How to Install and Use Lynis on CentOS 7

Lynis is an open source security auditing tool which is widely used on various Unix-like operating systems. With Lynis, system administrators and security professionals can perform in-depth system-wide security scans in a matter of minutes.

In this article, I will explain how to install and use Lynis on a CentOS 7 server.


  • A CentOS 7 x64 server instance.
  • A sudo user.

Step 1: Update the system

Log in from an SSH terminal as a sudo user, and then update the system as follows:

sudo yum install epel-release -ysudo yum update -ysudo shutdown -r now

After the system reboot, log in back as the same sudo user.

Step 2: Install Lynis and Lynis plugins (community)

2.1 Install Lynis

On CentOS 7, you can easily install Lynis using the EPEL YUM repo which has been installed earlier:

sudo yum install lynis -y

2.2 Install Lynis plugins (community)

If you want to enhance Lynis’ functionality, you can install Lynis plugins (community) which can only be obtained from subscription:

  1. On the official Lynis plugins download page, click the Download button.
  2. On the next page, input your email address and then click the Subscribe button.
  3. You will receive an email message in your email inbox, click the link within to confirm your subscription.
  4. You will receive another email message which includes the download URL of Lynis plugins, say it is

Now, download and unzip the plugins archive as follows:

cdwget -O  lynis-community-plugins.tar.gzsudo tar -zxvf lynis-community-plugins.tar.gz --strip-components=1 -C /usr/share/lynis/plugins

Setup proper permissions:

sudo chown root:root /usr/share/lynis/plugins/plugin_*sudo chmod 600 /usr/share/lynis/plugins/plugin_*

Finally, check the Lynis profile file to make sure that newly-added plugins (which are pam and systemd in our case) are enabled:

sudo grep plugin= /etc/lynis/default.prf

The output should include plugin=pam and plugin-systemd:


Step 3: Use Lynis

Simply running Lynis without any parameter will display the Lynis parameters:

sudo lynis

If you want to perform a full security scan, use the following command:

sudo lynis audit system

All scan results will be stored in the Lynis log file /var/log/lynis.log.

After the full security scan, you can sort out all Warning messages from the Lynis log file using the below grep command:

sudo grep Warning /var/log/lynis.log

Similarly, you can display all Suggestion messages using another grep command:

sudo grep Suggestion /var/log/lynis.log

That’s it. If you want to learn more details about Lynis, please visit Lynis official website.

Want to contribute?

You could earn up to $300 by adding new articles

Submit your article
Suggest an update
Request an article

No comments

Powered by Blogger.