It's important to use STIG and CIS hardened images for CentOS on AWS. In this blog, we give you an overview of our new AWS CentOS images, which are STIG and CIS hardened.
In addition to the CentOS 6.8 and 7.3 images that we released earlier in January 2017, we are happy to announce updated images for our security-hardened offerings. These enhanced security images include the same support that is included with our other images that are available in the AWS Marketplace.
What Does OpenLogic Mean by Security-Hardened Images?
We have taken our standard images and modified them to increase the security of the images by minimizing your system’s exposure to outside threats and taking full advantage of mature solutions like SELinux and auditing.
Not at all! You can have an instance of any of our images up and running in minutes. Here’s a demo on how to launch one of our security-hardened images, but the process is the same for our standard images:
As with our standard images, our security-hardened AWS images are minimal by design, taking up as little space as is necessary to provide a fully-functional AWS instance. This maximizes the available space for you to customize the instance to meet your specific needs.
Get the CentOS AWS ImagesDownload any of the OpenLogic CentOS images — standard or security-hardened — on the AWS marketplace.AWS MARKETPLACE
Download any of the OpenLogic CentOS images — standard or security-hardened — on the AWS marketplace.
Our AWS CentOS images are STIG and CIS hardened. This includes the CIS Level 1, CIS Level 2, and STIGs security profiles.
There are certain security measures that cannot be applied to CentOS AWS images — or are not appropriate for CentOS AWS images. The complete exclusion list is detailed below.
Our AWS images consist of a single partition, excluding the following:
AWS images do not have removable media, excluding the following:
AWS instances do not allow access to the bootloader or console when the instance is started, excluding the following:
Our AWS images are fresh installs from official media, excluding the following:
Our AWS images include the chrony package and do not include the NTP package, excluding the following:
AWS images do not have wireless interfaces:
Our AWS images do not use TCP Wrappers (since it is impossible to know where our customers will connect to the instances from), excluding the following:
AWS images are firewalled by the EC2 security groups, excluding the following:
CIS and STIGs conflict, excluding the following:
Our AWS images only have a single user account (centos) created by the CentOS installer, so we do not restrict user access, excluding the following:
Our AWS images are explicitly configured to not display a SSH banner, excluding the following:
Our AWS images do not contain any non-open source software, excluding the following:
Even with these exceptions, our images pass well over 200 security tests prescribed in the CIS 1, CIS 2, and STIGs profiles. The results of the tests is available within the instances in the /var/log/hardened/ directory.
Our automated image hardening process enables us to replicate our image building process with both speed and accuracy. Before we automated the process, it would take us over 8 hours to manually apply the security hardening recommendations to each image that we built, which was then put through rigorous quality assurance (QA) to ensure that we did not miss any steps and that each step was correctly applied.
Even after automating our hardening process, we still put our images through the same rigorous QA to ensure that each image that we release is complete, functional, and hardened the same way.
Sure, you could spend hours performing all of these steps yourself each time a new CentOS release is announced, but why would you want to? Our images are vetted, available and, best of all, include support from our team of Tier 3/4 open source architects and engineers.
The AWS images include 9x5 support which may very well cover your support needs.
But if you need 24x7 support, you're better off getting in touch with the OpenLogic CentOS experts. Our experts can help you ensure security with CentOS on AWS — and so much more.
In fact, when you choose CentOS supported by OpenLogic, you'll get:
Get in touch with a CentOS expert today to learn how we can help you.
Talk to an Expert
Enterprise Linux Developer, OpenLogic by Perforce
Rich Alloway has over 25 years of professional Linux experience in academic, Internet service provider and telco carrier environments. He has filled many production roles: SysAdmin, Systems/Network/RF Engineer and CTO. He is currently a member of the Enterprise Linux Team at OpenLogic by Perforce, and serves as a contributor on the Rocky Linux QA and Testing Team.