to Lynis Enterprise, whose Collector batches reports from multiple systems.

Key features

• Broad, extensible test coverage: More than 300 built-in tests cover system security checks, and custom tests let technical teams adapt audits to internal policies or unusual deployments.
• Adaptive scanning: Lynis tests the components and tools present on each machine and runs with almost no dependencies. That helps it accommodate mixed Unix environments, although the underlying shell and utility requirements still apply.
• Hardening and compliance guidance: Checks can help automate or test practices drawn from CIS benchmarks, NIST, NSA, OpenSCAP data, and vendor guides. It supports CIS benchmark work, but it does not provide automated remediation, so staff must interpret findings and make the changes.
• Plugins and integrations: Plugins add tests and system information. Some are available to community users, while others are reserved for Enterprise customers. Enterprise upload and Collector support make the commercial offering more suitable when several systems must be reviewed together.
• Audit integrity: The package is digitally signed and the download provides a SHA256 hash, giving administrators a way to verify that the software they obtained has not been altered.

Pricing

The free Lynis plan costs nothing and is free and open source software under GPLv3. It is the sensible starting point for individual administrators, developers, auditors, and small teams willing to run scans and manage reports themselves. The free version comes without warranties or support, and the product has no agentless assessment or automated remediation, so organizations must supply the operational expertise.

Lynis Enterprise - SaaS premium costs $36 a year, billed at $36.00 per system per year ($3.00 per system/month, billed annually). It adds a company-oriented SaaS service with security auditing, dashboard and reporting, an implementation plan, hardening advice, system integrity tests, intrusion detection, configuration management, and compliance capabilities. Choose it when a business needs centralized oversight and commercial assistance rather than standalone command-line output.

Lynis Enterprise - Self-hosted uses custom pricing, billed by request for a quote. It is hosted in your environment and includes a volume discount, making it the relevant route for organizations that cannot place the service in a SaaS deployment or need volume terms.

Platforms

Lynis runs on Linux, macOS, and self-hosted Unix environments. Supported systems include AIX, FreeBSD, HP-UX, NetBSD, NixOS, OpenBSD, and Solaris, along with Raspberry Pi, IoT, and QNAP devices. Its agent deployment model is aimed at systems where administrators can execute the scanner directly.

Who it's for

Choose Lynis if you are a system administrator, developer, IT auditor, or penetration tester who wants transparent, extensible checks on Unix-like hosts. It is particularly useful for teams aligning local configurations with recognized benchmarks and retaining detailed logs. It is a weaker fit for organizations that want remediation performed automatically, agentless discovery, or a managed service without shell-level administration.

Pros and cons

Pros

• 300+ built-in tests plus custom tests: Provides substantial coverage while allowing organization-specific controls.
• Very broad Unix support: Extends beyond mainstream Linux and macOS to numerous enterprise Unix variants and embedded devices.
• Low dependency footprint: Adaptive scans can work across differing system toolsets.
• Free GPLv3 edition: Individuals and teams can audit systems without a license fee.
• Verifiable package: Digital signatures and a SHA256 hash support download integrity checks.

Cons

• No included support on the free edition: Users must handle interpretation and operation themselves unless they buy commercial support.
• No automated remediation: Findings do not change system settings for you.
• No agentless assessment: The scanner must run on the systems being audited.
• Fleet features sit in Enterprise: Central collection and dashboards require the paid offering.

Alternatives

For a broader catalog of configuration tools, browse Security Configuration Management Software.

• Qualys External Attack Surface Management is the better choice when you want a 30-day CSAM with EASM trial rather than a permanently free local scanner.
• Chef InSpec fits teams needing Linux, macOS, Windows, API, and self-hosted coverage with free non-production and trial options.
• Kubescape is preferable for Kubernetes-focused work through its open-source CLI and operator.
• OpenSCAP is a free, open-source alternative for teams standardizing on the OpenSCAP tool family.
• Prowler Cloud suits cloud-security programs that want a 15-day trial and cloud account checks.
• CloudSploit is an option for a self-hosted open-source cloud scanner.
• Mondoo CSPM is aimed at broader cloud, Kubernetes, OS, SaaS, and API scanning through its open-source tools.
• DigitalOcean Cloud Security Posture Management is the alternative for web-based DigitalOcean workload scanning with a free manual-scan tier.

Verdict

Lynis is a strong choice for technical practitioners who need adaptable, benchmark-aware audits on Unix-like systems and are comfortable acting on command-line findings. Its free GPLv3 edition and extensive test library are the main reasons to choose it. Look elsewhere if you require automated fixes, agentless assessment, or centralized reporting and support without moving to an Enterprise plan.