I wasn’t aware of Lynis until I started utilizing Archcanary. It got me thinking… I know it’s not necessary, but is it worth using? While some YouTube “tutorials” make it seem somewhat difficult to use, their Lynis Documentation page seems rather straightforward.
Lynis is actually designed for server systems. With a little tweaking, though, you can also harden desktop systems. It’s quite complex, though—you need to know what you’re doing. I’m getting a system that’s about 68–70% hardened.
I’m sure the experts here on the forum can tell you more about it.
Keep in mind why Lynis Exist. For servers. With that in mind you can use its suggestions to help secure your system a bit more depending on your actual usage
I see. For me, a typical Linux user browsing the web and doing video/image editing, this is probably not something I need, then.
You’re sure to learn a thing or two about your system. If securing your system is extremely important to you, install Lynis and get started with it.
Yes, to answer your question. It scans for malware and provides an audit with suggestions for hardening. I never take them because they are too tinfoil for me (very little out-tinfoils me 
) and I trust EOS, but it helps me understand best practices.
I audit twice a year and always get an education with it. Two cents.
I did consider to install it, but after reading this I conclude that I don’t really need it for my use case.
Fair question — short answer:
it’s optional, and worth it for a few specific things, not as a “get to zero warnings” checklist.
Lynis was built for server hardening, so a chunk of its suggestion count doesn’t apply to a single-user desktop (mail-relay ACLs, multi-user audit policy, rules for exposed network services). Skip those.
What does carry over to desktop:
kernel sysctl hardening (ASLR, kptr_restrict, ptrace_scope), file-permission audits (world-writable files, stray SUID/SGID binaries), a GRUB bootloader password (arguably more relevant on a laptop than a rack server — physical access is the bigger threat there), outdated/vulnerable packages, and PAM/login policy.
Archcanary includes it for that overlap — it’s genuinely a different security domain than what archcanary itself checks (AUR-malware/persistence-specific), not something worth reinventing when Lynis already does general hardening auditing well.
It’s fully optional though: --doctor marks it [OPT ] if it’s missing, not a warning, and nothing else in archcanary depends on it.
Install it if you want the general hardening picture; skip it if you just want the malware-detection side.