RockyLinux 9 x86_64 Minimal Hardened by Cloudfu

This RockyLinux 9 image provides a standardized, security-focused operating system foundation for workloads running on AWS EC2 instances. It is designed for teams that want a clean and consistently configured starting point for application servers, development environments, automation workers, and custom infrastructure deployments.

The image applies a practical set of CIS-inspired system settings, including password complexity and aging policies, inactive-account controls, automatic shell timeouts, restricted sudo behavior with session logging, protected system files, and hardened kernel and network parameters. Unnecessary desktop components, services, Bluetooth packages, and legacy network protocol modules are removed or disabled to reduce the system operational footprint.

Remote administration is secured through a hardened OpenSSH configuration. Root login, empty-password authentication, host-based authentication, keyboard-interactive authentication, X11 forwarding, TCP forwarding, and SSH agent forwarding are disabled. SSH connections use an explicitly defined set of modern ciphers, key-exchange algorithms, and message authentication codes. Authentication attempts, concurrent sessions, connection startup rates, and idle connections are also restricted.

For operational reliability, the image includes:

• Rocky Linux 9 optimized for the x86_64 architecture and AWS EC2 instances
• Current operating system packages at image build time
• Chrony-based time synchronization
• UTC timezone and a consistent system locale
• Persistent systemd journal storage
• Rsyslog-based system and authentication logging
• Sudo activity logging and log rotation
• Increased file-descriptor limits for server workloads
• Reverse-path filtering, redirect protection, ASLR, and restricted kernel-pointer access
• A local build-information file for OS, architecture, kernel, image version, and build timestamp identification

The image intentionally provides a minimal operating system baseline rather than a bundled application stack. Docker and application-specific runtimes are not enabled by default, allowing customers to install and manage only the components required for their workloads.

Important configuration notes: IPv6, SSH port forwarding, SELinux enforcement, and the auditd package are disabled by this image baseline configuration. Customers should review these settings against their own security, networking, monitoring, and compliance requirements before deploying production workloads. This image is security-focused but is not represented as CIS-certified.