Hardened Images/Hardened AlmaLinux 9 (Base)
Kapstone Hardened AlmaLinux 9
The hardened operating system alone, for organizations deploying their own applications.
Function
A STIG-applied, FIPS-enabled AlmaLinux 9 image. 433 STIG checks passing, zero CAT I findings, every remaining item documented.
- Provisions as an AlmaLinux 9 host with the DISA STIG profile applied and FIPS mode enabled before any application is installed.
- Provides a documented baseline: 433 STIG checks passing, zero CAT I (high severity) findings, and a written exceptions list covering every remaining item.
- Ships with the evidence pack, so the inherited hardening can be presented to an assessor without additional scanning by the customer.
Intended use
Any workload the customer installs: web servers, databases, agents, build runners, container hosts. Organizations with existing configuration management can target this image directly.
A printable one-page summary is available for procurement and security staff.
Components
- Operating system
- AlmaLinux 9
- Hardening profile
- DISA STIG, documented exceptions
- Cryptography
- FIPS mode; OS crypto policy limited to FIPS 140-3 validated modules
- Mandatory access control
- SELinux enforcing
- Application control
- fapolicyd
- Audit
- auditd, STIG rule set
Hardening
Baseline shared by every image
- AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
- FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
- SELinux in enforcing mode
- fapolicyd application allow-listing
- auditd configured with the STIG audit rule set
- Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
- Monthly rebuilds with current security updates
Each control is explained on the Compliance page.
Evidence
Documentation issued with every release
- 433 STIG checks passing
- Zero CAT I findings
- Every remaining item listed with reason and mitigation
- Evidence pack regenerated with each monthly rebuild
- OpenSCAP scan results
- Automated STIG scan output from the exact build deployed.
- DISA-format .ckl checklist
- Opens in DISA STIG Viewer and can be provided directly to an assessor or ISSO.
- SBOM (CycloneDX)
- A software bill of materials listing every package and version on the image.
- Documented exceptions list
- Each open STIG item, the reason it remains open, and the mitigating control. Suitable as POA&M input.
Acquisition
Marketplace listing, free trial and private offers
Listing coming soon. Azure Marketplace first; AWS Marketplace to follow. Azure Government and AWS GovCloud regions are planned.
Free trial: one month on Azure, 30 days on AWS. The software fee is waived; the customer pays the cloud provider for the virtual machine. See Pricing.
Specifications
| Operating system | AlmaLinux 9 |
|---|---|
| Hardening profile | DISA STIG; documented exceptions |
| Cryptography | FIPS mode enabled at installation; OS crypto policy limited to FIPS 140-3 validated modules |
| Authentication | Customer-supplied SSH keys (RSA; ed25519 rejected under FIPS) |
| Release cadence | Monthly rebuilds; evidence pack per release |
| Marketplaces | Azure first; AWS to follow. Azure Government and AWS GovCloud planned |
| Tier and price | Base; from $0.04/hr for a Small instance. Launch range $0.04–$0.10/hr; final price set at launch |
| Support | Best-effort next-business-day by email included; paid priority support available |
| Customization | Consulting engagement, quoted separately |
Sectors
Sectors where this image typically applies
Contact Kapstone Systems
Describe the workload and cloud environment in question. Kapstone Systems will respond with a direct assessment of whether one of these images is appropriate and, if not, what alternative is recommended.
Email: info@kapstone.systems