Rocky Linux 10 LVM

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Rocky Linux 10 LVM SecureAnyCloud".
• Select the image and click Create.
• On the basics tab, set the following:
• Subscription: select your Azure subscription
• Resource Group: create a new one or select an existing one
• Virtual Machine Name: enter a name for your VM
• Region: select your preferred Azure region
• Size: Standard_B2s is recommended
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:rocky-10-lvm:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-rocky-10-lvm-vm \
  --image sac1647283583153:rocky-10-lvm:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-rocky-10-lvm-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, the key you supplied at create time is not the key your client is offering.

Check that the machine runs the Rocky Linux 10.2 release you expect:

cat /etc/rocky-release grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release uname -rm

Expected output:

Rocky Linux release 10.2 (Red Quartz) NAME="Rocky Linux" VERSION="10.2 (Red Quartz)" ID="rocky" PLATFORM_ID="platform:el10" 6.12.0-211.44.1.el10_2.x86_64 x86_64

The kernel version carries an el10_2 tag. This tag shows that the machine tracks the 10.2 maintenance stream.

The LVM root is the defining feature of this image. The root filesystem is a logical volume, not a plain partition. Confirm the layout:

lsblk -o NAME,TYPE,MOUNTPOINT,SIZE,FSTYPE findmnt /
sudo vgs
sudo lvs

Expected output:

NAME TYPE MOUNTPOINT SIZE FSTYPE sda disk 10G ├─sda1 part 2M ├─sda2 part /boot/efi 200M vfat ├─sda3 part /boot 1000M xfs └─sda4 part 8.8G LVM2_member └─rocky-lvroot lvm / 8.8G xfs TARGET SOURCE FSTYPE OPTIONS / /dev/mapper/rocky-lvroot xfs rw,relatime,... VG #PV #LV #SN Attr VSize VFree rocky 1 1 0 wz--n- 8.82g 32.00m LV VG Attr LSize lvroot rocky -wi-ao---- <8.79g

Root is /dev/mapper/rocky-lvroot, a logical volume in the rocky volume group. The lvm type against / in lsblk confirms that this is the LVM variant.

Growing the root filesystem

Because root is a logical volume, you can grow it online. First enlarge the OS disk in Azure: stop the VM, set a larger disk size and start it. Then grow the partition, the physical volume, the logical volume and the xfs filesystem in sequence:

# grow partition 4 to fill the enlarged disk
sudo growpart /dev/sda 4
# grow the physical volume into the enlarged partition
sudo pvresize /dev/sda4
# extend the logical volume to use all free space in the volume group sudo lvextend -l +100%FREE /dev/rocky/lvroot
# grow the xfs filesystem to fill the enlarged logical volume (xfs grows mounted)
sudo xfs_growfs /

You can also add a second data disk to the volume group and extend root across both. This is the main reason to run an LVM root:

sudo pvcreate /dev/sdc
sudo vgextend rocky /dev/sdc
sudo lvextend -l +100%FREE /dev/rocky/lvroot
sudo xfs_growfs /

The image is fully updated at build time. dnf check-update returns exit code 100 when updates are pending and 0 when none are:

sudo dnf check-update echo "exit code: $?" dnf repolist --enabled

The image also arms dnf-automatic, so security updates are downloaded and applied on a timer without any action from you. You can still run updates on your own schedule:

sudo dnf upgrade -y sudo systemctl reboot
# only if a new kernel was installed

Confirm that SELinux is enforcing, root is locked and SSH is key-only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication)'

Expected output:

Enforcing root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.) permitrootlogin no pubkeyauthentication yes passwordauthentication no

Confirm that the Azure Linux Agent, cloud-init and time synchronization are healthy and that unattended security updates are armed. Also check your resources:

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version
systemctl is-enabled dnf-automatic.timer
systemctl is-active chronyd df -h / free -h

waagent lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled. When dnf-automatic.timer is enabled, the machine keeps applying security updates on its own after launch.

The Azure Network Security Group controls inbound and outbound traffic. It is the first, and usually the only, place you need to open a port. The image advertises a single inbound port, SSH on 22.

The image binds no unnecessary listeners. rpcbind, the local RPC helper on port 111 that the stock cloud image leaves running, is masked because NFSv4, the Rocky 10 default, does not use it. Masking is stronger than disabling: it prevents the socket from starting even on demand. If you need NFSv3, unmask it first, then enable it:

sudo systemctl unmask rpcbind.socket rpcbind.service
sudo systemctl enable --now rpcbind.socket

Confirm what is listening before you open anything:

ss -tlnp

On a fresh machine, the only listener is sshd on port 22. If your policy also requires a host firewall, install and enable firewalld. Add the SSH service first so you do not lock yourself out:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --reload

AppStream carries the application packages. Search it, then install what you need:

dnf search nginx
dnf module list nginx
sudo dnf install -y nginx
sudo systemctl enable --now nginx

To add another administrator, create the account with sudo adduser <name>. Add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys. Set mode 600 on the file and mode 700 on the .ssh directory, both owned by that user.

Option A: AWS Marketplace console

• Open the SecureAnyCloud Rocky Linux listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control). In Version, choose Rocky Linux 10 LVM - YYYY-MM-DD HH:MM (the date and time when the version was added), and select your Region.
• Instance type: m5.large is recommended, and any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
• Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
• Security group: allow inbound TCP 22 from your own IP address or network only.
• Storage: the root volume is 12 GiB gp3 by default. Choose a larger size if you will install software (see Step 12). The extra space stays unallocated in the LVM physical volume until you give it to the volumes you choose.
• Metadata: leave the defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the key pair, security group and subnet with your own. The root device of this AMI is /dev/xvda:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/xvda,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rocky-10-lvm}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

From your workstation, connect as rocky with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem rocky@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all, through AWS Systems Manager Session Manager. This requires an instance profile that allows Systems Manager. The agent is installed and running on this image.

cat /etc/rocky-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release uname -srm

Expected output:

Rocky Linux release 10.2 (Red Quartz) NAME="Rocky Linux" VERSION="10.2 (Red Quartz)" ID="rocky" VERSION_ID="10.2" PLATFORM_ID="platform:el10" PRETTY_NAME="Rocky Linux 10.2 (Red Quartz)" Linux 6.12.0-211.67.1.el10_2.x86_64 x86_64

This version follows the Rocky Linux 10 line. It is built from whichever Rocky Linux 10 point release is current, 10.2 for this build.

The instance uses the standard Rocky Linux 10 repositories, so dnf updates keep it on the newest Rocky Linux 10 point release. When Rocky Linux 10.3 is released, the next update moves the instance to 10.3. If you need an instance that stays on one named point release, the listing also offers Rocky Linux 10.2, whose guide explains how to hold a release.

Your kernel version may be newer if updates have installed since this image was built.

The disk and its volumes:

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT /dev/nvme0n1

Expected output with the default 12 GiB root volume:

NAME SIZE TYPE FSTYPE MOUNTPOINT nvme0n1 12G disk ├─nvme0n1p1 1M part ├─nvme0n1p2 200M part vfat /boot/efi ├─nvme0n1p3 1G part xfs /boot └─nvme0n1p4 10.8G part LVM2_member ├─rl-root 4G lvm xfs / ├─rl-home 1G lvm xfs /home ├─rl-tmp 1G lvm xfs /tmp ├─rl-var 1.5G lvm xfs /var ├─rl-var_tmp 512M lvm xfs /var/tmp ├─rl-var_log 1G lvm xfs /var/log └─rl-var_log_audit 1G lvm xfs /var/log/audit

The volume group, its logical volumes and the mount options each volume carries:

sudo vgs
sudo lvs -o lv_name,lv_size,lv_path rl for m in / /home /tmp /var /var/tmp /var/log /var/log/audit /boot /dev/shm; do printf '%-15s %-30s %s\n' "$m" "$(findmnt -no SOURCE "$m")" "$(findmnt -no OPTIONS "$m" | tr , '\n' | grep -xE 'rw|ro|nodev|nosuid|noexec' | paste -sd, -)"; done

Expected output:

VG #PV #LV #SN Attr VSize VFree rl 1 7 0 wz--n- 10.80g 820.00m LV LSize Path home 1.00g /dev/rl/home root 4.00g /dev/rl/root tmp 1.00g /dev/rl/tmp var 1.50g /dev/rl/var var_log 1.00g /dev/rl/var_log var_log_audit 1.00g /dev/rl/var_log_audit var_tmp 512.00m /dev/rl/var_tmp / /dev/mapper/rl-root rw /home /dev/mapper/rl-home rw,nosuid,nodev /tmp /dev/mapper/rl-tmp rw,nosuid,nodev,noexec /var /dev/mapper/rl-var rw,nosuid,nodev /var/tmp /dev/mapper/rl-var_tmp rw,nosuid,nodev,noexec /var/log /dev/mapper/rl-var_log rw,nosuid,nodev,noexec /var/log/audit /dev/mapper/rl-var_log_audit rw,nosuid,nodev,noexec /boot /dev/nvme0n1p3 rw,nosuid,nodev /dev/shm tmpfs rw,nosuid,nodev,noexec

• The disk has a 1 MiB BIOS boot partition, a 200 MiB EFI system partition, a 1 GiB /boot (XFS) and one LVM physical volume. The AMI boots in UEFI mode on every instance type that supports it, and GRUB is also installed for legacy BIOS.
• The mount options are set in /etc/fstab by filesystem UUID, so they survive reboots and apply on every instance launched from the image. The last column shows the options that matter for the benchmark. findmnt lists the rest.
• The volume group keeps 820 MiB free at the default size, so you can grow the volume that fills first without touching EBS (Step 12).

The kernel finds its root filesystem on the logical volume. On Rocky Linux 10, each boot entry carries its own kernel arguments. kernel-install builds the entry for every kernel that a future update installs from /etc/kernel/cmdline. All three name the logical volume, so a new kernel boots from it as well:

grep -o 'root=[^ ]*\|rd.lvm[^ ]*' /proc/cmdline | sort -u
grep -o 'root=[^ ]*\|rd.lvm[^ ]*' /etc/kernel/cmdline | sort -u sudo sh -c 'grep -h "^options" /boot/loader/entries/*.conf' | grep -o 'root=[^ ]*\|rd.lvm[^ ]*' | sort -u rpm -q lvm2 cloud-utils-growpart xfsprogs

Expected output:

rd.lvm.lv=rl/root root=/dev/mapper/rl-root rd.lvm.lv=rl/root root=/dev/mapper/rl-root rd.lvm.lv=rl/root root=/dev/mapper/rl-root lvm2-2.03.36-2.el10.x86_64 cloud-utils-growpart-0.33-11.el10.noarch xfsprogs-6.16.0-1.el10.x86_64

The evaluation the build ran after its reboot ships on the image:

ls -lh /usr/share/doc/sac/ python3 -c "import json; s=json.load(open('/usr/share/doc/sac/cis-l1-summary.json')); print('profile: ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived: ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 32M -rw-r--r--. 1 root root 29M Oct 21 22:06 cis-l1-arf.xml -rw-r--r--. 1 root root 2.5M Oct 21 22:06 cis-l1-report.html -rw-r--r--. 1 root root 1.3K Oct 21 22:06 cis-l1-summary.json -rw-r--r--. 1 root root 1.7K Oct 21 22:06 cis-l1-tailoring.xml -rw-r--r--. 1 root root 2.6K Oct 21 22:06 cis-l1-waivers.txt -rw-r--r--. 1 root root 1.6K Oct 21 22:01 scap-security-guide-LICENSE.txt profile: CIS Level 1 Server (SCAP Security Guide 0.1.82) scored rules: 303 pass: 301 fail: 2 rate: 99.3% waived: 6 not applicable: 15 evaluated at: 2026-10-21T22:06:39Z

• cis-l1-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• cis-l1-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• cis-l1-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected or waived are not counted.
• Because the volumes are real, the partition rules are scored here, and they pass. These rules cover /tmp, /var, /var/tmp, /var/log, /var/log/audit and /home on their own partitions, and their mount options. A single-volume image has to waive them.

To copy the report to your workstation, run this on the workstation:

scp -i ~/.ssh/my-key-pair.pem rocky@<public-ip>:/usr/share/doc/sac/cis-l1-report.html .

The six waived rules

grep -v '^#' /usr/share/doc/sac/cis-l1-waivers.txt | cut -f1,2

Expected output:

grub2_password [serial-console-and-boot] ensure_root_password_configured [serial-console-and-boot] accounts_maximum_age_login_defs [key-only-account-aging] account_disable_post_pw_expiration [key-only-account-aging] sshd_limit_user_access [ssh-access-list] service_systemd-journal-upload_enabled [log-remote-destination]

The full reason for each is the third column of the same file. In short:

• Boot loader and root passwords: a GRUB or root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own if you need serial console access (see Step 11).
• Password aging defaults: the accounts cloud-init creates are key-only. An aging limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.
• Remote journal upload: the benchmark enables systemd-journal-upload, which sends the journal to a remote log server. An image cannot know your log server, and with no destination the upload service fails at every boot. systemd-journal-remote is installed and the upload service is left disabled. To send the journal to your own collector, set URL= in /etc/systemd/journal-upload.conf and run sudo systemctl enable --now systemd-journal-upload.

The two rules that do not pass

python3 -c "import json; [print(r) for r in json.load(open('/usr/share/doc/sac/cis-l1-summary.json'))['failingRules']]"

Expected output:

ensure_journald_and_rsyslog_not_active_together ensure_redhat_gpgkey_installed

• journald and rsyslog together. The benchmark wants one logging system, not both. Rocky Linux runs journald and rsyslog together by default. journald keeps the structured system journal (persistent, in /var/log/journal). rsyslog writes the traditional text logs (/var/log/messages, /var/log/secure, /var/log/cron) that many log shippers and audit procedures read. The image keeps both so neither kind of tooling loses its logs. If you standardize on one, for example the journal only, run sudo systemctl disable --now rsyslog on your instance and re-run Step 6.
• The Red Hat release key. In SCAP Security Guide 0.1.82, this rule's check for Rocky Linux 10 looks only for Red Hat's own package signing keys. Rocky Linux packages are signed with the Rocky Linux release key, which is installed, and dnf verifies every package against it. Installing Red Hat's key would not protect anything on a Rocky Linux system, so the image does not install it, and the rule stays as a reported fail. You can see the installed keys with:

rpm -q gpg-pubkey --qf '%{VERSION}-%{RELEASE} %{SUMMARY}\n'

Expected output:

6fedfc85-682ae1a9 Release Engineering (Rocky Linux 10) <releng@rockylinux.org> public key 2ebba43f-6a7b0932 Release Engineering (Rocky Linux 10) <releng@rockylinux.org> public key 22b7fa33-682ae15f Release Engineering (Rocky Linux 10 Testing) <releng@rockylinux.org> public key

Repeat the evaluation at any time with the same content and tailoring. It takes about a minute:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/sac/cis-l1-tailoring.xml \
  --profile xccdf_co.sac_profile_cis-l1_ec2_lvm \
  --results /tmp/cis-check-results.xml --report /tmp/cis-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rl10-ds.xml > /tmp/cis-check.log 2>&1 echo "oscap exit code: $? (0 = every rule passed, 2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/cis-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output (measured on a fresh instance launched from this image):

oscap exit code: 2 (0 = every rule passed, 2 = at least one rule did not pass) {'fail': 2, 'notapplicable': 15, 'notselected': 755, 'pass': 301} pass rate: 99.3%

Your own report is at /tmp/cis-check-report.html. As you install software and change settings, re-run the evaluation to see how your changes affect the result.

Use ssg-rl10-ds.xml, Rocky Linux's own content. The package also ships ssg-rhel10-ds.xml, whose rules only apply to Red Hat Enterprise Linux and would all report as not applicable here. /tmp is noexec, which does not affect oscap, because it runs its remediation and check scripts through their interpreter.

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401 us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2. Every current AWS SDK and the AWS CLI do this automatically.

sudo firewall-cmd --state sudo firewall-cmd --list-all sudo ss -tlnp systemctl is-enabled cockpit.socket cat /etc/systemd/system-preset/80-sac-cockpit.preset

Expected output:

running public (default, active) target: default ingress-priority: 0 egress-priority: 0 icmp-block-inversion: no interfaces: ens5 sources: services: dhcpv6-client ssh ports: protocols: forward: yes masquerade: no forward-ports: source-ports: icmp-blocks: rich rules: State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=1214,fd=7)) LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=1214,fd=8)) disabled
# sac: inbound SSH only. Enable the Cockpit web console yourself (see the user guide). disable cockpit.socket

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port.
• The public zone allows ssh and dhcpv6-client (replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address). The Rocky Linux default cockpit service is removed from the zone.
• The loopback interface sits in firewalld's trusted zone, with rules that drop traffic claiming a loopback source from anywhere else (a CIS requirement).
• The network interface name (ens5 here) depends on the instance type.

Opening a port for your own service takes two steps: allow it in the instance's security group, and allow it in firewalld. For example, for a web server on port 443, run this on the instance:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld, or the other way round, the traffic will not arrive.

Turning on the Cockpit web console. Cockpit (cockpit-ws, cockpit-system, cockpit-bridge) is installed as in a standard Rocky Linux system, but its socket is disabled. The preset file shown above stops the Rocky Linux default (enable cockpit.socket) from switching the socket back on, for example when systemctl preset-all applies the system presets again. If you want the console, run this on the instance:

sudo systemctl enable --now cockpit.socket
sudo firewall-cmd --permanent --add-service=cockpit sudo firewall-cmd --reload

Then allow TCP 9090 from your own address in the security group and browse to https://<public-ip>:9090. Cockpit signs in with a local account's password, so give your user one first (sudo passwd rocky). SSH stays key-only. Cockpit uses a self-signed certificate until you install your own.

Prefer an SSH tunnel (ssh -L 9090:localhost:9090 ...) to opening port 9090 to the internet.

systemctl is-active chronyd amazon-ssm-agent chronyc -n sources

Expected output (the pool servers and timings vary):

active active MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== ^- 173.249.203.227 2 6 377 37 +1227us[+1227us] +/- 27ms ^- 173.71.69.149 1 6 377 39 +31us[ +32us] +/- 4868us ^- 96.245.170.99 2 6 377 37 -1193us[-1193us] +/- 33ms ^- 162.159.200.123 3 6 377 38 +74us[ +75us] +/- 6560us ^* 169.254.169.123 3 4 377 5 +19us[ +20us] +/- 588us

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public Rocky Linux pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package at its current release (3.3.5538.0 on this build). It is not in the Rocky Linux repositories, so dnf does not update it. Systems Manager can keep it current for you, through the AWS-UpdateSSMAgent document or the Auto update SSM Agent setting in Fleet Manager.

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)" grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf systemctl is-enabled dnf-automatic.timer uname -r

Expected output on an instance launched soon after the image was built. Later launches list the updates released since then, with exit code 100:

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available) upgrade_type = security apply_updates = yes enabled 6.12.0-211.67.1.el10_2.x86_64

dnf-automatic runs daily (06:00, with a random delay of up to an hour) and installs security updates automatically. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

A new kernel boots from the logical volume like the current one, because its boot entry is built from /etc/kernel/cmdline (Step 4).

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval|banner|authorizedkeyscommand) ' cat /etc/issue.net rpm -q --quiet ec2-instance-connect && echo "EC2 Instance Connect: installed" || echo "EC2 Instance Connect: not installed"
sudo ls -l /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_rsa_key

Expected output:

Enforcing root L 2026-06-24 0 99999 7 -1 maxauthtries 4 clientaliveinterval 300 permitrootlogin no pubkeyauthentication yes passwordauthentication no banner /etc/issue.net authorizedkeyscommand none Authorized users only. All activity may be monitored and reported. EC2 Instance Connect: not installed -rw-------. 1 root root 537 Oct 21 22:32 /etc/ssh/ssh_host_ecdsa_key -rw-------. 1 root root 432 Oct 21 22:32 /etc/ssh/ssh_host_ed25519_key -rw-------. 1 root root 2622 Oct 21 22:32 /etc/ssh/ssh_host_rsa_key

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on. If your own software is denied, check sudo ausearch -m avc -ts recent instead of disabling SELinux.
• L means the root account is locked.
• maxauthtries 4 and clientaliveinterval 300 come from the CIS profile: SSH allows four authentication attempts per connection and checks idle sessions every five minutes.
• authorizedkeyscommand none: SSH reads keys only from each user's authorized_keys file.
• The banner text is shown before login.
• The SSH host keys are created on your instance's first boot and are readable by root only (-rw-------).

EC2 Instance Connect is not installed, so your key pair is the only SSH credential. Use Session Manager (Step 2) for browser-based access.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance. The password is yours and is not on the image:

sudo passwd rocky

sudo vgs rl df -h / /var /var/log
sudo grep -E 'cc_growpart.py.*(SKIPPED|resized|NOCHANGE)' /var/log/cloud-init.log | tail -1 | cut -c1-150 swapon --noheadings --show | wc -l sudo grep -h aide /etc/crontab

Expected output with the default 12 GiB root volume:

VG #PV #LV #SN Attr VSize VFree rl 1 7 0 wz--n- 10.80g 820.00m Filesystem Size Used Avail Use% Mounted on /dev/mapper/rl-root 4.0G 1.4G 2.6G 35% / /dev/mapper/rl-var 1.5G 142M 1.3G 10% /var /dev/mapper/rl-var_log 960M 68M 893M 8% /var/log 2026-10-21 22:32:43,399 - cc_growpart.py[DEBUG]: '/' SKIPPED: Resizing mapped device (/dev/mapper/rl-root) skipped as it is not encrypted. 0 05 4 * * * root /usr/sbin/aide --check

The root volume has under 3 GiB free at the default size. The operating system under /usr uses most of the 1.4 GiB in use. Before you install larger software, give / more space as shown below. Launch with a bigger root volume (or grow it later), then extend the root logical volume.

cloud-init does not grow LVM volumes. On a single-volume Rocky Linux image, cloud-init grows the root filesystem to the volume size on first boot. On this image the root filesystem is a logical volume, so cloud-init skips it (the SKIPPED line above). This is deliberate: you decide which volume gets the space.

When you launch with a bigger root volume, or grow the EBS volume later with aws ec2 modify-volume, add the space in three steps on the instance:

• Grow partition 4 (the LVM physical volume) to the end of the disk, then tell LVM:

sudo growpart /dev/nvme0n1 4
sudo pvresize /dev/nvme0n1p4

• Give space to the volumes that need it. --resizefs grows the XFS filesystem in the same step, online, with no reboot:

sudo lvextend --resizefs -L +4G /dev/rl/root
sudo lvextend --resizefs -L +2G /dev/rl/var

• Check the result:

sudo vgs rl df -h / /var

Example output after growing a 12 GiB volume to 18 GiB and running the commands above. The filesystem geometry that xfs_growfs prints is shortened to ...:

CHANGED: partition=4 start=2510848 old: size=22652928 end=25163775 new: size=35237855 end=37748702 Physical volume "/dev/nvme0n1p4" changed 1 physical volume(s) resized or updated / 0 physical volume(s) not resized File system xfs found on rl/root mounted at /. Size of logical volume rl/root changed from 4.00 GiB (1024 extents) to 8.00 GiB (2048 extents). Extending file system xfs to 8.00 GiB (8589934592 bytes) on rl/root... xfs_growfs /dev/rl/root meta-data=/dev/mapper/rl-root isize=512 agcount=8, agsize=131072 blks ... data blocks changed from 1048576 to 2097152 xfs_growfs done Extended file system xfs on rl/root. Logical volume rl/root successfully resized. File system xfs found on rl/var mounted at /var. Size of logical volume rl/var changed from 1.50 GiB (384 extents) to 3.50 GiB (896 extents). Extending file system xfs to 3.50 GiB (3758096384 bytes) on rl/var... xfs_growfs /dev/rl/var meta-data=/dev/mapper/rl-var isize=512 agcount=8, agsize=49152 blks ... data blocks changed from 393216 to 917504 xfs_growfs done Extended file system xfs on rl/var. Logical volume rl/var successfully resized. VG #PV #LV #SN Attr VSize VFree rl 1 7 0 wz--n- 16.80g 820.00m Filesystem Size Used Avail Use% Mounted on /dev/mapper/rl-root 8.0G 1.5G 6.5G 19% / /dev/mapper/rl-var 3.5G 129M 3.4G 4% /var

To give a volume all the remaining free space instead, use -l +100%FREE, for example sudo lvextend --resizefs -l +100%FREE /dev/rl/var_log. Leaving some space unallocated is useful, because you can grow whichever volume fills first without touching EBS. XFS volumes grow online but cannot shrink, so add space in steps.

• Adding a data volume. Attach a new EBS volume, then give it its own volume group (for example sudo pvcreate /dev/nvme1n1, sudo vgcreate datavg /dev/nvme1n1, sudo lvcreate -n data -l 100%FREE datavg, sudo mkfs.xfs /dev/datavg/data). Mount it from /etc/fstab by UUID with the nofail option, so the instance still boots if the volume is ever detached. Check the device name with lsblk first. On Nitro instances, the second EBS volume is usually /dev/nvme1n1. The image ships no LVM devices file (/etc/lvm/devices/system.devices), so LVM sees every attached disk.
• Swap. The image has no swap. If your workload needs it, create a logical volume for it (for example sudo lvcreate -L 2G -n swap rl, then sudo mkswap /dev/rl/swap and an /etc/fstab entry), or use a swap file on / or /var.
• AIDE. The file integrity database is built from the image's own files, and the CIS profile schedules aide --check daily at 04:05 from /etc/crontab.

The instance uses the standard Rocky Linux 10 repositories (BaseOS, AppStream and Extras):

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available Packages nginx.x86_64 2:1.26.3-6.el10_2.7 appstream

Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx. Open its port in the security group and firewalld (Step 8).

Most software installs under /usr and /etc on the root volume and keeps its data and logs under /var. Watch the / and /var volumes as you add software, and grow them as needed (Step 12). The AWS CLI is not on the image. If you need it, install the current version from AWS (the AWS CLI install guide).

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys. restorecon gives the file the SELinux label that sshd expects.

The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only, and sudo uses the password. Password-free sudo is granted only to rocky, which cloud-init creates, and to ssm-user, which the Systems Manager agent creates the first time you open a Session Manager session.