# My yearly Lynis check **URL:** \ **Category:** Applications\ **Created:** [June 3, 2026, 1:13am UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975 "2026-06-03T01:13:39Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![drunkenvicar](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/drunkenvicar/32/112222_2.png) [@drunkenvicar](https://forum.endeavouros.com/u/drunkenvicar)\ **Post date:** [June 3, 2026, 1:13am UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975/1 "2026-06-03T01:13:39Z")
(installed from /extra) I was squeamish about being pwned after my password was continually rejected today in terminal. It worked for mounting drives and gparted. Same time too so not a caps lock things. Eventually it worked after continuous lockouts. \*\*WTF??? [\*\*no I did not start a thread for this but read some old ones]. To the point: eos Cinnamon passed with flying colors: “no malicious software” Like Lynis it offered 100 suggestions like - ```auto If not required, consider explicit disabling of core dump in /etc/security/limits.conf file [KRNL-5820] Related resources Article: Understand and configure core dumps on Linux: https://linux-audit.com/software/understand-and-configure-core-dumps-work-on-linux/ Website: https://cisofy.com/lynis/controls/KRNL-5820/ ``` Like I can do any of that 🙄 sober.. Had plenty of red boxes but none worrisome. Only worried about these two: ![2](https://forum.endeavouros.com/uploads/default/original/3X/8/1/812dc949e2354d8ca2924f12fc31eefae3345d70.png) this means almost nothing, right? if I wanted a cve tool I should get it myself? Is that what I’m seeing? also in the kernel section a lot of “different” than expected which seems harmless: ![diff](https://forum.endeavouros.com/uploads/default/original/3X/b/e/beccf93425a132806f50360cf72548e98a588a12.png) Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS ---
**Author:** ![Biotico1974](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/biotico1974/32/101999_2.png) [@Biotico1974](https://forum.endeavouros.com/u/Biotico1974)\ **Post date:** [June 3, 2026, 6:17am UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975/2 "2026-06-03T06:17:32Z")
> [@drunkenvicar](#): > > Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS I use a conjunction of lynis and [rkhunter](https://www.rkhunter.dev/) for security assessment on my systems for better results. ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [June 21, 2026, 3:20pm UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975/3 "2026-06-21T15:20:16Z")
> [@drunkenvicar](#): > > (installed from /extra) > Only worried about these two: > > ![2](https://forum.endeavouros.com/uploads/default/original/3X/8/1/812dc949e2354d8ca2924f12fc31eefae3345d70.png) > > this means almost nothing, right? if I wanted a cve tool I should get it myself? Is that what I’m seeing? About the **package audit tool** , it is looking for `auditd` or equivalent to be installed. That will help to determine which application and which package had done what. Please do note that `auditd` will create humongous log files inside the directory `/var/log/audit`. One has to be proficient in understanding the audit log files created by `auditd`. It is a good to have. If you are running a server, a definite/mandatory yes. If running a desktop, then yes would be good to have. Recommendation is to have it. > [@drunkenvicar](#): > > also in the kernel section a lot of “different” than expected which seems harmless: > > ![diff](https://forum.endeavouros.com/uploads/default/original/3X/b/e/beccf93425a132806f50360cf72548e98a588a12.png) > > Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS These are kernel hardening parameters. With the expected value, i.e. `exp`. @drunkenvicar in the lynis log file, typically `$HOME/lynis.log` or `/var/log/lynis.log`, what is the value of “ **Hardening index :** ” and **Hardening strength:** that you see? > [@Biotico1974](#): > > > [@drunkenvicar](#): > > > > Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS > > I use a conjunction of lynis and [rkhunter](https://www.rkhunter.dev/) for security assessment on my systems for better results. The package `rkhunter` in Arch repos point to [https://rkhunter.sourceforge.net/](https://rkhunter.sourceforge.net/) which has not been updated since 2018/19. The github repo for [rkhunter](https://www.rkhunter.dev/) has not been updated for the past 9 years. Is `rkhunter` still relevant and usefull? ---
**Author:** ![swh](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/swh/32/95303_2.png) [@swh](https://forum.endeavouros.com/u/swh)\ **Post date:** [June 21, 2026, 3:52pm UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975/4 "2026-06-21T15:52:07Z")
```auto -[Lynis 3.1.6 Results]- Great, no warnings ``` ```auto Lynis security scan details: Scan mode: Normal [] Forensics [] Integration [] Pentest [▆] (running non-privileged) Lynis modules: - Compliance status [?] - Security audit [V] - Vulnerability scan [V] Details: Hardening index : 64 [############] Tests performed : 233 Plugins enabled : 0 Software components: - Firewall [V] - Intrusion software [X] - Malware scanner [V] Files: - Test and debug information : /home/swh/lynis.log - Report data : /home/swh/lynis-report.dat ``` There’s always room for improvement. I need to sit down and try to understand these results. ---
**Author:** ![drunkenvicar](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/drunkenvicar/32/112222_2.png) [@drunkenvicar](https://forum.endeavouros.com/u/drunkenvicar)\ **Post date:** [June 21, 2026, 4:00pm UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975/5 "2026-06-21T16:00:04Z")
thanks for filling in the gaps, Archie > [@swh](#): > > There’s always room for improvement. I need to sit down and try to understand these results. I’ve done that a time or too–the understanding part. I like their suggestions. Someday I’ll take them. It’s tempting to want an gov-level hardened machine…I wonder at what cost that comes at? Linux Smarties always preach “assess your attack vector”–well I assessed mine and it’s boring. I like that audit tool, though. ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [June 21, 2026, 4:10pm UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975/6 "2026-06-21T16:10:55Z")
@drunkenvicar What is the value of “ **Hardening index :** ” and **Hardening strength:** in your case? ---
**Author:** ![drunkenvicar](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/drunkenvicar/32/112222_2.png) [@drunkenvicar](https://forum.endeavouros.com/u/drunkenvicar)\ **Post date:** [June 21, 2026, 5:21pm UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975/7 "2026-06-21T17:21:05Z")
for my 6/2 scan: 2026-06-02 17:55:05 Hardening index : [61] [############] 2026-06-02 17:55:05 Hardening strength: System has been hardened, but could use additional hardening guessing I’m above average but not what they consider optimal (perhaps) ---
**Author:** ![Biotico1974](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/biotico1974/32/101999_2.png) [@Biotico1974](https://forum.endeavouros.com/u/Biotico1974)\ **Post date:** [June 21, 2026, 5:49pm UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975/8 "2026-06-21T17:49:25Z")
> [@Archie1](#): > > > [@Biotico1974](#): > > > > > [@drunkenvicar](#): > > > > > > Except for the 100 suggestions, I passed, I think, with flying colors. Thanks EOS > > > > I use a conjunction of lynis and [rkhunter](https://www.rkhunter.dev/) for security assessment on my systems for better results. > > The package `rkhunter` in Arch repos point to [https://rkhunter.sourceforge.net/](https://rkhunter.sourceforge.net/) which has not been updated since 2018/19. The github repo for [rkhunter](https://www.rkhunter.dev/) has not been updated for the past 9 years. Is `rkhunter` still relevant and usefull? Not by itself, but it can still detect: - File property checks. - Detection of hidden files. - Checks for suspicious permissions. - Verification of some system binaries. - Warnings about unusual system configurations. That’s why I use it in conjunction with other tools: - Clamav - Lynis - Opensnitch - Picosnitch ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [June 22, 2026, 12:46pm UTC](https://forum.endeavouros.com/t/my-yearly-lynis-check/79975/9 "2026-06-22T12:46:24Z")
I wonder what is the maximum hardening score according to lynis? And will there be a usable desktop arch if the maximum hardening score is achieved?