Skip to content
AlmaLinux Community Docs
AlmaLinux
Docs networkNetwork
Search AlmaLinux

    Browse this documentation

    AlmaLinux Security Hardening Guide

    The right order for hardening is baseline first, tools second. AlmaLinux’s advantage is that the official SCAP toolchain and ready-made baseline profiles ship with it: hardening is not changing settings by feel, it is scanning against a profile and closing the gaps.

    Accounts and authentication baseline

    Section titled “Accounts and authentication baseline”

    Close the login-related openings first: ordinary users use sudo instead of sharing root; SSH turns off password login and uses keys; idle sessions and password aging follow your organization’s policy. These are general baselines. After changing them, spot-check the login records with last and lastlog.

    SELinux and the firewall

    Section titled “SELinux and the firewall”

    Keeping SELinux in enforcing mode is the floor: use temporary permissive mode while troubleshooting, and do not take the shortcut of disabling it. Tidy the firewalld zones and services as default deny, allow on demand, and record the result with firewall-cmd --list-all once you are done. The tools for these two areas are the same as in the general tutorials maintained on the hub site: SELinux basics and firewalld basics.

    SCAP toolchain: what to install

    Section titled “SCAP toolchain: what to install”

    The four packages listed by the official OpenSCAP guide (written for AlmaLinux 8; check your own version) are all in the AppStream repository:

    • openscap - the OpenSCAP library and evaluation tool that assesses the system and produces reports;
    • openscap-utils - command-line tools built on that library;
    • openscap-scanner - enables SCAP capabilities such as vulnerability and configuration scanning, and connects to the SCAP Security Guide;
    • scap-security-guide - system hardening guides in SCAP format, with the compliance profiles built in.

    Built-in baseline profiles

    Section titled “Built-in baseline profiles”

    According to the official guide, the AlmaLinux 8 content in scap-security-guide covers the common compliance frameworks: the CIS AlmaLinux OS 8 Benchmark (Server and Workstation variants at Level 1 and 2), ANSSI-BP-028, the Protection Profile for General Purpose Operating Systems (OSPP), PCI-DSS v3.2.1 and DISA STIG, among others. The guide notes that the profiles available on your system may differ from its list.

    Choosing the profile matters more than choosing the tool: first confirm which framework your auditor accepts.

    Install and first scan

    Section titled “Install and first scan”
    Terminal window
    sudo dnf install openscap openscap-utils scap-security-guide

    After installation the security content is under /usr/share/xml/scap/ssg/content/. Use oscap to run a first assessment against the profile you picked, order the failed items in the report by risk and close them, then rescan and keep the result. For connecting errata data with scanning see Security errata tracking.

    Section titled “Related pages”