Example lynis run: docker run --rm ubuntu:14.04 sh -c 'apt-get install -y lynis && lynis --quick --no-colors 2>&1'

lynis.txt

Reading package lists...
Building dependency tree...
Reading state information...
The following extra packages will be installed:
  menu
Suggested packages:
  dnsutils menu-l10n gksu kdebase-bin kdebase-runtime ktsuss sux
The following NEW packages will be installed:
  lynis menu
0 upgraded, 2 newly installed, 0 to remove and 24 not upgraded.
Need to get 550 kB of archives.
After this operation, 2526 kB of additional disk space will be used.
Get:1 http://archive.ubuntu.com/ubuntu/ trusty/universe lynis all 1.3.9-1 [95.0 kB]
Get:2 http://archive.ubuntu.com/ubuntu/ trusty/universe menu amd64 2.1.46ubuntu1 [455 kB]
Fetched 550 kB in 1s (423 kB/s)
Selecting previously unselected package lynis.
(Reading database ... 11518 files and directories currently installed.)
Preparing to unpack .../archives/lynis_1.3.9-1_all.deb ...
Unpacking lynis (1.3.9-1) ...
Selecting previously unselected package menu.
Preparing to unpack .../menu_2.1.46ubuntu1_amd64.deb ...
Unpacking menu (2.1.46ubuntu1) ...
Processing triggers for mime-support (3.54ubuntu1) ...
Setting up lynis (1.3.9-1) ...
Checking for unneeded old plugin files in /etc/lynis/plugins
Setting up menu (2.1.46ubuntu1) ...
Processing triggers for menu (2.1.46ubuntu1) ...

[ Lynis 1.3.9 ]

################################################################################
 Lynis comes with ABSOLUTELY NO WARRANTY. This is free software, and you are
 welcome to redistribute it under the terms of the GNU General Public License.
 See the LICENSE file for details about using this software.

 Copyright 2007-2014 - Michael Boelen, http://cisofy.com
 Enterprise support and plugins available via CISOfy - http://cisofy.com
################################################################################

[+] Initializing program
------------------------------------
- Detecting OS...  [ DONE ]
- Clearing log file (/var/log/lynis.log)...  [ DONE ]

  ---------------------------------------------------
  Program version:           1.3.9
  Operating system:          Linux
  Operating system name:     Ubuntu
  Operating system version:  14.04
  Kernel version:            3.16.1-1-ARCH
  Hardware platform:         x86_64
  Hostname:                  10984a62183f
  Auditor:                   [Unknown]
  Profile:                   /etc/lynis/default.prf
  Log file:                  /var/log/lynis.log
  Report file:               /var/log/lynis-report.dat
  Report version:            1.0
  ---------------------------------------------------
- Checking profile file (/etc/lynis/default.prf)...
- Program update status...  [ SKIPPED ]

[+] System Tools
------------------------------------
- Scanning available tools...
- Checking system binaries...
- Checking /bin...  [ FOUND ]
- Checking /sbin...  [ FOUND ]
- Checking /usr/bin...  [ FOUND ]
-i used with no filenames on the command line, reading from STDIN.
- Checking /usr/sbin...  [ FOUND ]
- Checking /usr/local/bin...  [ FOUND ]
- Checking /usr/local/sbin...  [ FOUND ]
- Checking /usr/local/libexec...  [ NOT FOUND ]
- Checking /usr/libexec...  [ NOT FOUND ]
- Checking /usr/sfw/bin...  [ NOT FOUND ]
- Checking /usr/sfw/sbin...  [ NOT FOUND ]
- Checking /usr/sfw/libexec...  [ NOT FOUND ]
- Checking /opt/sfw/bin...  [ NOT FOUND ]
- Checking /opt/sfw/sbin...  [ NOT FOUND ]
- Checking /opt/sfw/libexec...  [ NOT FOUND ]
- Checking /usr/xpg4/bin...  [ NOT FOUND ]
- Checking /usr/css/bin...  [ NOT FOUND ]
- Checking /usr/ucb...  [ NOT FOUND ]
- Checking /usr/X11R6/bin...  [ NOT FOUND ]

[+] Boot and services
------------------------------------
- Checking boot loaders
- Checking presence GRUB...  [ NOT FOUND ]
- Checking presence LILO...  [ NOT FOUND ]
- Checking boot loader SILO [ NOT FOUND ]
- Checking boot loader YABOOT [ NOT FOUND ]
- Check startup files (permissions)...  [ OK ]

[+] Kernel
------------------------------------
- Checking default run level... [ UNKNOWN ]
- Checking CPU support (NX/PAE)
CPU support: PAE and/or NoeXecute supported [ FOUND ]
- Checking kernel version and release [ DONE ]
- Checking kernel type [ DONE ]
- Checking loaded kernel modules [ DONE ]
Found 178 active modules
- Checking Linux kernel configuration file... [ NOT FOUND ]
dpkg-query: no path found matching pattern /vmlinuz
- Checking for available kernel update...  [ UNKNOWN ]
- Checking core dumps configuration...  [ DISABLED ]
- Checking setuid core dumps configuration...  [ DEFAULT ]

[+] Memory and processes
------------------------------------
- Checking /proc/meminfo...  [ FOUND ]
- Searching for dead/zombie processes... [ OK ]
- Searching for IO waiting processes... [ OK ]

[+] Users, Groups and Authentication
------------------------------------
- Search administrator accounts... [ OK ]
- Checking consistency of group files (grpck)... [ OK ]
- Checking non unique group ID's... [ OK ]
- Checking non unique group names... [ OK ]
- Checking password file consistency... [ OK ]
- Query system users (non daemons)... [ DONE ]
- Checking NIS+ authentication support [ NOT ENABLED ]
- Checking NIS authentication support [ NOT ENABLED ]
- Checking sudoers file [ FOUND ]
- Check sudoers file permissions [ OK ]
- Checking PAM password strength tools [ SUGGESTION ]
- Checking PAM configuration files (pam.conf) [ FOUND ]
- Checking PAM configuration files (pam.d) [ FOUND ]
- Checking PAM modules [ FOUND ]
- Checking LDAP module in PAM [ NOT FOUND ]
- Checking accounts without expire date [ OK ]
- Checking accounts without password [ OK ]
- Checking user password aging [ DISABLED ]
- Determining default umask
- Checking umask (/etc/profile) [ UNKNOWN ]
- Checking umask (/etc/login.defs) [ SUGGESTION ]
- Checking umask (/etc/init.d/rc) [ SUGGESTION ]
- Checking LDAP authentication support [ NOT ENABLED ]

[+] Shells
------------------------------------
- Checking shells from /etc/shells...
Result: found 4 shells (valid shells: 4).

[+] File systems
------------------------------------
- Checking mount points
- Checking /home mount point... [ SUGGESTION ]
- Checking /tmp mount point... [ SUGGESTION ]
- Checking for old files in /tmp... [ OK ]
- Checking /tmp sticky bit... [ OK ]
tune2fs: No such file or directory while trying to open /dev/sda4
Couldn't find valid filesystem superblock.
- ACL support root file system... [ DISABLED ]
- Checking Locate database... [ NOT FOUND ]

[+] Storage
------------------------------------
- Checking usb-storage driver (modprobe config)... [ NOT DISABLED ]
- Checking firewire ohci driver (modprobe config)... [ DISABLED ]

[+] NFS
------------------------------------
- Check running NFS daemon... [ NOT FOUND ]

[+] Software: name services
------------------------------------
- Checking default DNS search domain... [ NONE ]
- Checking search domains... [ FOUND ]
- Checking /etc/resolv.conf options... [ NONE ]
- Searching DNS domain name... [ UNKNOWN ]
- Checking nscd status... [ NOT FOUND ]
- Checking BIND status... [ NOT FOUND ]
- Checking PowerDNS status... [ NOT FOUND ]
- Checking ypbind status... [ NOT FOUND ]
- Checking /etc/hosts
- Checking /etc/hosts (duplicates) [ OK ]
- Checking /etc/hosts (hostname) [ OK ]
- Checking /etc/hosts (localhost) [ OK ]

[+] Ports and packages
------------------------------------
- Searching package managers...
- Searching dpkg package manager... [ FOUND ]
- Querying package manager...
- Query unpurged packages... [ NONE ]
- Checking security repository in sources.list file...  [ OK ]
- Checking APT package database... [ OK ]
- Checking vulnerable packages (apt-get only)... [ DONE ]
- Checking upgradeable packages... [ SKIPPED ]
- Checking package audit tool... [ NONE ]

[+] Networking
------------------------------------
- Checking configured nameservers...
- Testing nameservers...
Nameserver: 172.17.42.1...  [ SKIPPED ]
- Minimal of 2 responsive nameservers... [ SKIPPED ]
- Checking default gateway... [ DONE ]
- Getting listening ports (TCP/UDP)... [ SKIPPED ]
- Checking promiscuous interfaces... [ OK ]
- Checking waiting connections... [ OK ]
- Checking status DHCP client... [ NOT ACTIVE ]

[+] Printers and Spools
------------------------------------
- Checking cups daemon... [ NOT FOUND ]

[+] Software: e-mail and messaging
------------------------------------
- Checking Exim status... [ NOT FOUND ]
- Checking Postfix status... [ NOT FOUND ]
- Checking Qmail smtpd status... [ NOT FOUND ]

[+] Software: firewalls
------------------------------------
- Checking iptables kernel module [ FOUND ]
Status pf [ NOT FOUND ]
- Checking host based firewall [ ACTIVE ]

[+] Software: webserver
------------------------------------
- Checking Apache... [ NOT FOUND ]
- Checking nginx... [ NOT FOUND ]

[+] SSH Support
------------------------------------
- Checking running SSH daemon... [ NOT FOUND ]

[+] SNMP Support
------------------------------------
- Checking running SNMP daemon... [ NOT FOUND ]

[+] Databases
------------------------------------
- MySQL process status... [ NOT FOUND ]
- PostgreSQL processes status... [ NOT FOUND ]
- Oracle processes status... [ NOT FOUND ]

[+] LDAP Services
------------------------------------
- Checking OpenLDAP instance... [ NOT FOUND ]

[+] Software: PHP
------------------------------------
- Checking PHP... [ NOT FOUND ]

[+] Squid Support
------------------------------------
- Checking running Squid daemon... [ NOT FOUND ]

[+] Logging and files
------------------------------------
- Checking for a running log daemon... [ WARNING ]
- Checking Syslog-NG status [ NOT FOUND ]
- Checking Metalog status [ NOT FOUND ]
- Checking RSyslog status [ NOT FOUND ]
- Checking RFC 3195 daemon status [ NOT FOUND ]
- Checking klogd [ OK ]
- Checking minilogd instances [ NONE ]
- Checking logrotate presence [ OK ]
- Checking log directories (static list) [ DONE ]
- Checking open log files [ SKIPPED ]

[+] Insecure services
------------------------------------
- Checking inetd status... [ NOT ACTIVE ]

[+] Banners and identification
------------------------------------
- /etc/motd... [ NOT FOUND ]
- /etc/issue... [ FOUND ]
- /etc/issue contents... [ WEAK ]
- /etc/issue.net... [ FOUND ]
- /etc/issue.net contents... [ WEAK ]

[+] Scheduled tasks
------------------------------------
- Checking crontab/cronjob [ DONE ]
- Checking atd status [ NOT RUNNING ]

[+] Accounting
------------------------------------
- Checking accounting information...  [ NOT FOUND ]
- Checking auditd [ NOT FOUND ]

[+] Time and Synchronization
------------------------------------
- Checking running NTP daemon (ntpd)... [ NOT FOUND ]
- Checking running NTP daemon (timed)... [ NOT FOUND ]
- Checking running NTP daemon (dntpd)... [ NOT FOUND ]
- Checking NTP client in crontab file (/etc/crontab)... [ NOT FOUND ]
- Checking NTP client in cron.d files... [ NOT FOUND ]
- Checking event based ntpdate (if-up)... [ FOUND ]
- Checking for a running NTP daemon or client... [ OK ]

[+] Cryptography
------------------------------------

[+] Virtualization
------------------------------------

[+] Security frameworks
------------------------------------
- Checking presence AppArmor [ NOT FOUND ]
- Checking presence SELinux [ NOT FOUND ]
- Checking presence grsecurity [ NOT FOUND ]
- Checking for implemented MAC framework [ NONE ]

[+] Software: file integrity
------------------------------------
- Checking file integrity tools...
- AFICK... [ NOT FOUND ]
- AIDE... [ NOT FOUND ]
- Osiris... [ NOT FOUND ]
- Samhain... [ NOT FOUND ]
- Tripwire... [ NOT FOUND ]
- OSSEC (syscheck)... [ NOT FOUND ]
- Checking presence integrity tool... [ NOT FOUND ]

[+] Software: Malware scanners
------------------------------------
- Checking chkrootkit... [ NOT FOUND ]
- Checking Rootkit Hunter... [ NOT FOUND ]
- Checking ClamAV scanner... [ NOT FOUND ]
- Checking ClamAV daemon... [ NOT FOUND ]

[+] System Tools
------------------------------------
- Starting file permissions check...
/etc/lilo.conf [ NOT FOUND ]
/root/.ssh [ NOT FOUND ]

[+] Home directories
------------------------------------
- Checking shell history files...  [ OK ]

[+] Kernel Hardening
------------------------------------
- Comparing sysctl key pairs with scan profile...
- kernel.core_uses_pid (exp: 1) [ OK ]
- kernel.ctrl-alt-del (exp: 0) [ OK ]
- kernel.sysrq (exp: 0) [ DIFFERENT ]
- net.ipv4.conf.all.accept_redirects (exp: 0) [ OK ]
- net.ipv4.conf.all.accept_source_route (exp: 0) [ OK ]
- net.ipv4.conf.all.bootp_relay (exp: 0) [ OK ]
- net.ipv4.conf.all.forwarding (exp: 0) [ DIFFERENT ]
- net.ipv4.conf.all.log_martians (exp: 1) [ DIFFERENT ]
- net.ipv4.conf.all.mc_forwarding (exp: 0) [ OK ]
- net.ipv4.conf.all.proxy_arp (exp: 0) [ OK ]
- net.ipv4.conf.all.rp_filter (exp: 1) [ DIFFERENT ]
- net.ipv4.conf.all.send_redirects (exp: 0) [ DIFFERENT ]
- net.ipv4.conf.default.accept_redirects (exp: 0) [ DIFFERENT ]
- net.ipv4.conf.default.accept_source_route (exp: 0) [ OK ]
- net.ipv4.conf.default.log_martians (exp: 1) [ DIFFERENT ]
- net.ipv4.icmp_echo_ignore_broadcasts (exp: 1) [ OK ]
- net.ipv4.icmp_ignore_bogus_error_responses (exp: 1) [ OK ]
- net.ipv6.conf.all.accept_redirects (exp: 0) [ DIFFERENT ]
- net.ipv6.conf.all.accept_source_route (exp: 0) [ OK ]
- net.ipv6.conf.default.accept_redirects (exp: 0) [ DIFFERENT ]
- net.ipv6.conf.default.accept_source_route (exp: 0) [ OK ]

[+] Hardening
------------------------------------
- Installed compiler(s)... [ NOT FOUND ]
- Installed malware scanner... [ NOT FOUND ]

[+] Custom Tests
------------------------------------
- Running custom tests...  [ SKIPPED ]

================================================================================

  -[ Lynis 1.3.9 Results ]-

  Tests performed: 144

  Warnings:
  ----------------------------
  - No syslog daemon found [test:LOGG-2130]
  - klogd is not running, which could lead to missing kernel messages in log files [test:LOGG-2138]

  Suggestions:
  ----------------------------
  - Please check the output of apt-cache policy manually to determine why output is empty [test:KRNL-5788]
  - Install a PAM module for password strength testing like pam_cracklib or pam_passwdqc [test:AUTH-9262]
  - Configure password aging limits to enforce password changing on a regular base [test:AUTH-9286]
  - Default umask in /etc/login.defs could be more strict like 027 [test:AUTH-9328]
  - Default umask in /etc/init.d/rc could be more strict like 027 [test:AUTH-9328]
  - To decrease the impact of a full /home file system, place /home on a separated partition [test:FILE-6310]
  - To decrease the impact of a full /tmp file system, place /tmp on a separated partition [test:FILE-6310]
  - The database required for 'locate' could not be found. Run 'updatedb' or 'locate.updatedb' to create this file. [test:FILE-6410]
  - Disable drivers like USB storage when not used, to prevent unauthorized storage or data theft [test:STRG-1840]
  - Install package apt-show-versions for patch management purposes [test:PKGS-7394]
  - Install a package audit tool to determine vulnerable packages [test:PKGS-7398]
  - Check if any syslog daemon is running and correctly configured. [test:LOGG-2130]
  - Check why klogd is not running [test:LOGG-2138]
  - Add a legal banner to /etc/issue, to warn unauthorized users [test:BANN-7126]
  - Add legal banner to /etc/issue.net, to warn unauthorized users [test:BANN-7130]
  - Enable auditd to collect audit information [test:ACCT-9628]
  - Install a file integrity tool [test:FINT-4350]
  - One or more sysctl values differ from the scan profile and could be tweaked [test:KRNL-6000]
  - Harden the system by installing one or malware scanners to perform periodic file system scans [test:HRDN-7230]
================================================================================
  Files:
  - Test and debug information      : /var/log/lynis.log
  - Report data                     : /var/log/lynis-report.dat
================================================================================
  Hardening index : [57]     [###########         ]

  Enterprise support and plugins available via CISOfy - http://cisofy.com
================================================================================
  Tip: Disable all tests which are not relevant or are too strict for the
       purpose of this particular machine. This will remove unwanted suggestions
       and also boost the hardening index. Each test should be properly analyzed
       to see if the related risks can be accepted, before disabling the test.
================================================================================
  Lynis 1.3.9
  Copyright 2007-2014 - Michael Boelen, http://cisofy.com
================================================================================