A fresh server is rarely as locked down as it should be: password logins are on, nothing blocks someone guessing them, there's no firewall, security updates wait for someone to remember them. The OS hardening tab audits the server with Lynis, shows its score from 0 to 100, and lists everything Lynis found — exactly as Lynis reports it.
First time: install the auditor
Scans use Lynis, a free, widely used security auditor made by CISOfy.
Click Install Lynis 3.1.7 once per server. The panel downloads the official
release from downloads.cisofy.com and checks it against a known fingerprint
before installing it in /opt/dcp-lynis, so the server needs HTTPS access to
the internet. It uses no resources until you scan.
The panel always uses Lynis 3.1.7 — on every server, the same version — so
results read the same everywhere and from one month to the next. It doesn't
use your distribution's lynis package or a newer release. If a server
already has another Lynis (for example a distro package), the tab says so and
won't scan with it: click Uninstall at the top right, then
Install Lynis 3.1.7.
Installing and uninstalling need an Operator, Admin or Owner. The server login needs root or passwordless sudo — without it, Lynis can't read most of what it checks.
Run a scan
Click Scan now. Lynis checks a few hundred things — SSH, the firewall, updates, the kernel, logins, file permissions, logging, malware scanners — and the progress bar follows it section by section. It usually takes one to three minutes and runs at low priority. A scan only reads: nothing on the server changes. You can leave the tab; the result is saved and opens here next time.
Every role can scan and read results, so a Viewer can check a server too.
Reading the result
- The hardening index (0–100) is Lynis's own score. Green from 80, amber from 65, red below. Next to it, a small line shows how it moved over your last scans. Most fresh cloud servers start between 55 and 65.
- Warnings and suggestions counts. These are Lynis's own two kinds: a warning is something Lynis found wrong, a suggestion something that could be better. The panel adds no grading of its own.
- Since the scan before: how many findings are new, and which ones are gone. Click N fixed to see them — handy proof of work for a client.
- Warnings and Suggestions sections. Each finding shows its Lynis test
id (for example
SSH-7408), Lynis's text and details, the current and preferred setting where Lynis gives one, Lynis's own solution, and a link to CISOfy's page about the check.
AI explain
AI explain on a finding asks the chatbot about it straight away. The chat opens in the split view on the right (or, if it's already open there, starts a new chat) and sends a question with the server's details and the Lynis finding, asking:
- what the finding means and why Lynis flags it,
- how to fix it, step by step, after checking the current setting,
- what the fix could affect (apps, users, logins) and how to undo it.
The chatbot only reads until you ask it to change something. On a phone the chat opens full screen instead.
Fixing through the chatbot
In Execute mode, after you say Yes on its approval card, the chatbot can apply the panel's tested fixes: Harden SSH, turn on the firewall, automatic security updates, kernel settings, disable core dumps, login banner, security tools and blocking unused kernel modules. Each shows exactly what it will change before you approve.
Harden SSH and Turn on the firewall decide who can log in, so they come with an automatic undo: the server sets a 3-minute timer that puts everything back, the panel opens a brand-new connection, and only if that works is the timer cancelled. If it fails — or the panel loses contact — the server undoes the change by itself.
Some things Lynis suggests break real servers, and the chatbot won't apply them: turning off packet forwarding (Docker and VPNs need it), strict reverse-path filtering, locking kernel modules until reboot, changing the SSH port, and turning off SSH tunnels or extra sessions (the panel and tools like VS Code use them). Change these by hand if you're sure.
Ignoring a finding
Some findings don't apply to you: a database port that only your other server can reach, for example. Click Ignore, say why (your team sees the reason), and choose this server or every server in the project. Ignored findings stay in their section, greyed out at the bottom, and don't count in the warning and suggestion numbers. Stop ignoring brings one back. The hardening index is Lynis's and doesn't change.
On the Servers page
The table on the Servers page has an OS hardening score column: the server's latest score, or a red 0/100 if it has never been scanned (Lynis isn't installed yet). Click it to open the server on this tab. Scanned servers also show Hardening 72/100 on their card.
Every week, by email
The ready-made Server hardening baseline agent rescans every server each Tuesday and emails a report: each server's index and how it moved, and Lynis's warnings with the panel's fixes. Turn it on under Agents in the sidebar.
Good to know
- Results are kept for the last 30 scans per server. Uninstalling Lynis keeps them.
- A scan writes only a temporary report in
/var/tmp/dcp-hardening, which the panel reads and deletes. Lynis's log goes there too, not to/var/log. - Every install, uninstall, scan and fix appears in the server's Activity log, including whether a fix was kept or undone.
- This is an automated review, not a penetration test or a certification.