Security Scanning with Lynis on Linux

In this article, we'll walk through the complete process of working with lynis in a server environment. Understanding scanning is essential for maintaining a reliable and performant infrastructure.

Prerequisites

• Root or sudo access to the server
• A registered domain name (for public-facing services)
• Current system packages (run apt update && apt upgrade)
• A VPS running Ubuntu 22.04 or later (2GB+ RAM recommended)

Installation and Configuration

If you encounter issues during setup, check the system logs first. Most problems can be diagnosed by examining the output of journalctl or the application-specific log files in /var/log/.

# Install and configure lynis
sudo apt update && sudo apt install -y lynis

# Backup existing config
sudo cp /etc/lynis/lynis.conf /etc/lynis/lynis.conf.bak

# Edit configuration
sudo nano /etc/lynis/lynis.conf

Note that file paths may vary depending on your Linux distribution. The examples here are for Debian/Ubuntu; adjust paths accordingly for RHEL/CentOS-based systems.

Performance Considerations

The default configuration works well for development environments, but production servers require additional tuning. Pay particular attention to connection limits, timeout values, and logging settings.

• Maintain runbooks for common operations
• Document all configuration changes
• Set up monitoring before going to production

Creating Security Rules

The scanning component plays a crucial role in the overall architecture. Understanding how it interacts with lynis will help you make better configuration decisions.

# Check security status
sudo lynis --check
sudo systemctl status lynis

# View logs for security events
sudo journalctl -u lynis --since "1 hour ago"
sudo tail -f /var/log/lynis.log

This configuration provides a good balance between performance and resource usage. For high-traffic scenarios, you may need to increase the limits further.

Performance Considerations

When scaling this setup, consider vertical scaling (adding more RAM/CPU) first, as it's simpler to implement. Horizontal scaling adds complexity but may be necessary for high-traffic applications.

Testing the Configuration

Performance benchmarks show that properly tuned lynis can handle significantly more concurrent connections than the default configuration. The key improvements come from adjusting worker processes and connection pooling.

# Firewall rules for security
sudo ufw allow ssh
sudo ufw allow http
sudo ufw allow https
sudo ufw enable
sudo ufw status verbose

Each line in the configuration serves a specific purpose. The comments explain the reasoning behind each setting, making it easier to customize for your specific use case.

Common Issues and Solutions

• Slow performance: Check for disk I/O bottlenecks with iostat -x 1 and network issues with mtr. Review application logs for slow queries or requests.
• High memory usage: Review the configuration for memory-related settings. Reduce worker counts or buffer sizes if running on a low-RAM VPS.
• Service won't start: Check the logs with journalctl -xe -u lynis. Common causes include port conflicts, missing configuration files, or insufficient permissions.

Next Steps

With lynis now set up and running, consider implementing monitoring to track performance metrics over time. Regularly review your configuration as your workload changes and scale resources accordingly.