Kapstone.Systems Hardened Images
Kapstone Hardened Bastion
Browser-based SSH, RDP and VNC access to cloud networks without a VPN client or internet-exposed RDP.
Apache Guacamole on the hardened base: browser-based SSH/RDP/VNC with MFA and session recording enabled by default, and SSO (OIDC/SAML) as a documented option.
What is hardened
- AlmaLinux 9 with the DISA STIG profile applied; all exceptions documented
- FIPS mode enabled at installation; the operating system crypto policy restricts the system to FIPS 140-3 validated cryptographic modules
- SELinux in enforcing mode
- fapolicyd application allow-listing
- auditd configured with the STIG audit rule set
- Authentication by customer-supplied SSH keys only (RSA; ed25519 keys are rejected under FIPS mode)
What is proven
- Built on the hardened AlmaLinux 9 base; inherits its evidence pack
- MFA and session recording active from first boot
- Replaces exposed RDP and shared VPN credentials with a single audited access point
- Evidence pack: OpenSCAP results, DISA-format .ckl, CycloneDX SBOM, documented exceptions
How to try it free
Launch from Azure Marketplace (AWS Marketplace to follow). One month free on Azure; 30 days on AWS. The software fee is waived; the customer pays the cloud provider for the virtual machine.
Azure Government and AWS GovCloud regions planned. Private offers available for agencies and primes.
Listing coming soon — get notified
Listing not yet live at time of printing. Contact info@kapstone.systems for notification.
What it costs
from $0.40/hr
Software fee, Small instance (≤2 vCPU), in addition to the cloud VM cost. Launch range $0.40–$1.00/hr; final price set at launch. Larger instances priced per core. Clusters of 3+ discounted. Annual private offers available.
Includes monthly rebuilds, the evidence pack and next-business-day email support. Priority support and custom modifications quoted separately.