Lynis audits general host hardening — SSH config, filesystem permissions, kernel settings, and dozens of other checks — and Reef enriches every result with a plain-language explanation instead of leaving you to decode a bare test ID.
Why it runs the way it does
Lynis audits whatever system it runs on and has no target flag, so scanning the host from inside a container takes a trick: the agent tars up a portable copy into the host’s mount namespace and runs it with nsenter -t 1 -m -u -i -n -p, giving it the real /proc, the host’s package manager, and the host’s services. This needs privileged + pid: host (already set in compose). It falls back to a local audit when REEF_SCAN_ROOT=/ or params.in_container is set.
Output mapping
warning[]→ medium/high findingssuggestion[]→ low findings
Each finding is enriched from a curated, offline knowledge base that maps a terse test ID like SSH-7408 to a plain-language what it means, why it matters, and how to fix it, a category, and the upstream docs link. Unmapped IDs still get a category (from the ID prefix) and the link.
Summary fields
The hardening index, audited_host / audited_os (so a container-vs-host
mix-up is visible at a glance), and explained — how many findings the
knowledge base was able to annotate.
Params
| Key | Default | Effect |
|---|---|---|
in_container |
false |
audit the agent container instead of the host — mainly useful for testing Reef itself |