AlmaLinux 9 Minimal

Option A: AWS Marketplace console

• Open the SecureAnyCloud AlmaLinux listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.

• Once the subscription is active, choose Launch your software.

• Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control), then in Version choose AlmaLinux 9 Minimal - YYYY-MM-DD (the date is when the version was added) and your Region.

• Instance type: m5.large is recommended; any current x86_64 type works. The software charge is $0.04 per vCPU per hour.

• Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.

• Security group: allow inbound TCP 22 from your own IP address or network only.

• Storage: the root volume is 10 GiB gp3 by default. Choose a larger size if you need one; cloud-init grows the root partition and filesystem to fill it on first boot.

• Metadata: leave the defaults. The image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=almalinux-9-minimal}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

From your workstation, connect as ec2-user with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all through AWS Systems Manager Session Manager, if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

cat /etc/almalinux-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release uname -srm

Expected output:

AlmaLinux release 9.8 (Olive Jaguar) NAME="AlmaLinux" VERSION="9.8 (Olive Jaguar)" ID="almalinux" VERSION_ID="9.8" PLATFORM_ID="platform:el9" PRETTY_NAME="AlmaLinux 9.8 (Olive Jaguar)" Linux 5.14.0-687.59.1.el9_8.x86_64 x86_64

This version follows AlmaLinux 9: it receives every AlmaLinux 9 minor release (9.8 at build time) through normal dnf updates. Your kernel version may be newer if updates have installed since this image was built.

The image lists exactly what was removed, and anything that a removal would have taken with it is kept and listed instead:

cat /usr/share/doc/sac/minimal-manifest.txt rpm -qa | wc -l

Expected output:

Minimal version: packages 480 -> 463 Removed: geolite2-city geolite2-country tuned Kept (a removal would have taken a protected package, or it failed): 465

The trim takes the package count from 480 to 463, including the dependencies that left with those three packages. Nothing had to be kept back. The base image is already small, so most of the candidate list (wireless and sound firmware, Cockpit, Plymouth, sos) was never installed. After the trim, the CIS remediation adds the tools it needs (OpenSCAP, AIDE and their libraries) and the build removes the superseded kernels; on this build that nets out at two more, so a new instance has 465 packages. The count on your instance moves by a few as kernels and updates install.

Anything removed is one sudo dnf install away from the standard AlmaLinux repositories.

The evaluation the build ran after its reboot ships on the image:

ls -lh /usr/share/doc/sac/ python3 -c "import json; s=json.load(open('/usr/share/doc/sac/cis-l1-summary.json')); print('profile: ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived: ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 39M -rw-r--r--. 1 root root 36M Oct 19 22:06 cis-l1-arf.xml -rw-r--r--. 1 root root 2.3M Oct 19 22:06 cis-l1-report.html -rw-r--r--. 1 root root 1.3K Oct 19 22:06 cis-l1-summary.json -rw-r--r--. 1 root root 1.7K Oct 19 22:06 cis-l1-tailoring.xml -rw-r--r--. 1 root root 2.3K Oct 19 22:06 cis-l1-waivers.txt -rw-r--r--. 1 root root 158 Oct 19 22:03 minimal-manifest.txt -rw-r--r--. 1 root root 1.6K Oct 19 22:03 scap-security-guide-LICENSE.txt profile: CIS Level 1 Server (SCAP Security Guide 0.1.82) scored rules: 256 pass: 255 fail: 1 rate: 99.6% waived: 6 not applicable: 33 evaluated at: 2026-10-19T22:06:57Z

• cis-l1-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.

• cis-l1-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.

• cis-l1-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).

• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected, or waived are not counted.

To copy the report to your workstation, run this on the workstation:

scp -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>:/usr/share/doc/sac/cis-l1-report.html .

The six waived rules

grep -v '^#' /usr/share/doc/sac/cis-l1-waivers.txt | cut -f1,2

Expected output:

partition_for_tmp [single-volume-partitions] grub2_password [serial-console-and-boot] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list]

The full reason for each is the third column of the same file. In short:

• Separate /tmp partition: this version boots from one EBS root volume. (The LVM versions of this listing provide separate volumes for /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home.)

• Boot loader and root passwords: a GRUB or root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own if you need serial console access (see Step 11).

• Password ageing defaults: the accounts cloud-init creates are key-only. An ageing limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.

• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.

The one rule that does not pass

python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/cis-l1-summary.json'))['failingRules']]"

Expected output:

ensure_journald_and_rsyslog_not_active_together

The benchmark wants one logging system, not both. AlmaLinux runs journald and rsyslog together by default: journald keeps the structured system journal (persistent, in /var/log/journal), and rsyslog writes the traditional text logs (/var/log/messages, /var/log/secure, /var/log/cron) that many log shippers and audit procedures read. The image keeps both so neither kind of tooling loses its logs. If you standardise on one, for example the journal only, run sudo systemctl disable --now rsyslog on your instance and re-run Step 6.

You can repeat the evaluation at any time with the same content and tailoring. It takes under a minute:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/sac/cis-l1-tailoring.xml \
  --profile xccdf_co.sac_profile_cis-l1_ec2_single \
  --results /tmp/cis-check-results.xml --report /tmp/cis-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-almalinux9-ds.xml > /tmp/cis-check.log 2>&1 echo "oscap exit code: $? (2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/cis-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 2 (2 = at least one rule did not pass) {'fail': 1, 'notapplicable': 33, 'notselected': 1251, 'pass': 255} pass rate: 99.6%

Your own report is at /tmp/cis-check-report.html. As you install software and change settings, re-run this to see how your changes affect the result.

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401 us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2; every current AWS SDK and the AWS CLI do this automatically.

sudo firewall-cmd --state sudo firewall-cmd --list-all sudo ss -tlnp

Expected output:

running public (active) target: default icmp-block-inversion: no interfaces: eth0 sources: services: dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=810,fd=7)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=810,fd=8))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port.

• The public zone allows ssh and dhcpv6-client (replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address). The AlmaLinux default cockpit service is removed from the zone; Cockpit is not installed.

• The loopback interface sits in firewalld's trusted zone, with rules that drop traffic claiming a loopback source from anywhere else (a CIS requirement).

Opening a port for your own service takes two steps: allow it in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run on the instance:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld (or the other way round), the traffic will not arrive.

systemctl is-active chronyd amazon-ssm-agent chronyc -n sources

Expected output (the pool servers and timings vary):

active active MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- 172.234.37.140 2 6 17 53 -3333us[-3251us] +/- 56ms ^- 38.45.67.7 2 6 17 53 +209us[ +294us] +/- 13ms ^- 66.118.231.14 2 6 17 53 +3879us[+3966us] +/- 128ms ^- 23.111.186.186 2 6 17 53 +520us[ +604us] +/- 32ms ^* 169.254.169.123 3 4 177 4 +27us[ +164us] +/- 488us

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public AlmaLinux pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package at its current release (3.3.5390.0 on this build). It is not in the AlmaLinux repositories, so dnf does not update it; Systems Manager can keep it current for you (the AWS-UpdateSSMAgent document, or the Auto update SSM Agent setting in Fleet Manager).

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)" grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer uname -r

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available) upgrade_type = security apply_updates = yes enabled 5.14.0-687.59.1.el9_8.x86_64

dnf-automatic runs daily (06:00, with a random delay of up to an hour) and installs security updates automatically. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval|banner) ' cat /etc/issue.net

Expected output:

Enforcing root LK 2023-11-16 0 99999 7 -1 (Password locked.) maxauthtries 4 clientaliveinterval 300 permitrootlogin no pubkeyauthentication yes passwordauthentication no banner /etc/issue.net Authorized users only. All activity may be monitored and reported.

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on; if your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.

• LK means the root account is locked.

• maxauthtries 4 and clientaliveinterval 300 come from the CIS profile: SSH allows four authentication attempts per connection and checks idle sessions every five minutes.

• The banner text is shown before login.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance (the password is yours and is not on the image):

sudo passwd ec2-user

df -hT /
sudo grep -E 'cc_growpart.*(resized|NOCHANGE)' /var/log/cloud-init.log | tail -1 swapon --noheadings --show | wc -l sudo grep -h aide /etc/crontab

Expected output with the default 10 GiB root volume (on a larger volume, Size is larger and the cloud-init line says resized):

Filesystem Type Size Used Avail Use% Mounted on /dev/nvme0n1p4 xfs 9.3G 1.5G 7.9G 16% / 2026-10-19 22:26:58,286 - cc_growpart.py[DEBUG]: '/' NOCHANGE: no change necessary (/dev/nvme0n1, 4) 0 05 4 * * * root /usr/sbin/aide --check

• Disk layout. The root filesystem is XFS on partition 4 of the root volume; /boot (XFS) and /boot/efi are separate small partitions.

• Disk growth. cloud-init grows the root partition and filesystem to the volume size on first boot. To grow later, increase the EBS volume size in the console or with aws ec2 modify-volume, then run sudo growpart /dev/nvme0n1 4 && sudo xfs_growfs / (or reboot).

• Swap. The image has no swap. Add a swap file yourself if your workload needs one.

• AIDE. The file integrity database is built from the image's own files, and the CIS profile schedules aide --check daily at 04:05 from /etc/crontab.

The instance uses the standard AlmaLinux 9 repositories (BaseOS, AppStream and Extras):

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available Packages nginx.x86_64 2:1.20.1-28.el9_8.6.alma.1 appstream

Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx, and open its port in the security group and firewalld (Step 8). The AWS CLI is not on the image; install the current version from AWS (the AWS CLI install guide) if you need it.

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys (and restorecon gives the file the SELinux label sshd expects). The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only; the password is used by sudo. (Only ec2-user, created by cloud-init, has password-free sudo.)