CentOS Stream 10 with GNOME desktop

Connecting to your instance

Connect over SSH as the default login user for the operating system variant you launched:

Operating system variant SSH login user

CentOS Stream 10 with GNOME Desktop ec2-user

Launch from AWS Marketplace

• Open the listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose Launch from EC2 Console (or One-click launch). In Version, choose CentOS Stream 10 with GNOME Desktop - YYYY-MM-DD HH:MM, then choose your Region.
• Choose an instance type. m5.large (2 vCPU, 8 GiB) is recommended, because the GNOME desktop needs the 8 GiB. For smooth everyday use, pick m5.xlarge or larger. There is no GPU requirement, because the desktop renders in software.
• Choose your EC2 key pair. It is the only way in.
• Configure the security group to allow inbound TCP 22 from your own IP address only. The listing's default security group also offers TCP 3389 for a direct RDP connection. Restrict it to your own address too, or remove it and use the SSH tunnel (Step 5).
• Set the storage. The root volume is 16 GiB gp3 by default. Choose a larger size if you will install applications. cloud-init grows the root filesystem to fill it on first boot.
• Leave the metadata settings at their defaults, because the image requires IMDSv2. Then choose Launch.

Security posture

Confirm four things:

• SSH is key-only.
• Root is locked.
• No account has a password until you set one.
• The host firewall admits SSH only.

sudo sshd -T | grep -E '^(passwordauthentication|permitrootlogin|pubkeyauthentication) '
sudo passwd -S root
sudo awk -F: '$2 !~ /^[!*]/ && $2 != "" {n++} END {print "accounts with a password: " n+0}' /etc/shadow
sudo firewall-cmd --list-services getenforce

permitrootlogin no pubkeyauthentication yes passwordauthentication no root L 2025-04-08 0 99999 7 -1 accounts with a password: 0 dhcpv6-client ssh Enforcing

After Step 3, the third line reads 1 (your own account). root L means the root password is locked.

View the compliance report

The evaluation the build ran ships in /usr/share/doc/sac/ in three forms:

• cis-l1-report.html, the HTML report
• cis-l1-arf.xml, the machine-readable ARF results
• cis-l1-summary.json, with the counts, pass rate, threshold, SSG version and checksums

The build host's name and addresses are replaced in the shipped copy.

python3 -c "import json; d=json.load(open('/usr/share/doc/sac/cis-l1-summary.json')); print(d['profileLabel'], d['ssgVersion'], '-', d['pass'], 'of', d['scored'], 'scored rules pass', '(' + str(d['ratePct']) + '%)', '- waived', d['waived'])"
python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/cis-l1-summary.json'))['failingRules']]"

CIS Level 1 Server 0.1.82 - 296 of 298 scored rules pass (99.3%) - waived 7 ensure_journald_and_rsyslog_not_active_together ensure_redhat_gpgkey_installed

The two rules that do not pass. The first is ensure_journald_and_rsyslog_not_active_together. The benchmark wants one logging system, not both, but CentOS Stream runs journald and rsyslog together by default. journald keeps the structured system journal, and rsyslog writes the traditional text logs (/var/log/messages, /var/log/secure) that many log shippers and audit procedures read. The image keeps both so neither kind of tooling loses its logs. If you standardize on the journal only, run sudo systemctl disable --now rsyslog.

The second is ensure_redhat_gpgkey_installed. The rule looks for Red Hat's release signing key. CentOS Stream packages are signed with the CentOS Project's own key instead, which is installed and which dnf checks on every package (gpgcheck=1 in each repository). Installing Red Hat's key would not change how any CentOS Stream package is verified, so the image does not add it.

Copy the HTML report to your workstation and open it in a browser:

scp -i ~/.ssh/my-key.pem ec2-user@<public-ip>:/usr/share/doc/sac/cis-l1-report.html .

You can re-run the same evaluation on your instance at any time. It takes about 5 to 10 minutes and changes nothing. oscap exits with status 2 when any rule fails, and the report is still written:

sudo oscap xccdf eval --tailoring-file /usr/share/sac/openscap/tailoring.xml \
  --profile xccdf_co.sac_profile_cis-l1_ec2_single \
  --report ~/cis-l1-rescan.html /usr/share/xml/scap/ssg/content/ssg-cs10-ds.xml

Waived rules

These rules of the profile are deselected through the tailoring file /usr/share/sac/openscap/tailoring.xml and are not scored. The reasons are in /usr/share/doc/sac/cis-l1-waivers.txt. Everything else the profile selects is remediated and scored.

grep -v '^#' /usr/share/doc/sac/cis-l1-waivers.txt | cut -f1,2

partition_for_tmp [single-volume-partitions] grub2_password [serial-console-and-boot] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list] service_systemd-journal-upload_enabled [log-remote-destination]

Rule Why it is waived on EC2

partition_for_tmp The image boots from one EBS root volume, so /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home live on the root filesystem.

grub2_password, ensure_root_password_configured A boot-loader or root password would have to be baked into the image, giving every instance the same credential. Root stays locked and no password exists.

accounts_maximum_age_login_defs, account_disable_post_pw_expiration Password-age defaults apply to every account cloud-init creates at launch. Those accounts are key only and have no password, so an age limit would expire them and lock the SSH key out. Accounts that do have a password (yours, after Step 3) are still aged.

sshd_limit_user_access An AllowUsers/AllowGroups list fixed at build time would refuse SSH to accounts you create with cloud-init user data. SSH is key only, root login is refused, and your security group restricts the source addresses.

service_systemd-journal-upload_enabled The profile turns on journal upload to a remote log server but sets no destination, and an image cannot know your server. To use it, put URL= for your collector in /etc/systemd/journal-upload.conf, then run sudo systemctl enable --now systemd-journal-upload.

Networking and services that ship switched off

NetworkManager manages the EC2 network interface, and cloud-init writes its connection profile at first boot:

nmcli -t -f DEVICE,TYPE,STATE device

ens5:ethernet:connected lo:loopback:connected (externally)

The Server with GUI group brings several network services that this image leaves switched off:

• cockpit.socket (the Cockpit web console) is disabled.
• Avahi and Bluetooth are masked by the CIS Level 1 remediation.
• ModemManager is disabled.

To use the Cockpit web console, run sudo systemctl enable --now cockpit.socket. Then reach it on port 9090 through an SSH tunnel (ssh -N -L 9090:localhost:9090 ...).

Flatpak

CentOS Stream's GNOME group includes redhat-flatpak-repo, which configures a system Flatpak remote named rhel for Red Hat's Flatpak registry. That registry needs a Red Hat account, and the image ships the remote disabled, so no Flatpak remote is enabled:

flatpak remotes --system --show-disabled

rhel disabled,oci,no-gpg-verify

To use it with your Red Hat account, run sudo flatpak remote-modify --enable rhel, or add the remote of your choice with sudo flatpak remote-add.

Printing is not included

The image has no print server. The CUPS server and its filters are removed, cups-browsed is never installed, and /etc/dnf/dnf.conf keeps them out of every dnf transaction, including the automatic updates. The client library cups-libs stays because the desktop libraries link against it. Check it:

rpm -q cups cups-filters cups-browsed libcupsfilters libppd grep '^exclude=' /etc/dnf/dnf.conf

package cups is not installed package cups-filters is not installed package cups-browsed is not installed package libcupsfilters is not installed package libppd is not installed exclude=cups cups-filters cups-browsed libcupsfilters libppd

To add printing yourself, delete those names from the exclude= line, then run sudo dnf install cups and sudo systemctl enable --now cups.

Turn remote desktop off, or replace the RDP credential

To switch remote desktop off again (the setting survives reboots):

sudo sac-remote-desktop disable

To replace the generated RDP password with a new random one, run rotate, then print the new credential. The new password reaches the remote desktop server on standard input, so it never appears in a log or a process list.

sudo sac-remote-desktop rotate
sudo sac-remote-desktop credentials

Patching

dnf-automatic installs every available update automatically each day. Check what is pending now:

sudo dnf -q check-update --refresh >/dev/null; echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)" grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available) upgrade_type = default apply_updates = yes enabled

upgrade_type = default installs every available update, not only security fixes. CentOS Stream's repositories carry no security advisory data, so a security-only setting would install nothing at all. CentOS Stream moves ahead of RHEL and updates arrive continuously, so test updates on a non-production instance first if your workload is sensitive to package changes. To stop automatic updates, run sudo systemctl disable --now dnf-automatic.timer.

An instance launched later lists the updates released since, with exit code 100. To install everything now, run sudo dnf -y upgrade, then sudo systemctl reboot if a new kernel was installed. Automatic updates never restart the instance for you. dnf needs-restarting -r tells you whether a restart is owed.

Troubleshooting

The RDP client connects, then the screen stays black or it disconnects

GNOME Remote Desktop requires the RDP graphics pipeline. Current Windows and macOS clients and Remmina support it. With FreeRDP, pass /gfx /bpp:32; without those flags the server closes the connection after authentication. Read the server side with:

sudo journalctl -u gnome-remote-desktop --no-pager -n 20

"Connection refused" on localhost:3389

Remote desktop is switched off on a new instance by design. Run sudo sac-remote-desktop enable first, and check that the SSH tunnel is still running in its own terminal window. sudo sac-remote-desktop status shows whether anything is listening on 3389.

The RDP client says the credentials are wrong

The client wants the RDP credential from sudo sac-remote-desktop credentials, not your account password. The account password is only for the GNOME login screen that appears afterwards.

The login screen does not accept my password

The login screen does not list accounts, so type ec2-user (or your account name), then your password. If the account has no password yet, set it with sudo passwd ec2-user over SSH.

After 5 failed attempts the account is locked for 15 minutes (part of the CIS Level 1 remediation). To unlock it early, run sudo faillock --user ec2-user --reset.

The session locked while I was away

The screen locks after 15 minutes of inactivity (CIS Level 1). Unlock it with your account password.

Cannot connect via SSH

• Check that port 22 is allowed in the security group from your address.
• Use the user ec2-user and the key pair you chose at launch. Password login over SSH is disabled by design.

A service is blocked and the logs mention SELinux

SELinux is enforcing. Read the denial with sudo ausearch -m avc -ts recent before you change anything. Fix the label or the boolean it names rather than turning SELinux off.

Emergency access

No account has a password until you set one. EC2 Serial Console and single-user recovery need a local password, and the one you set in Step 3 works for the serial console. If SSH is unavailable, use Session Manager (SSM) as the other way in.

Support

SecureAnyCloud provides 24/7 technical support for this image by email and live chat: sales@secureanycloud.com.

CentOS Stream is free and open source. It is assembled from thousands of independently packaged components, each under its own license (see rpm -qi <package>). No subscription or license key is required.

CentOS is a trademark of Red Hat, Inc. GNOME is a trademark of the GNOME Foundation. CIS and CIS Benchmarks are trademarks of the Center for Internet Security, Inc. The names are used only to identify the software this image contains. SecureAnyCloud is not affiliated with or endorsed by the CentOS Project, Red Hat, the GNOME Foundation or CIS.

Deploy on AWS

Launch CentOS Stream 10 with GNOME Desktop on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com