Lynis vs OpenSCAP

Lynis performs security health scans to support system hardening and compliance testing on Linux, macOS, and Unix-based systems. Its stated uses also include security auditing, penetration testing, and vulnerability detection, for audiences such as developers, system administrators, IT auditors, and penetration testers. The tool checks components and tools found on each system through modular, opportunistic scans and is described as having almost no dependencies. It includes 300+ built-in tests and allows custom tests. Results appear on screen; technical details go to a log file, while warnings and suggestions are kept in a separate report. Lynis can help test security practices associated with CIS benchmarks, NIST, NSA, OpenSCAP data, and vendor guides. Listed systems include AIX, FreeBSD, HP-UX, Linux, macOS, NetBSD, NixOS, OpenBSD, and Solaris, along with Raspberry Pi, IoT, and QNAP devices. The free GPLv3 version costs nothing and comes without warranties or support. Lynis Enterprise SaaS is listed at $36 a year per system, billed annually; self-hosted Enterprise pricing is by quote.

OpenSCAP is a free collection of open-source tools for applying and enforcing the Security Content Automation Protocol (SCAP) standard. It provides customizable policies for security compliance and automated vulnerability assessment. OpenSCAP Base includes a library and the oscap command-line tool for parsing and evaluating SCAP content, scanning systems and producing documents. It supports XCCDF benchmarks and OVAL definitions, with SCAP 1.2 support and backward compatibility for SCAP 1.1 and 1.0. SCAP Workbench can tailor content, run local or remote scans, and export results; OpenSCAP Daemon schedules assessments of machines and containers. Policy variables and rules can be changed, and customized policies saved separately for reuse. Integrations listed include Red Hat Satellite, RH Access Insights, Preupgrade Assistant and orcharhino. With Red Hat Satellite 6, the site describes centralized policy management, scheduled audits and audit-result collection and search. OpenSCAP Base is available on Linux distributions including Red Hat Enterprise Linux, Fedora and Ubuntu; the project also reports Windows support since version 1.3.0. Policies may include automated remediation, but some rules cannot be remediated automatically, and remediation may disrupt infrastructure functionality.