By hand, with Lynis, or with an app
Every guide on this site works without any app: they are the commands, with the reasons. So why use a tool at all? Here is an honest comparison of the three ways people secure their servers, and where each one falls short.
Published . Any Linux server you run yourself, such as Ubuntu, Debian or AlmaLinux.
By hand, with a checklist
You SSH in and work through a list: keys instead of passwords, a firewall that allows SSH first, fail2ban, automatic security updates, nothing listening that should not be. Our security checklist is a good start.
- Good: free, you learn how your server works, and you are in full control.
- Costs: time, every time, on every server. It is easy to skip a step on server number four.
- Misses: drift. A server you hardened in spring is not the same in autumn: a new container publishes a port, an update needs a reboot, a database starts listening on all addresses.
- Risk: the classic lockout, a firewall or SSH change that cuts your own connection. Our guides show how to avoid it, but it only takes one tired evening.
With Lynis, a read-only audit
Lynis is a free, open-source auditing tool from CISOfy. You run it on the server; it checks hundreds of settings and prints warnings, suggestions and a hardening index.
- Good: thorough, well known, and read-only, so it cannot break anything.
- Costs: you still fix everything yourself, and the list can be long and hard to rank.
- Misses: the outside view (what the internet can actually reach) and history. Each run is a snapshot of one server.
With an app that also fixes
This is where Stenvakt sits. It reviews each server over SSH, gives it a security and a health score, and splits the findings into fix now, should do and nice to have.
- Good: one view for all your servers, fixes you can preview before they run, and safe mode: the server arms a rollback timer before a firewall or SSH change and keeps it only after a fresh login works.
- Costs: it is an app on your Mac, and the advanced features are paid. Review, Preview and safe mode are free.
- Misses: it is opinionated. It covers the security and health basics deeply; it is not a general admin panel for mail, DNS or file shares.
Which one?
- One server and you enjoy learning it: by hand, with our guides open.
- You want a second opinion on a server you already hardened: run Lynis.
- Several servers, little time, and you never want to need the hosting console again: an app with rollback.
Stenvakt is the third option: a Mac app that reviews your servers, explains each finding, and fixes the risky ones in safe mode with an automatic rollback. Get early access.