Lynis audits general host hardening, including SSH configuration, file permissions, kernel settings, and dozens of other checks. Reef adds a plain-language explanation to every result, so you don’t have to look up bare test IDs.
Supports: NIST 800-53 CM-6 (Configuration Settings) and CM-7 (Least Functionality).
What you get
- Warnings become medium or high findings.
- Suggestions become low findings.
- The scan summary shows the host’s hardening index, which is a single score you can track over time.
Each finding explains what it means, why it matters, and how to fix it, along with a category and a link to the official Lynis documentation. For example, SSH-7408 becomes a readable description of the SSH setting that needs attention.
It audits the host, not the container
Lynis examines whatever system it runs on. Reef runs it directly against the host so that results reflect the host’s real services, packages, and settings. The scan summary shows the audited hostname and operating system, so you can confirm at a glance that the right system was checked.
Options
| Key | Default | Effect |
|---|---|---|
in_container |
false |
Audit the agent container instead of the host. This is mainly useful for testing. |