Lynis Plugins

Introduction into Lynis plugins.


Introduction into Plugins

Lynis is written in shell script, a versatile scripting language available on all systems running Linux or a UNIX-based operating system. For this reason, most system administrators can easily create their own tests for Lynis. This is useful when you want to write your own tests and plugins, or customizing functionality. In this document we have a look at how to create a plugin, with some custom tests in it.

Plugin Phases

Lynis runs each time a full cycle of steps. For plugins there are two moments when they can run, which we call phase 1 and phase 2. The complete cycle looks like this:

  1. Initialization
  2. OS detection
  3. Detection of binaries
  4. Plugins phase 1
  5. Run built-in tests
  6. Optional: run any custom tests
  7. Plugins phase 2
  8. Show report
  9. Terminate

Plugin Location

The first step is to know where Lynis is installed, and in particular in which directory your plugins are stored. This path is displayed on screen when running Lynis, and stored in your log file (usually /var/log/lynis.log).


grep -i plugin /var/log/lynis.log

Plugin Development

Custom plugins can be created by leveraging common shell scripting. This is useful when you want to create your own tests.

Plugins Development Guide