The main focus of Lynis is security auditing. Since some parts are so important for integrity of the systems or forensics, we do check them. Proper timing is one of them, proper DNS configuration is another one. Some things you want to put into your monitoring system as a regular test, other will be handled by the tooling itself. What we find, is that Lynis often detects incorrect configurations. That is exactly the purpose of the tool. Helping those, who didn't know, or thought things were fine.
Appreciate your stance, understand it and even agree with most of it. The tool is there to help to achieve what we both see as an ideal world: secure permissions by default, proper configurations, correct monitoring and integrity of data. Till the time we achieved that, I'm glad to see many were able to move up a few steps to this ideal world. Till then, happy hardening :)
If the upstream software author won’t fix it, and the Debian Maintainer (packager) won’t fix it, and if the Debian Technical Committee chooses not to overrule the Debian Maintainer, then it’s probably not actually a problem.
> if you have configured at least two name servers, or that your time is properly configured, and no false-tickers are present. Things which no upstream vendor even can configure for you.
This, on the other hand, does sound like a nice set of features, but this is then no longer a “Security audit” tool. Ideally, of course, these kinds of checks should be integrated into their respective programs/packages.
> you are the new system administrator and have to deal with the "great" work of the previous one.
Either you know that you can’t trust the previous sysadmin, in which case you have to reinstall anyway, or you start out trusting them, in which case you wait until you actually find something bad, and only then reinstall. I don’t really think this use case is very useful.