Labs · Cyber Security

Lab: Audit Your Own Linux VM with Lynis, Rank the Findings by Risk and Plan the Fixes

By Ravindra Bagale · Last updated: 8 October 2026

Suppose we are…

Suppose we are a junior in the vulnerability management team at Infosys. A client asks: "Our Linux servers passed the network scan, but are they configured safely inside?" We run Lynis (a free, open-source tool that audits a Linux system's own settings) on a test server, rank the results, and give the client a fix plan, starting with the highest risk.

Goal of this lab

By the end you will have:

• A Lynis audit of your own VM with its hardening index (a score out of 100).
• Warnings and suggestions sorted into Fix now / Fix this month / Accept with a reason.
• Two fixes applied and a second audit showing a higher score.

What you need (all free)

• Your own Ubuntu Server VM (Lab 17 plan) or your Kali VM. For installing packages, the VM can be on NAT for a few minutes; do not do this with Metasploitable.
• 40–45 minutes.

Steps

1. On your Ubuntu VM, update and install Lynis:

   sudo apt update
   sudo apt install -y lynis
   lynis show version
   

2. Run the audit (--quick means do not pause between sections):

   sudo lynis audit system --quick
   

   👁 What you should see: many coloured [ OK ], [ WARNING ] and [ SUGGESTION ] lines, and at the end a block like Hardening index : 62 [############ ].

3. Write down the hardening index and the numbers of Warnings and Suggestions.

4. Read the findings from the report file, which is easier than scrolling:

   sudo grep -E "^warning\[\]|^suggestion\[\]" /var/log/lynis-report.dat | head -n 40
   

   👁 What you should see: lines such as suggestion[]=SSH-7408|Consider hardening SSH configuration|MaxAuthTries (6 --> 3)|... and warning[]=PKGS-7392|Found one or more vulnerable packages.|.... The code before | is the test ID.

5. Check how many packages have updates (often the biggest risk):

   apt list --upgradable 2>/dev/null | wc -l
   

6. Rank the findings. Make a table with Test ID, Finding, Risk (High/Medium/Low), Plan. Rule of thumb: missing security updates and remote-login weaknesses (SSH) are High; local hardening such as file permissions or banners is Medium/Low.

7. Fix 1, security updates:

   sudo apt upgrade -y
   sudo apt install -y unattended-upgrades
   

8. Fix 2, SSH hardening with a separate drop-in file:

   echo -e "MaxAuthTries 3\nPermitRootLogin no\nX11Forwarding no" | sudo tee /etc/ssh/sshd_config.d/99-lab-hardening.conf
   sudo sshd -t && sudo systemctl reload ssh
   

   sshd -t tests the config first, just like nginx -t.

9. Run the audit again and compare:

   sudo lynis audit system --quick | grep -A1 "Hardening index"
   

   👁 What you should see: a higher hardening index than in step 3, and SSH-7408 no longer suggesting MaxAuthTries.

10. Finish your plan: for each remaining High and Medium item write who fixes it and by when. Items you decide not to fix go under Accept with a reason (for example, "no USB on a VM").

Common mistakes

Self-check checklist

Try-at-home challenge

Pick one finding you marked Medium and research its test ID with lynis show details <TEST-ID>. Write the fix, apply it, and confirm the suggestion disappears.

Samjla ka? Audit, rank, fix the high risks first, and re-run to prove it. Aata pudhe jaauya: Chapter 21 looks at web application testing tools.