Last updated: March 22, 2026

Interpreting the Lynis Report for Remediation Priority

The Lynis report file is tab-separated and machine-parseable. A score of 80+ is achievable on most servers within a few hours of remediation. but not all suggestions have equal impact on your actual security posture.

Prioritize in this order:

Priority Test Type Examples Impact
1 Warnings (red) Open world-readable sensitive files, root SSH enabled High. active risk
2 Authentication tests Weak password policy, no account lockout High. attack vector
3 SSH hardening Weak ciphers, forwarding enabled Medium. reduces attack surface
4 Kernel hardening Missing sysctl settings Medium. defense in depth
5 Suggestions (yellow) Missing auditing, unused services Low. incremental improvement

Track your improvement over time by saving the score after each remediation pass:

Quick score check without running a full audit
grep "^hardening_index=" /var/log/lynis-report.dat

Score trend from multiple reports
for report in /var/log/lynis/report-*.dat; do
    date=$(basename "$report" | grep -oE '[0-9]{4}-[0-9]{2}-[0-9]{2}')
    score=$(grep "^hardening_index=" "$report" | cut -d= -f2)
    echo "$date: $score"
done | sort

A realistic improvement path for a default Ubuntu server: 60 → 72 (SSH hardening + kernel params, 30 min) → 80 (password policy + file permissions, 1 hour) → 85+ (auditd + AppArmor profiles, 2-3 hours).

Related Articles