AlmaLinux 9.8 (Alma 9.8) Hardened & Minimal

This is a repackaged open source software product wherein additional charges apply for a hardened, minimal AlmaLinux 9.8 image built and verified by Rinne Labs.

AlmaLinux is free and open source software, downloadable at no cost from the AlmaLinux OS Foundation. This listing charges neither for the operating system nor for support.

The charge covers the hardened build: a security baseline applied to the image at build time, an automated assertion suite that proves every control of that baseline is live on a booted instance before the image is published, and continued rebuilds carrying current security updates.

Every control below is applied at build time and verified by an automated assertion against a booted instance before publication. The image records the baseline it carries in a versioned marker at /etc/rinne-labs-hardening.

• SELinux enforcing, at runtime and persistently across reboots
• Root login over SSH disabled
• Key-only SSH: password and keyboard-interactive authentication refused
• Reduced SSH surface: X11 forwarding off, lowered MaxAuthTries and LoginGraceTime, empty passwords and host-based authentication refused
• Kernel network hardening via sysctl, confirmed live in the running kernel
• Audit rules loaded in the running kernel, auditd enabled at boot
• Account lockout via pam_faillock, with a bounded unlock interval and root exempt
• Password quality enforcement via pam_pwquality
• A default umask of 027 for login shells
• Login banners on console and network logins
• The default user's authorized_keys restricted to mode 0600

• Built from the official AlmaLinux 9.8 ISO, "Minimal Install" package group
• 8GB root volume, no LVM, for a fast boot and a small storage footprint
• UEFI/GPT boot with an XFS root filesystem
• cloud-init configured; root partition and filesystem grow to the volume size at first boot
• Elastic Network Adapter (ENA) and NVMe drivers present and verified
• AWS CLI preinstalled
• Distribution security updates applied at build time

• Apache HTTP Server and NGINX web and reverse-proxy tiers
• PostgreSQL, MySQL, MariaDB and MongoDB database hosts
• Jenkins, GitLab CI and self-hosted GitHub Actions runners
• Terraform, OpenTofu and Ansible control nodes
• Docker and Podman container hosts, and Kubernetes worker nodes
• Auto Scaling groups and immutable golden-image fleets

How do I connect? SSH in as ec2-user with the key pair you chose at launch: ssh -i your-key.pem ec2-user@your-instance. Password login is disabled and root may not log in over SSH; run sudo -i for a root shell.

Do I need a subscription? No. AlmaLinux is free and open source, and the image updates from the distribution's public repositories.

Who maintains this image, and how often is it rebuilt? Rinne Labs. It is rebuilt as the distribution ships security updates and on each new release, and nothing is published until it passes the full assertion suite on a booted instance.

• Every image comes out of the same reproducible, fully automated build pipeline, starting from the distribution's official ISO. Nothing is hand-edited in.
• Every image is validated by an automated assertion suite against a booted instance, covering the hardening baseline, the cloud drivers, the repositories and the applied updates. An image that fails an assertion is not published.

"AlmaLinux" is a trademark of the AlmaLinux OS Foundation. Rinne Labs is an independent publisher, not affiliated with or endorsed by the AlmaLinux OS Foundation. This product repackages free and open source software; all trademarks are the property of their respective owners.

THIS IMAGE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

• AlmaLinux 9.7 
• AlmaLinux 9.6 
• AlmaLinux 9.5 
• RHEL 9.8 
• RHEL 9.7 
• Rocky Linux 9.8 
• Rocky Linux 9.7 
• All Rinne Labs images on AWS Marketplace