We hardened Rocky Linux 9 to make it more secure and reduce its vulnerability to threats. You can find it on the AWS Marketplace.

About Rocky Linux 9.0

Rocky Linux is a free, open-source operating system. It is built upon the Linux kernel and includes a collection of software packages, utilities, and tools that make it a complete product prepared to handle both simple and complex needs of the user. Rocky Linux is compatible with a popular commercial Linux distribution,  Red Hat Enterprise Linux (RHEL), and can be used as its replacement. Rocky Linux is a good choice for enterprises, developers, and IT professionals seeking a robust and consistent operating system for their workloads.

Rocky Linux 9 hardening

What does hardening mean?

The process of operating system hardening refers to the actions taken in order to increase the security of the system. This involves configuring the system to be more resistant to attacks, minimizing the risk of exploitation by removing unnecessary features and services, and implementing various security measures. The goal is to create a secure environment that protects against potential threats and unauthorized access.

Why do operating systems require hardening?

Even though operating systems are generally designed to be secure and to guard the user against common threats, their full potential in this matter can only be unlocked by a proper configuration. It’s particularly important if the user is dealing with any kind of sensitive data that requires increased protection. Here are some benefits from hardening an operating system:

• Reducing attack surface: Hardening reduces the number of vulnerabilities that attackers can exploit. By disabling unnecessary services and features, the potential points of attack are minimized.

• Protecting sensitive data: Operating systems often handle sensitive data, including personal information, financial data, and intellectual property. Hardening ensures that this data is protected against unauthorized access and breaches.

• Compliance with regulations: Many industries are subject to regulatory requirements (such as GDPR, HIPAA, or PCI-DSS) that mandate specific security measures. Hardening helps organizations comply with these regulations and avoid penalties.

• Preventing unauthorized access: Hardening measures, such as implementing strong authentication mechanisms and access controls, prevent unauthorized users from accessing the system.

• Enhancing system stability and performance: A hardened system is less likely to be compromised by malware or attacks, which can degrade performance and stability. Regular updates and patches also ensure that the system runs efficiently.

• Mitigating known vulnerabilities: Regularly updating and patching the system addresses known vulnerabilities, preventing attackers from exploiting them.

• Preparing for advanced threats: Attackers continually develop new methods to compromise systems. Hardening prepares the operating system to defend against advanced and evolving threats.

Rocky Linux 9 hardening

Like any operating system, Rocky Linux 9 requires hardening to ensure it is secure and resistant to attacks. While it is designed to be secure out of the box, additional hardening is recommended for production environments, especially those handling sensitive data or exposed to the internet.

Tools and security benchmark

Successful hardening of an operating system requires the selection of proper tools and relevant guidelines that would help achieve the desired effect. In the following section we’ll provide an overview of the resources we used in our Rocky Linux 9 hardening process.

OpenSCAP

OpenSCAP (Open Security Content Automation Protocol) is an open-source project that provides a set of tools for implementing and enforcing security policies on IT systems. It is designed to help organizations automate compliance with various security standards and regulations. OpenSCAP is a part of the SCAP framework, which is maintained by the U.S.  National Institute of Standards and Technology (NIST).

Key OpenSCAP features:

• Security compliance: OpenSCAP allows users to check their systems against predefined security policies and benchmarks, such as those provided by the Center for Internet Security (CIS) or specific regulatory requirements.

• Automated auditing: It automates the process of auditing system configurations and security settings to ensure they comply with security policies.

• Vulnerability management: OpenSCAP can scan systems for known vulnerabilities and generate reports on the findings.

• Remediation: It provides remediation scripts and guidance to fix identified issues and bring systems into compliance.

• Reporting: OpenSCAP generates detailed reports that can be used for compliance audits, security reviews, and management reporting.

CIS Rocky Linux Benchmark

The CIS Rocky Linux Benchmark refers to a set of guidelines and best practices developed by the Center for Internet Security (CIS) to secure and harden systems running Rocky Linux. CIS benchmarks are comprehensive, consensus-driven security configuration guides that are widely used by organizations to assess and improve their security posture.

CIS Rocky Linux Benchmark includes the following elements:

• Operating system configuration: Recommendations for securing various aspects of the operating system, such as user authentication, file system permissions, and network settings.

• Service configuration: Guidance on configuring and securing services and daemons running on the system, such as web servers (e.g., Apache, Nginx) and database servers (e.g., MySQL, PostgreSQL).

• Network configuration: Best practices for configuring firewalls, setting up secure network protocols, and managing network services.

• Logging and monitoring: Recommendations for enabling and configuring logging to monitor system activity and detect potential security incidents.

• User and account management: Guidelines for managing user accounts, enforcing password policies, and implementing least privilege principles.

• System hardening: Steps to harden the system against common attack vectors, such as disabling unnecessary services, applying security patches promptly, and encrypting sensitive data.

We used this Benchmark as a baseline to assess the security of Rocky Linux 9, identify potential vulnerabilities, and implement necessary security controls. Adhering to these benchmarks helps align with industry best practices and regulatory requirements, thereby enhancing overall system security and resilience.

Hardened Rocky Linux 9 on the AWS Marketplace

Our hardened Rocky Linux 9 is now available on the AWS Marketplace. We offer a highly secure foundation for your cloud environment. It adheres to CIS guidelines, guaranteeing protection against common vulnerabilities. 

Choosing our product equals choosing a stable, already configured solution that helps to reduce costs and save time. We’re the ones who take care of the upkeep so that you don’t have to worry about it. Along with the product, we provide comprehensive support, guaranteeing to respond to your messages within 1 business day. 

We value each and every one of our clients, and so you can expect an individual approach to your needs. We’re open for consultations – reach out to us at [email protected] and share your expectations.