Run a complete local audit with sudo lynis audit system. Lynis examines the VPS operating system, services, configuration, permissions, logging and other host controls, then writes a log and a report containing warnings and hardening suggestions. Running as root or through sudo gives it the broadest view; the unprivileged --pentest mode intentionally skips tests that require elevated access.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The useful workflow is iterative: establish a baseline, investigate each finding in the context of the services your VPS actually runs, make one controlled change at a time, and rerun the same audit. A Lynis result is security guidance, not proof that a host is compliant or safe.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What Lynis audits on a Linux VPS
Lynis is a local UNIX-like-system security auditing and hardening tool. It checks the host’s configuration and installed software, performs tests, and records what it discovers. On a VPS, that makes it useful for finding weak SSH settings, unnecessary services, permissive files, incomplete logging, outdated packages and other host-level issues before they become incidents.
The audit runs on the machine being assessed, so it can see local files, services and kernel settings that a network-only scan cannot. It is not a universal application vulnerability scanner: it will not replace patch management, secure coding and application configuration, network segmentation, backups, incident response or an independent compliance assessment.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Before you start
Have administrative access
Use an account that can run commands with sudo, or log in as root. Root is not strictly required by the Ubuntu command reference, but many tests need privileged access. Without it, Lynis reports a narrower set of facts and skips root-only checks.
Confirm the host and its role
Record the distribution, release, kernel, public services and intended purpose of the VPS. A single-purpose application host, mail server, database server, web server and container host have different acceptable configurations. A warning about a disabled service may be harmless on one system and serious on another.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Use a current Lynis build
Distribution packages are convenient but can lag behind the current project release. Check the installed version and compare it with the current package, tarball or Git release provided by the Lynis project. The Kali tool page accessed on 2026-10-15 listed package version 3.1.6; that figure describes Kali’s page at that date, not every distribution.
Install Lynis
Debian or Ubuntu package installation
On a Debian-family VPS, the usual path is:
sudo apt update
sudo apt install lynis
lynis show version
sudo lynis audit systemThe package method is preferred when an up-to-date package is available because it is quick to install and easy to update. Run lynis show version after installation so your audit records identify the tool version.
When the distribution package is old or unavailable
Use the official Lynis repository, a project tarball or the documented Git checkout. A Git checkout runs directly and does not require compilation or a conventional installation:
./lynis audit systemIf you invoke a checkout as root, the project documentation warns that its files should be owned by root so Lynis does not report an unprivileged owner. From the checkout directory, that ownership adjustment is:
sudo chown -R 0:0 .Keep the checkout or extracted directory in a controlled location and update it through the project’s documented process. Do not mix files from different releases in one directory.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Run a full local audit
The standard command for a complete system audit is:
sudo lynis audit systemLynis displays progress and test results in the terminal, then writes its normal log and report files. Let the command finish so the final summary and suggestions are recorded. On a production VPS, run it from a maintenance session such as tmux or screen if your connection is unreliable.
Running without root
For a non-privileged penetration-testing view, run:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
lynis audit system --pentestThis mode is useful when you cannot obtain administrative access, but it is deliberately incomplete. Tests that require root privileges are skipped, so do not treat its output as equivalent to a privileged audit.
Useful execution options
| Command | Use |
|---|---|
sudo lynis audit system |
Run the normal privileged local audit. |
lynis audit system --pentest |
Run a non-privileged audit; root-only tests are skipped. |
sudo lynis audit system --cronjob --no-colors |
Produce cron-safe, non-coloured output for unattended jobs. |
sudo lynis audit system --quick |
Request a quick non-interactive run; the short form is -Q. |
lynis show groups |
List valid test groups before selecting a subset. |
sudo lynis audit system --tests-from-group <group> |
Run the tests belonging to one named group. |
sudo lynis audit system --tests <test-id> |
Target explicit test IDs when you need a narrow check. |
sudo lynis audit system --warnings-only |
Emit only warnings, useful for a monitoring job. |
sudo lynis audit system remote <host> |
Use Lynis’s documented remote-audit mode rather than the normal local workflow. |
Use the full audit for a baseline and after significant changes. Narrow groups or test IDs are better for troubleshooting a specific subsystem, but they do not replace the complete audit.
Find the log and report
The Ubuntu Lynis manpage documents /var/log/lynis.log as the default log. Common packages use /var/log/lynis-report.dat for the report that stores findings and discovered data. Package layouts can differ, so check the final terminal output and your local manpage if those paths are absent.
sudo less /var/log/lynis.log
sudo less /var/log/lynis-report.dat
grep -E '^(warning|suggestion)' /var/log/lynis-report.datWhen you need a controlled destination, select one explicitly:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
sudo lynis audit system --report-file /var/lib/lynis/$(hostname)-baseline.datCreate and protect any custom directory before using it. Reports can contain host names, software versions, paths, service information and configuration details. Restrict read access, encrypt copies sent off-host, and apply a retention period appropriate to your environment.
Report keys and formatting can vary between Lynis versions. Inspect a sample report before building automation that parses individual fields; do not assume that a key or ordering remains unchanged after an upgrade.
Interpret warnings and suggestions
Start with exposure and impact
Read warnings first, then suggestions that affect an exposed or privileged component. For every item, capture:
- the Lynis test ID and exact message;
- the affected service, package, file or setting;
- the current state observed on your VPS;
- the proposed change and its security rationale;
- the person responsible for the change;
- a maintenance window, validation test and rollback plan.
Confirm that the service or behavior is actually needed before changing it. Removing an unused daemon can reduce attack surface; disabling a daemon that provides backups, mail delivery or container networking can create an outage.
Free tools Windows power users keep installed
One-click scans. No signup required.
Check the underlying configuration yourself
A Lynis suggestion is a review item, not an instruction to paste a command blindly. Open the relevant configuration, compare it with the service’s current documentation and your organization’s baseline, and check dependencies. For SSH, for example, consider how administrators authenticate, whether an emergency access path exists and how a change will be tested before a session is closed.
Account for false positives and accepted risk
Some findings are intentional. A development service may need a permission that a hardened single-purpose host would not; a container host may expose interfaces that are unnecessary elsewhere. Document the reason, owner and review date for an accepted finding. Keeping that context prevents the same debate every time an audit runs.
Compare reports after remediation
Apply one related set of changes, test the service, and rerun the same audit. The Lynis manpage notes that reports can be used to compare differences between audits. Retain a dated baseline and the post-change report so you can show what changed and identify regressions.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
VPS-focused audit checklist
Use these areas to turn a general audit into a practical VPS review:
- Operating system and kernel: verify the release and kernel are supported, and install available security updates through your normal change process.
- SSH: review authentication methods, root-login policy, administrative groups, key handling and lockout or rate-limiting controls. Confirm that a second administrative session works before ending the first.
- Exposed services: inventory listening sockets and disable software the host does not need. Match every public port to a documented service owner.
- Firewall: check host firewall rules against the provider’s network controls and the application’s required ports. Keep an approved recovery path for administration.
- Files and directories: inspect ownership and permissions on credentials, service configuration, writable directories, scheduled-job files and web roots.
- Boot and kernel controls: review boot-loader protection and relevant kernel settings without breaking provider recovery mechanisms.
- Logging and auditing: verify that security and service logs are generated, retained and forwarded or monitored. Logging on the VPS alone does not help if an attacker can erase it.
- Packages: check package state, update policy and removal of obsolete software. Schedule reboots when kernel or library updates require them.
- Time: confirm reliable time synchronization so logs, certificates and incident timelines are trustworthy.
- Backups: verify that backups exist outside the VPS, are protected from the VPS account and have been restored successfully.
- Service accounts: use least privilege, separate application identities and disable unused accounts and credentials.
- Alerting: send important host and application events to monitoring outside Lynis; Lynis itself is not a complete alerting system.
Schedule recurring audits safely
For one VPS, a periodic cron job or system-timer unit can run the cron-safe form:
sudo lynis audit system --cronjob --no-colorsGive unattended runs an explicit report destination and archive dated copies so a later review can compare changes. Ensure the job runs with the intended privileges, has a predictable PATH, and cannot write reports into a directory writable by an untrusted account. Test the job interactively before scheduling it.
A monitoring task can use --warnings-only when the alert channel should contain warnings rather than the full terminal output. Keep the complete report for investigation even if the alert message is short. If you use --quick, document that choice: a quick run is not a substitute for a full baseline.
Use Lynis across multiple VPSs
Fleet operation requires more than running the same command on every host. Standardize host identity, report naming, retention, time synchronization and alert thresholds. Store reports in a protected central location, and preserve enough metadata to tell which operating-system release, kernel and Lynis version produced each result.
Do not rank hosts solely by a single hardening index. A score can improve while an exposed application vulnerability, weak backup process or compromised credential remains. Use Lynis findings alongside patch status, vulnerability management, firewall telemetry, application testing and incident-response controls.
The Lynis project documents an enterprise reporting tier with a web interface, dashboards, reporting, hardening snippets, risk-based improvement plans and commercial support. If you evaluate that option for a team or compliance program, verify its current licensing, deployment model and partner terms directly with the project before committing.
Troubleshoot common problems
The command is not found
Confirm that the package installed successfully and that the executable is on the administrative user’s PATH. Run lynis show version. If you are using a Git checkout, change to that directory and invoke ./lynis audit system instead of the package command.
Recommended Free Tools
The audit has many skipped tests
First check whether you ran --pentest or another unprivileged command. Re-run with sudo for broad coverage. Some tests can still be inapplicable because a service or feature is not installed; record that context rather than enabling software merely to satisfy a test.
The expected report path is missing
Check the command’s final output, the local manpage and the directory permissions. Use --report-file to select a known writable, protected path. Avoid assuming that every distribution package uses identical paths.
A Git checkout reports ownership concerns
When the checkout is executed as root, ensure the checkout files are owned by root with sudo chown -R 0:0 ., as documented by the project, and keep unprivileged users from modifying the files that root executes.
A suggestion conflicts with the application
Identify the exact test and affected component, test the proposed setting in a maintenance window or staging host, and confirm application behavior. If the setting is intentionally different, document the accepted risk and revisit it when the service or threat model changes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallKnow what Lynis cannot establish
Lynis does not publish a universal accuracy percentage, guaranteed compliance result or security-score threshold. No score can certify that a VPS is secure. The tool also does not replace application-layer vulnerability testing, patch governance, network controls, backups, disaster-recovery exercises, credential management or incident response.
Use the audit as evidence in a broader control cycle: identify exposure, make a justified change, validate the service, preserve the report and monitor the result. That approach is more defensible than applying every suggestion simply to raise an index.
Quick Recap
A repeatable operating procedure
- Record the VPS role, public services, operating-system release, kernel and Lynis version.
- Install or update Lynis using the distribution package when current; otherwise use the documented repository, tarball or Git release.
- Run
sudo lynis audit systemand preserve the dated log and report. - Review warnings and high-impact suggestions, beginning with internet-exposed and privileged components.
- Validate each proposed change against service requirements, maintenance impact and a rollback plan.
- Apply a controlled change and test administration, application behavior, logging and backups.
- Run the same audit again and compare the new report with the baseline.
- Document accepted findings, owners and review dates, then schedule recurring cron-safe audits.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
