AlmaLinux 9.8

Option A: Azure Portal

• Open the Azure Marketplace and search for "AlmaLinux 9.8 SecureAnyCloud".
• Select the image and choose Create.
• Configure the basics:
  • Subscription: select your Azure subscription.
  • Resource Group: create a new one or select an existing one.
  • Virtual Machine Name: enter a name for your VM.
  • Region: select your preferred Azure region.
  • Size: Standard_B2s is recommended.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Choose Review + Create, then choose Create.

Option B: Azure CLI

Run these commands on your own workstation. Substitute your resource group, VM name and preferred region:

az vm image terms accept --urn sac1647283583153:almalinux-9-8:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-almalinux-9-8-vm \
  --image sac1647283583153:almalinux-9-8:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-almalinux-9-8-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, the key your client is offering is not the key you supplied at create time.

First, check that the machine runs the point release you procured:

cat /etc/almalinux-release

AlmaLinux release 9.8 (Olive Jaguar)

The os-release fields carry the same information in a machine-readable form, which is what configuration management tools read:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release

NAME="AlmaLinux" VERSION="9.8 (Olive Jaguar)" ID="almalinux" VERSION_ID="9.8" PLATFORM_ID="platform:el9"

VERSION_ID is 9.8, not 9. Inventory and compliance tools key on this field, and it is the reason this listing exists as a separate product.

The distribution itself asserts the RHEL compatibility lineage:

cat /etc/redhat-release

AlmaLinux release 9.8 (Olive Jaguar)

Then check the kernel:

uname -srm

Linux 5.14.0-687.36.1.el9_8.x86_64 x86_64

Every update available in the 9.8 stream was applied when this image was built. The dnf check-update command exits 100 when updates are pending and 0 when none are:

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"

exit=0

Check that no reboot is pending either:

dnf needs-restarting -r

No core libraries or services have been updated since boot-up. Reboot should not be necessary.

Your update path is intact. List the enabled repositories. There are three:

dnf repolist --enabled

repo id repo name appstream AlmaLinux 9 - AppStream baseos AlmaLinux 9 - BaseOS extras AlmaLinux 9 - Extras

CRB (CodeReady Builder) ships configured but disabled, which is the AlmaLinux default. Enable CRB only if you build software that needs its development headers:

sudo dnf config-manager --set-enabled crb

Automatic updates

Unlike a stock AlmaLinux cloud image, this machine keeps patching itself. The dnf-automatic package is installed and its timer is enabled, so the machine applies updates on its own schedule:

systemctl is-enabled dnf-automatic.timer

enabled

systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec'

OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m

The policy applies all available updates, not only those tagged as security errata. It never reboots automatically, so a kernel update waits for a window you choose instead of restarting a production machine without warning:

grep -E '^(apply_updates|upgrade_type|download_updates|reboot)' /etc/dnf/automatic.conf

upgrade_type = default download_updates = yes apply_updates = yes reboot = never

upgrade_type is deliberately default rather than security. On an image whose errata metadata is not always populated, a security-only policy can silently resolve to applying nothing. The default setting is the one that actually keeps the machine current.

Because reboot = never, check periodically whether a restart is owed after a kernel update, using the needs-restarting -r command above. To opt out entirely, run sudo systemctl disable --now dnf-automatic.timer.

Confirm that SELinux is enforcing:

getenforce

Enforcing

Confirm that the root account is locked. LK in the second field means locked:

passwd -S root

root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.)

Confirm that no account on the machine has a usable password. This command prints nothing on a clean image:

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy instead of the config file, because the running daemon is what a client actually meets:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) '

permitrootlogin without-password pubkeyauthentication yes passwordauthentication no

The image has no swap on the operating system disk. Azure manages swap on the ephemeral resource disk if you want it, and a swap file baked into a Marketplace image is not permitted. This command prints nothing:

swapon --show

Confirm what is listening. On a freshly launched machine, sshd on port 22 is your remote access. The base OS also runs rpcbind on port 111 and chronyd bound to the loopback address for time synchronisation:

ss -tulnH | awk '{print $1, $5}' | sort -u

tcp 0.0.0.0:111 tcp 0.0.0.0:22 tcp [::]:111 tcp [::]:22 udp 0.0.0.0:111 udp 127.0.0.1:323 udp [::1]:323 udp [::]:111

The Azure Network Security Group (NSG) controls inbound traffic. Only the ports you explicitly open in the NSG are reachable from outside the VM, regardless of what is bound locally.

If you do not use RPC-based services and want to close port 111 on the host as well, run sudo systemctl disable --now rpcbind.socket rpcbind.service.

By default this machine behaves like any other AlmaLinux 9 system. sudo dnf update moves it forward within the AlmaLinux 9 series, including across future point releases. This is the right behaviour for most workloads, and it is how you receive security fixes.

If your change control requires a fleet to stay on the 9.8 package set, use AlmaLinux's mechanism, the releasever variable:

echo "9.8" | sudo tee /etc/dnf/vars/releasever

Read this before you pin. AlmaLinux serves a pinned minor release from its vault, and a vault is only populated once that release has been superseded. At the time of writing, 9.8 is the current release, so pinning today would point dnf at a vault location that may not exist yet.

More importantly, once a vault is frozen it stops receiving new security backports. Pinning trades security currency for version stability. Pin only if a compliance obligation requires it, revisit the decision on a schedule, and never pin a machine that is exposed to the internet without compensating controls.

For most people the right choice is to leave the repositories alone and let the automatic updates run. Use this listing for what it is: a guarantee about the release you procured.

The Azure Linux Agent handles provisioning, extensions and the portal's serial console. Check the agent and the related packages:

systemctl is-active waagent rpm -q WALinuxAgent cloud-init chrony

active WALinuxAgent-2.14.0.1-4.el9.noarch cloud-init-24.4-8.el9_8.1.alma.1.noarch chrony-4.8-1.el9.x86_64

Cloud-init should report done, which means provisioning finished cleanly:

cloud-init status

status: done

The kernel puts a console on ttyS0. This makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH:

grep -o 'console=ttyS0[^ ]*' /proc/cmdline

Time synchronisation runs through chronyd against the Azure host clock. Check the time sources:

chronyc -n sources | head -4

MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* PHC0 2 3 377 8 -5662ns[-8956ns] +/- 3607ns

Azure attaches an ephemeral resource disk, which waagent formats and mounts at /mnt. The disk is fast and local, but it is erased whenever the machine is deallocated or moved. Use it for scratch data and caches, never for data you need to keep:

df -h / /mnt

Filesystem Size Used Avail Use% Mounted on /dev/sda4 29G 1.4G 28G 5% / /dev/sdb1 7.8G 28K 7.4G 1% /mnt

The Azure Network Security Group controls inbound and outbound traffic. It is the first place, and usually the only place, where you need to open a port.

This image is a minimal build, so firewalld is not installed:

rpm -q firewalld || echo "(firewalld absent - the Azure NSG is your only firewall)"

package firewalld is not installed (firewalld absent - the Azure NSG is your only firewall)

This is deliberate. With no host firewall in the way, your NSG rules take effect exactly as written, with no second layer to keep in sync. Confirm what is listening before you open anything:

ss -tlnp

If your policy also requires a host firewall, install and enable it yourself:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Once firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service.

AppStream carries the application packages. Search it, then install what you need:

dnf search nginx

Install a package and enable it in the usual way. For example, run sudo dnf install -y nginx, then sudo systemctl enable --now nginx.

To add another administrator, create the account with sudo adduser <name>. Add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys, with mode 600 on the file and mode 700 on the .ssh directory, both owned by that user.

The image ships with no human accounts at all, so azureuser is the only login until you add one. List the group members:

getent group wheel

Option A: AWS Marketplace console

• Open the SecureAnyCloud AlmaLinux listing on AWS Marketplace, choose View purchase options, then choose Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for full control. In Version, choose AlmaLinux 9.8 - YYYY-MM-DD (the date is when the version was added), then select your Region.
• Instance type: m5.large is recommended, and any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
• Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
• Security group: allow inbound TCP 22 from your own IP address or network only.
• Storage: the root volume is 10 GiB gp3 by default. Choose a larger size if you need one. cloud-init grows the root partition and filesystem to fill it on first boot.
• Metadata: leave the defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this command on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=almalinux-9-8}]'

You do not need --metadata-options, because the AMI already requires IMDSv2.

From your workstation, connect as ec2-user with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all, through AWS Systems Manager Session Manager. This requires an instance profile that allows Systems Manager. The agent is installed and running on this image.

Print the release files and the kernel version:

cat /etc/almalinux-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release uname -srm

Expected output:

AlmaLinux release 9.8 (Olive Jaguar) NAME="AlmaLinux" VERSION="9.8 (Olive Jaguar)" ID="almalinux" VERSION_ID="9.8" PLATFORM_ID="platform:el9" PRETTY_NAME="AlmaLinux 9.8 (Olive Jaguar)" Linux 5.14.0-687.59.1.el9_8.x86_64 x86_64

The image is AlmaLinux 9.8 as built. Its repositories are the AlmaLinux 9 release stream ($releasever is 9), which the AlmaLinux mirror list serves from the 9.8 tree today.

AlmaLinux publishes updates only for the newest minor release. When AlmaLinux 9.9 ships, the instance moves to it through normal dnf updates, as every AlmaLinux 9 system does. Your kernel version may be newer if updates have installed since this image was built.

This version keeps the AlmaLinux 9.8 EC2 package set whole. The packages that the Minimal version removes are installed here, and tuned is running. Check the package count, the packages and the service:

rpm -qa | wc -l rpm -q tuned geolite2-city geolite2-country systemctl is-active tuned tuned-adm active

Expected output (the package versions change over time):

482 tuned-2.27.0-2.el9_8.noarch geolite2-city-20191217-6.el9.noarch geolite2-country-20191217-6.el9.noarch active Current active profile: virtual-guest

• tuned is the system tuning daemon. Its virtual-guest profile, the one tuned-adm recommend picks on EC2, sets memory writeback and swappiness, disk readahead and CPU performance settings for a guest on a hypervisor. To use another profile, list the profiles with tuned-adm list (tuned also ships an aws profile). Then switch with, for example, sudo tuned-adm profile throughput-performance.
• geolite2-city and geolite2-country are IP geolocation databases that some tools can use.
• The sos support-report collector is not part of the AlmaLinux 9 EC2 base image. If a support engineer asks for a report, install it with sudo dnf -y install sos and run sudo sos report.

What the Minimal version drops. AlmaLinux 9 Minimal removes tuned, geolite2-city and geolite2-country, along with the packages that exist only for them. It lists the removals in /usr/share/doc/sac/minimal-manifest.txt on its own image. A new Minimal instance has 465 packages against 482 here.

Everything else is the same in both versions. The AlmaLinux 9.8 EC2 base image is already small, so neither version has wireless or sound firmware, Cockpit or Plymouth installed. Both carry the same hardening, compliance tooling and AWS agents. The package count on your instance moves by a few as kernels and updates install.

The evaluation that the build ran after its reboot ships on the image. Read the files and the summary:

ls -lh /usr/share/doc/sac/ python3 -c "import json; s=json.load(open('/usr/share/doc/sac/cis-l1-summary.json')); print('profile: ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived: ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 39M -rw-r--r--. 1 root root 36M Oct 20 02:55 cis-l1-arf.xml -rw-r--r--. 1 root root 2.3M Oct 20 02:55 cis-l1-report.html -rw-r--r--. 1 root root 1.2K Oct 20 02:55 cis-l1-summary.json -rw-r--r--. 1 root root 1.7K Oct 20 02:55 cis-l1-tailoring.xml -rw-r--r--. 1 root root 2.3K Oct 20 02:55 cis-l1-waivers.txt -rw-r--r--. 1 root root 1.6K Oct 20 02:51 scap-security-guide-LICENSE.txt profile: CIS Level 1 Server (SCAP Security Guide 0.1.82) scored rules: 256 pass: 255 fail: 1 rate: 99.6% waived: 6 not applicable: 33 evaluated at: 2026-10-20T02:55:29Z

• cis-l1-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• cis-l1-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• cis-l1-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected, or waived are not counted.

To copy the report to your workstation, run this command on the workstation:

scp -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>:/usr/share/doc/sac/cis-l1-report.html .

The six waived rules

List the waived rules and their groups:

grep -v '^#' /usr/share/doc/sac/cis-l1-waivers.txt | cut -f1,2

Expected output:

partition_for_tmp [single-volume-partitions] grub2_password [serial-console-and-boot] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list]

The third column of the same file gives the full reason for each. In short:

• Separate /tmp partition: this version boots from one EBS root volume. The LVM versions of this listing provide separate volumes for /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home.
• Boot loader and root passwords: a GRUB or root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own if you need serial console access (see Step 11).
• Password ageing defaults: the accounts cloud-init creates are key-only. An ageing limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.

The one rule that does not pass

Print the failing rule:

python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/cis-l1-summary.json'))['failingRules']]"

Expected output:

ensure_journald_and_rsyslog_not_active_together

The benchmark wants one logging system, not both. AlmaLinux runs journald and rsyslog together by default. journald keeps the structured system journal (persistent, in /var/log/journal). rsyslog writes the traditional text logs (/var/log/messages, /var/log/secure, /var/log/cron) that many log shippers and audit procedures read.

The image keeps both so that neither kind of tooling loses its logs. If you standardise on one, for example the journal only, run sudo systemctl disable --now rsyslog on your instance and re-run Step 6.

Repeat the evaluation at any time with the same content and tailoring. It takes under a minute:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/sac/cis-l1-tailoring.xml \
  --profile xccdf_co.sac_profile_cis-l1_ec2_single \
  --results /tmp/cis-check-results.xml --report /tmp/cis-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-almalinux9-ds.xml > /tmp/cis-check.log 2>&1 echo "oscap exit code: $? (2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/cis-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 2 (2 = at least one rule did not pass) {'fail': 1, 'notapplicable': 33, 'notselected': 1251, 'pass': 255} pass rate: 99.6%

Your own report is at /tmp/cis-check-report.html. As you install software and change settings, re-run the evaluation to see how your changes affect the result.

Request instance metadata without a token, then with one:

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401 us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2. Every current AWS SDK and the AWS CLI do this automatically.

Check the firewall state and the listening sockets:

sudo firewall-cmd --state sudo firewall-cmd --list-all sudo ss -tlnp

Expected output:

running public (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=816,fd=7)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=816,fd=8))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port.
• The public zone allows ssh and dhcpv6-client. The DHCPv6 client receives replies for the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address. The AlmaLinux default cockpit service is removed from the zone, and Cockpit is not installed.
• The loopback interface sits in firewalld's trusted zone. Rules drop any traffic that claims a loopback source from anywhere else (a CIS requirement).

Opening a port for your own service takes two steps. Allow the port in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run this on the instance:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld, or the other way round, the traffic does not arrive.

Check both services and the time sources:

systemctl is-active chronyd amazon-ssm-agent chronyc -n sources

Expected output (the pool servers and timings vary):

active active MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- 129.250.35.250 2 6 17 17 -760us[ -860us] +/- 62ms ^- 23.150.41.122 2 6 33 18 -754us[ -854us] +/- 23ms ^- 198.178.138.195 2 6 17 19 +3195us[+3095us] +/- 38ms ^- 67.215.249.229 2 6 35 18 +1087us[ +987us] +/- 18ms ^* 169.254.169.123 3 4 37 4 +1125us[+1026us] +/- 1519us

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public AlmaLinux pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package at its current release (3.3.5390.0 on this build). It is not in the AlmaLinux repositories, so dnf does not update it. Systems Manager can keep it current for you, through the AWS-UpdateSSMAgent document or the Auto update SSM Agent setting in Fleet Manager.

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)" grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer uname -r

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available) upgrade_type = security apply_updates = yes enabled 5.14.0-687.59.1.el9_8.x86_64

dnf-automatic runs daily (06:00, with a random delay of up to an hour) and installs security updates automatically. To update everything immediately, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Check SELinux, the root account and the effective SSH policy:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval|banner) ' cat /etc/issue.net

Expected output:

Enforcing root LK 2023-11-16 0 99999 7 -1 (Password locked.) maxauthtries 4 clientaliveinterval 300 permitrootlogin no pubkeyauthentication yes passwordauthentication no banner /etc/issue.net Authorized users only. All activity may be monitored and reported.

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on. If your own software is denied, check sudo ausearch -m avc -ts recent instead of disabling SELinux.
• LK and (Password locked.) mean the root account is locked.
• maxauthtries 4 and clientaliveinterval 300 come from the CIS profile. SSH allows four authentication attempts per connection and checks idle sessions every five minutes.
• The banner text is shown before login.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance. The password is yours and is not on the image:

sudo passwd ec2-user

Check the root filesystem, the first-boot partition growth, swap and the AIDE schedule:

df -hT /
sudo grep -E 'cc_growpart.*(resized|NOCHANGE)' /var/log/cloud-init.log | tail -1 swapon --noheadings --show | wc -l sudo grep -h aide /etc/crontab

Expected output with the default 10 GiB root volume (on a larger volume, Size is larger and the cloud-init line says resized):

Filesystem Type Size Used Avail Use% Mounted on /dev/nvme0n1p4 xfs 9.3G 1.6G 7.8G 17% / 2026-10-20 03:16:39,900 - cc_growpart.py[DEBUG]: '/' NOCHANGE: no change necessary (/dev/nvme0n1, 4) 0 05 4 * * * root /usr/sbin/aide --check

• Disk layout. The instance boots with legacy BIOS. The root filesystem is XFS on partition 4 of the root volume. /boot (XFS) and a small /boot/efi partition sit beside it.
• Disk growth. cloud-init grows the root partition and filesystem to the volume size on first boot. To grow later, increase the EBS volume size in the console or with aws ec2 modify-volume. Then run sudo growpart /dev/nvme0n1 4 && sudo xfs_growfs / (or reboot).
• Swap. The image has no swap. Add a swap file yourself if your workload needs one.
• AIDE. The file integrity database is built from the image's own files, and the CIS profile schedules aide --check daily at 04:05 from /etc/crontab.

The instance uses the standard AlmaLinux 9 repositories (BaseOS, AppStream and Extras). Check that a package such as nginx is available:

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available Packages nginx.x86_64 2:1.20.1-28.el9_8.6.alma.1 appstream

Install and start software in the usual way. For example, run sudo dnf -y install nginx, then sudo systemctl enable --now nginx. Open its port in the security group and firewalld (Step 8).

AppStream also carries newer streams of some software as modules. For nginx, sudo dnf module list nginx shows 1.22, 1.24 and 1.26. Development headers and some build tools live in the CRB repository, which is present but disabled. Enable it with sudo dnf config-manager --set-enabled crb.

The AWS CLI is not on the image. Install the current version from AWS (the AWS CLI install guide) if you need it.

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys. The restorecon command gives the file the SELinux label that sshd expects.

The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only, and sudo uses the password. Only ec2-user, created by cloud-init, has password-free sudo.