My yearly Lynis check

[drunkenvicar]

(installed from /extra)

I was squeamish about being pwned after my password was continually rejected today in terminal. It worked for mounting drives and gparted. Same time too so not a caps lock things. Eventually it worked after continuous lockouts. **WTF??? [**no I did not start a thread for this but read some old ones].

To the point: eos Cinnamon passed with flying colors: “no malicious software”

Like Lynis it offered 100 suggestions like

If not required, consider explicit disabling of core dump in /etc/security/limits.conf file [KRNL-5820]

Related resources

Article: Understand and configure core dumps on Linux: https://linux-audit.com/software/understand-and-configure-core-dumps-work-on-linux/

Website: https://cisofy.com/lynis/controls/KRNL-5820/

Like I can do any of that sober..

Had plenty of red boxes but none worrisome.

Only worried about these two:

this means almost nothing, right? if I wanted a cve tool I should get it myself? Is that what I’m seeing?

also in the kernel section a lot of “different” than expected which seems harmless:

Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS

[Biotico1974]

@drunkenvicar

Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS

I use a conjunction of lynis and rkhunter for security assessment on my systems for better results.

[Archie1]

@drunkenvicar

(installed from /extra)
Only worried about these two:

this means almost nothing, right? if I wanted a cve tool I should get it myself? Is that what I’m seeing?

About the package audit tool, it is looking for auditd or equivalent to be installed. That will help to determine which application and which package had done what. Please do note that auditd will create humongous log files inside the directory /var/log/audit. One has to be proficient in understanding the audit log files created by auditd.
It is a good to have. If you are running a server, a definite/mandatory yes. If running a desktop, then yes would be good to have. Recommendation is to have it.

@drunkenvicar

also in the kernel section a lot of “different” than expected which seems harmless:

Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS

These are kernel hardening parameters. With the expected value, i.e. exp.
@drunkenvicar in the lynis log file, typically $HOME/lynis.log or /var/log/lynis.log, what is the value of “Hardening index :” and Hardening strength: that you see?

@Biotico1974

@drunkenvicar

Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS

I use a conjunction of lynis and rkhunter for security assessment on my systems for better results.

The package rkhunter in Arch repos point to https://rkhunter.sourceforge.net/ which has not been updated since 2018/19. The github repo for rkhunter has not been updated for the past 9 years. Is rkhunter still relevant and usefull?

[swh]

-[ Lynis 3.1.6 Results ]-

  Great, no warnings

 Lynis security scan details:

  Scan mode:
  Normal [ ]  Forensics [ ]  Integration [ ]  Pentest [▆] (running non-privileged)

  Lynis modules:
  - Compliance status      [?]
  - Security audit         [V]
  - Vulnerability scan     [V]

  Details:
  Hardening index : 64 [############        ]
  Tests performed : 233
  Plugins enabled : 0

  Software components:
  - Firewall               [V]
  - Intrusion software     [X]
  - Malware scanner        [V]

  Files:
  - Test and debug information      : /home/swh/lynis.log
  - Report data                     : /home/swh/lynis-report.dat

There’s always room for improvement. I need to sit down and try to understand these results.

[drunkenvicar]

thanks for filling in the gaps, Archie

@swh

There’s always room for improvement. I need to sit down and try to understand these results.

I’ve done that a time or too–the understanding part. I like their suggestions. Someday I’ll take them. It’s tempting to want an gov-level hardened machine…I wonder at what cost that comes at? Linux Smarties always preach “assess your attack vector”–well I assessed mine and it’s boring.

I like that audit tool, though.

[Archie1]

@drunkenvicar What is the value of “Hardening index :” and Hardening strength: in your case?

[drunkenvicar]

for my 6/2 scan:

2026-06-02 17:55:05 Hardening index : [61] [############ ]
2026-06-02 17:55:05 Hardening strength: System has been hardened, but could use additional hardening

guessing I’m above average but not what they consider optimal (perhaps)

[Biotico1974]

@Archie1

@Biotico1974

@drunkenvicar

Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS

I use a conjunction of lynis and rkhunter for security assessment on my systems for better results.

The package rkhunter in Arch repos point to https://rkhunter.sourceforge.net/ which has not been updated since 2018/19. The github repo for rkhunter has not been updated for the past 9 years. Is rkhunter still relevant and usefull?

Not by itself, but it can still detect:

• File property checks.
• Detection of hidden files.
• Checks for suspicious permissions.
• Verification of some system binaries.
• Warnings about unusual system configurations.

That’s why I use it in conjunction with other tools:

• Clamav
• Lynis
• Opensnitch
• Picosnitch

[Archie1]

I wonder what is the maximum hardening score according to lynis? And will there be a usable desktop arch if the maximum hardening score is achieved?