CentOS Stream 10

Option A: Azure Portal

• Open the Azure Marketplace and search for "CentOS Stream 10 on Azure SecureAnyCloud".
• Select the image and click Create.
• On the Basics tab, choose your Subscription and a Resource Group (create a new one or select an existing one).
• Enter a Virtual Machine Name and select your preferred Region.
• Set Size to Standard_B2s, the recommended size.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:centos-stream-10:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-centos-stream-10-azure-vm \
  --image sac1647283583153:centos-stream-10:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

When your VM is running, connect over SSH:

ssh azureuser@<public-ip-address>

To find your VM's public IP address, run:

az vm show --resource-group myResourceGroup --name my-centos-stream-10-azure-vm --show-details --query publicIps -o tsv

After connecting, verify the operating system:

cat /etc/centos-release
cat /etc/os-release uname -r

Check disk space and memory:

df -h free -h

Verify that the Azure Linux Agent is running:

systemctl status waagent

CentOS Stream 10 is continuously delivered (rolling). Updating it pulls the latest package set and all security backports:

sudo dnf upgrade -y

The Azure Network Security Group (NSG) is the primary inbound and outbound firewall for your VM. The minimal CentOS Stream 10 image does not ship a host firewall by default. If you want an additional host-based firewall, install and enable firewalld first:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --list-all

To allow additional ports, run:

sudo firewall-cmd --permanent --add-port=80/tcp sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Option A: AWS Marketplace console

• Open the SecureAnyCloud CentOS Stream listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• When the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace, or Launch from EC2 Console for full control. In Version, choose CentOS Stream 10 - YYYY-MM-DD HH:MM (the date and UTC time when the version was added), then choose your Region.
• Instance type: m5.large is recommended, and any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
• Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
• Security group: allow inbound TCP 22 from your own IP address or network only.
• Storage: the root volume is 10 GiB gp3 by default. Choose a larger size if you need one. On first boot, cloud-init grows the root partition and filesystem to fill it.
• Metadata: leave the defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the key pair, security group and subnet with your own. The root device of this AMI is /dev/sda1:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=centos-stream-10}]'

You do not need --metadata-options, because the AMI already requires IMDSv2.

Once you have subscribed, you can also find the AMI ID from the CLI. Look it up by the listing's product code and the version's image name. The newest image comes first, and the same command works in any Region:

ami=$(aws ec2 describe-images --owners aws-marketplace \
  --filters Name=product-code,Values=92965ysffq64jl24gdjgioljg \
  'Name=name,Values=sac-centos-stream-10-aws-*' \
  --query 'sort_by(Images,&CreationDate)[-1].ImageId' --output text)
aws ec2 describe-images --image-ids "$ami" --query 'Images[0].[ImageId,Name]' --output text

Expected output (your AMI ID depends on the Region and the version date):

ami-0123456789abcdef0 sac-centos-stream-10-aws-centos-stream-10-<build date>-prod-x7mjtndaxbiti

Then pass --image-id "$ami" to aws ec2 run-instances. To find another version of the listing, change the name filter, for example sac-centos-stream-10-minimal-aws-*, sac-centos-stream-10-lvm-aws-* or sac-centos-stream-9-aws-*.

From your workstation, connect as ec2-user with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all, through AWS Systems Manager Session Manager. This requires an instance profile that allows Systems Manager. The agent is installed and running on this image.

cat /etc/centos-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release uname -srm

Expected output:

CentOS Stream release 10 (Coughlan) NAME="CentOS Stream" VERSION="10 (Coughlan)" ID="centos" VERSION_ID="10" PLATFORM_ID="platform:el10" PRETTY_NAME="CentOS Stream 10 (Coughlan)" Linux 6.12.0-277.el10.x86_64 x86_64

CentOS Stream has no point releases. The release is just 10, and the system moves forward through ordinary dnf updates. Your kernel version is newer if updates have installed since this image was built.

This version keeps the CentOS Stream 10 EC2 package set whole. The packages that the Minimal version removes are installed here, and tuned is running. Check them:

rpm -qa | wc -l rpm -q tuned linux-firmware systemctl is-active tuned tuned-adm active

Expected output (the package versions change over time):

547 tuned-2.28.0-1.el10.noarch linux-firmware-20260812-27.el10.noarch active Current active profile: virtual-guest

• tuned is the system tuning daemon. Its virtual-guest profile, the one tuned-adm recommend picks on EC2, sets memory writeback and swappiness, disk readahead and CPU performance settings for a guest on a hypervisor. To use another profile, list the profiles with tuned-adm list, then switch with a command such as sudo tuned-adm profile throughput-performance.
• linux-firmware is the firmware collection for physical network, graphics and wireless hardware. An EC2 instance does not load it, but it is part of the standard CentOS Stream package set, so tools that expect it find it.
• The sos support-report collector is not part of the CentOS Stream 10 EC2 base image. If a support engineer asks for a report, install it with sudo dnf -y install sos, then run sudo sos report.

What the Minimal version drops. CentOS Stream 10 Minimal removes linux-firmware and tuned, and lists the removals in /usr/share/doc/sac/minimal-manifest.txt on its own image. A new Minimal instance has 545 packages against 547 here.

Everything else is the same in both versions. The CentOS Stream 10 EC2 base image is already small, so neither version has sound firmware, Cockpit or Plymouth installed. Both carry the same hardening, compliance tooling and AWS agents. The package count on your instance moves by a few as kernels and updates install.

The evaluation that the build ran after its reboot ships on the image. List the evidence files:

ls -lh /usr/share/doc/sac/ python3 -c "import json; s=json.load(open('/usr/share/doc/sac/cis-l1-summary.json')); print('profile: ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived: ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 32M -rw-r--r--. 1 root root 29M Oct 21 14:20 cis-l1-arf.xml -rw-r--r--. 1 root root 2.4M Oct 21 14:20 cis-l1-report.html -rw-r--r--. 1 root root 1.3K Oct 21 14:20 cis-l1-summary.json -rw-r--r--. 1 root root 1.8K Oct 21 14:20 cis-l1-tailoring.xml -rw-r--r--. 1 root root 2.9K Oct 21 14:20 cis-l1-waivers.txt -rw-r--r--. 1 root root 1.6K Oct 21 14:09 scap-security-guide-LICENSE.txt profile: CIS Level 1 Server (SCAP Security Guide 0.1.82) scored rules: 286 pass: 284 fail: 2 rate: 99.3% waived: 7 not applicable: 31 evaluated at: 2026-10-21T14:20:36Z

• cis-l1-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• cis-l1-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• cis-l1-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected or waived are not counted.

To copy the report to your workstation, run this command on the workstation:

scp -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>:/usr/share/doc/sac/cis-l1-report.html .

The seven waived rules

grep -v '^#' /usr/share/doc/sac/cis-l1-waivers.txt | cut -f1,2

Expected output:

partition_for_tmp [single-volume-partitions] grub2_password [serial-console-and-boot] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list] service_systemd-journal-upload_enabled [log-remote-destination]

The full reason for each is the third column of the same file. In short:

• Separate /tmp partition: this version boots from one EBS root volume. The LVM versions of this listing provide separate volumes for /tmp, /var, /var/log, /var/log/audit, /var/tmp and /home.
• Boot loader and root passwords: a GRUB or root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own if you need serial console access (see Step 11).
• Password ageing defaults: the accounts cloud-init creates are key-only, and an ageing limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.
• Journal upload to a remote log server: the profile switches on systemd-journal-upload but sets no destination, and an image cannot know your log server. With no destination, the service fails at every boot. systemd-journal-remote is installed and the upload service is left off. To enable it, create /etc/systemd/journal-upload.conf with an [Upload] section and URL= for your collector (the packaged defaults are in /usr/lib/systemd/journal-upload.conf), then run sudo systemctl enable --now systemd-journal-upload.

The two rules that do not pass

python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/cis-l1-summary.json'))['failingRules']]"

Expected output:

ensure_journald_and_rsyslog_not_active_together ensure_redhat_gpgkey_installed

• journald and rsyslog together. The benchmark wants one logging system, not both. CentOS Stream runs journald and rsyslog together by default. Journald keeps the structured system journal (persistent, in /var/log/journal). Rsyslog writes the traditional text logs (/var/log/messages, /var/log/secure, /var/log/cron) that many log shippers and audit procedures read. The image keeps both so that neither kind of tooling loses its logs. If you standardise on one, for example the journal only, run sudo systemctl disable --now rsyslog on your instance and re-run Step 6.
• Red Hat's package signing key. The rule comes from the RHEL content and checks that Red Hat's own release key is in the RPM database. The CentOS Project, not Red Hat, signs CentOS Stream packages, so that key is neither shipped nor useful here. The CentOS Official Signing Key is installed, and every repository checks package signatures (gpgcheck=1). rpm -qa gpg-pubkey lists the keys. The image deliberately does not import a key that signs none of its packages.

You can repeat the evaluation at any time with the same content and tailoring. It takes under a minute. Run:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/sac/cis-l1-tailoring.xml \
  --profile xccdf_co.sac_profile_cis-l1_ec2_single \
  --results /tmp/cis-check-results.xml --report /tmp/cis-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-cs10-ds.xml > /tmp/cis-check.log 2>&1 echo "oscap exit code: $? (2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/cis-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 2 (2 = at least one rule did not pass) {'fail': 2, 'notapplicable': 31, 'notselected': 756, 'pass': 284} pass rate: 99.3%

Your own report is at /tmp/cis-check-report.html. Use the ssg-cs10-ds.xml content shown above. The scap-security-guide package also ships ssg-rhel10-ds.xml, but that content applies only to Red Hat Enterprise Linux, so on CentOS Stream it reports almost every rule as not applicable. As you install software and change settings, re-run the evaluation to see how your changes affect the result.

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401 us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2. Every current AWS SDK and the AWS CLI do this automatically.

sudo firewall-cmd --state sudo firewall-cmd --list-all sudo ss -tlnp

Expected output (the interface name and process IDs may differ):

running public (default, active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: ens5 sources: services: dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1204,fd=7)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=1204,fd=8))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port.
• The public zone allows ssh and dhcpv6-client. The latter allows replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address. The CentOS default cockpit service is removed from the zone, and Cockpit is not installed.
• The loopback interface sits in the firewalld trusted zone, which is a CIS requirement. Local services can therefore talk to each other over lo.

Opening a port for your own service takes two steps: allow it in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run this on the instance:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld, or the other way round, the traffic does not arrive.

systemctl is-active chronyd amazon-ssm-agent chronyc -n sources

Expected output (the timings vary):

active active MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^* 169.254.169.123 3 4 377 31 -87ns[ -87us] +/- 552us

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too.

The AWS Systems Manager agent is installed from Amazon's own package at its current release (3.3.5390.0 on this build). It is not in the CentOS Stream repositories, so dnf does not update it. Systems Manager can keep it current for you, through the AWS-UpdateSSMAgent document or the Auto update SSM Agent setting in Fleet Manager.

The image is fully patched at build time. Check which updates are pending and how automatic updates are set up:

sudo dnf -q check-update --refresh echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)" grep -E '^(upgrade_type|apply_updates|reboot) =' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer systemctl cat dnf-automatic.timer | grep -E '^(OnCalendar|RandomizedDelaySec)' uname -r

Expected output on an instance launched soon after the image was built. Later launches list the updates released since, with exit code 100:

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available) upgrade_type = default apply_updates = yes reboot = never enabled OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m 6.12.0-277.el10.x86_64

How dnf-automatic is configured on this image:

• upgrade_type = default installs every available update, not only security fixes. CentOS Stream's repositories carry no security advisory data, so a security-only setting would install nothing at all.
• apply_updates = yes installs the updates instead of only downloading them.
• The timer runs daily at 06:00 (instance time, UTC by default) with a random delay of up to an hour.
• reboot = never means a new kernel or core library is installed but takes effect only after you reboot, at a time you choose.

CentOS Stream moves ahead of RHEL and updates arrive continuously. If your workload is sensitive to package changes, test updates on a non-production instance first.

To stop automatic updates, run sudo systemctl disable --now dnf-automatic.timer. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval|banner) ' cat /etc/issue.net

Expected output:

Enforcing root L 2025-04-08 0 99999 7 -1 maxauthtries 4 clientaliveinterval 300 permitrootlogin no pubkeyauthentication yes passwordauthentication no banner /etc/issue.net Authorized users only. All activity may be monitored and reported.

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on. If your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.
• L in the second column means the root account is locked.
• sshd -T prints the settings the SSH server actually uses, after every file in /etc/ssh/sshd_config.d/ has been read. maxauthtries 4 and clientaliveinterval 300 come from the CIS profile. SSH allows four authentication attempts per connection and checks idle sessions every five minutes. sudo sshd -T | grep -E '^(x11forwarding|kbdinteractiveauthentication) ' shows both set to no.
• The banner text is shown before login.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance. The password is yours and is not on the image, and pam_pwquality refuses a weak one:

sudo passwd ec2-user

df -hT / lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT
sudo grep -E 'cc_growpart.*(resized|NOCHANGE)' /var/log/cloud-init.log | tail -1 swapon --noheadings --show | wc -l sudo grep -h aide /etc/crontab

Expected output with the default 10 GiB root volume (on a larger volume, Size is larger and the cloud-init line says resized):

Filesystem Type Size Used Avail Use% Mounted on /dev/nvme0n1p3 xfs 9.8G 2.2G 7.6G 23% / NAME SIZE TYPE FSTYPE MOUNTPOINT nvme0n1 10G disk ├─nvme0n1p1 1M part ├─nvme0n1p2 200M part vfat /boot/efi └─nvme0n1p3 9.8G part xfs / 2026-10-21 14:44:51,726 - cc_growpart.py[DEBUG]: '/' NOCHANGE: no change necessary (/dev/nvme0n1, 3) 0 05 4 * * * root /usr/sbin/aide --check

• Disk layout. This is the standard (not LVM) layout of the official CentOS Stream 10 image. The root filesystem is XFS on partition 3 of the root volume, with /boot on the root filesystem. Partition 1 is the small BIOS boot partition that the boot loader uses. Partition 2 is an EFI system partition that the image carries but does not boot from, because the AMI boots in legacy BIOS mode. If you need separate filesystems for /var, /var/log, /tmp or /home, or want to grow storage by adding volumes, choose the CentOS Stream 10 LVM version of this listing instead.
• Disk growth. On first boot, cloud-init grows the root partition and filesystem to the volume size. To grow them later, increase the EBS volume size in the console or with aws ec2 modify-volume, then run sudo growpart /dev/nvme0n1 3 && sudo xfs_growfs / (or reboot).
• Swap. The image has no swap. Add a swap file yourself if your workload needs one.
• AIDE. The file integrity database is built from the image's own files, and the CIS profile schedules aide --check daily at 04:05 from /etc/crontab.

The instance uses the standard CentOS Stream 10 repositories (BaseOS, AppStream and Extras). List them:

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available Packages nginx.x86_64 2:1.26.3-15.el10 appstream

Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx. Then open its port in the security group and firewalld (Step 8).

The CRB repository (build and development dependencies) is installed but disabled. If a package needs it, enable it with sudo dnf config-manager --set-enabled crb. The AWS CLI is not on the image. If you need it, install the current version from AWS (the AWS CLI install guide).

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys. The restorecon command gives the file the SELinux label that sshd expects.

The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only, and sudo uses the password. Only ec2-user, created by cloud-init, has password-free sudo.