Quick Start

From AWS Marketplace subscription to a verified running instance in under 10 minutes.

Launch steps

# CLI option — create SG with your current IP only
aws ec2 authorize-security-group-ingress \
  --group-id sg-xxxxxxxxx \
  --protocol tcp --port 22 \
  --cidr $(curl -s ifconfig.me)/32

ssh -i /path/to/your-key.pem ec2-user@PUBLIC_IP

# SELinux enforcing
sudo getenforce

# Auditd running
sudo systemctl status auditd | grep Active

# Firewalld running
sudo systemctl status firewalld | grep Active

# Compliance manifest
cat /opt/PTG/compliance/manifest.txt

# Full Lynis scan (3–5 min)
sudo lynis audit system

Requirements

Everything required before launching a PTG Hardened RHEL 9 instance.

Instance requirements

Supported instance types

Network requirements

• Outbound internet access on port 443/80 for dnf-automatic security updates
• Inbound SSH port 22 from your management IP — restrict to your IP, not 0.0.0.0/0 in production
• For SSM Session Manager: VPC endpoint for SSM or NAT Gateway with outbound 443

IAM requirements

CIS Level 2 Hardening

All hardening is applied at build time using the ansible-lockdown RHEL9-CIS role. Controls are baked into the AMI, not applied at runtime, so every instance launches in a known verified state.

SSH Configuration

Applied to /etc/ssh/sshd_config at build time.

sudo grep -E "^(PermitRootLogin|PasswordAuthentication|MaxAuthTries|X11Forwarding)" /etc/ssh/sshd_config

SELinux

SELinux enforcing mode with targeted policy. Configured in /etc/selinux/config — persists across reboots. Cannot be changed without root access and a reboot.

# Current enforcement mode
getenforce

# Full status
sestatus

# Check policy from config file matches running mode
sestatus | grep "from config file"

Firewalld

Active with default zone drop. All inbound blocked except SSH (port 22). Add application ports after launch.

# View all active rules
sudo firewall-cmd --list-all

# Add a port for your application
sudo firewall-cmd --permanent --add-port=443/tcp
sudo firewall-cmd --reload

# Check default zone
sudo firewall-cmd --get-default-zone

Auditd

Running with full CIS audit ruleset. Immutable flag -e 2 set — rules cannot change without a reboot. Logs to /var/log/audit/audit.log.

# Service status
sudo systemctl status auditd

# Confirm immutable flag (enabled 2 = immutable)
sudo auditctl -s | grep enabled

# View loaded audit rules
sudo auditctl -l | head -30

# Search recent audit events
sudo ausearch -ts recent | head -40

Kernel Sysctl Hardening

CIS and Lynis recommended values applied via /etc/sysctl.d/99-ptg-lynis.conf.

Security Stack

Pre-installed, pre-configured tools active on every instance from first boot.

Fail2ban — Intrusion Prevention

Monitors /var/log/secure for SSH failures. The SSH jail is active and configured out of the box.

# View SSH jail status and banned IPs
sudo fail2ban-client status sshd

# Manually unban an IP
sudo fail2ban-client set sshd unbanip IP_ADDRESS

# View fail2ban log
sudo tail -f /var/log/fail2ban.log

AIDE — File Integrity Monitoring

AIDE monitors the filesystem for unauthorized changes. Initialize your baseline database after you finish configuring your application files, then check against it regularly.

# Initialize baseline (run after full app setup)
sudo aide --init
sudo mv /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

# Run integrity check against baseline
sudo aide --check

# Update database after intentional changes
sudo aide --update

rkhunter — Rootkit Detection

# Update signatures
sudo rkhunter --update

# Run full scan
sudo rkhunter --check --skip-keypress

# View warnings only
sudo grep -i warning /var/log/rkhunter.log

dnf-automatic — Unattended Security Updates

Security patches applied automatically on a daily timer. No manual intervention required.

# Verify timer is active
sudo systemctl status dnf-automatic-install.timer

# View update history
sudo dnf history list | head -20

Compiler Access Restriction

GCC and Make are set to 0750 permissions — root access only. Non-root users cannot compile code, reducing post-exploitation attack surface.

Compliance & Scoring

Every PTG image is scored with Lynis before release. The score reflects controls actively applied in the AMI — not theoretical compliance.

Lynis Hardening Score

Known Lynis suggestions — by design

The following suggestions appear in Lynis output and are intentional architectural decisions, not oversights.

CIS benchmark sections applied

• Section 1 — Filesystem configuration, kernel module blacklisting, /tmp hardening
• Section 2 — Services — unnecessary services disabled, inetd removed
• Section 3 — Network configuration — full IPv4 and IPv6 stack hardening
• Section 4 — Firewall — firewalld enforced with default deny policy
• Section 5 — SSH server hardening — full key-pair enforcement, all forwarding disabled
• Section 6 — Logging and auditing — auditd with complete CIS ruleset, immutable flag
• Section 7 — User accounts — password policies, locked accounts, PAM, sudoers

Connecting to Your Instance

Two connection methods are supported. SSH password authentication is permanently disabled — key-pair or SSM only.

Method 1 — SSH with key pair

# Connect as ec2-user
ssh -i /path/to/your-key.pem ec2-user@PUBLIC_IP

# Escalate to root
sudo su -

# Or run a single command as root
sudo COMMAND

Method 2 — AWS Systems Manager Session Manager

SSM Agent is pre-installed and running. Attach AmazonSSMManagedInstanceCore to your instance role to connect without opening any inbound ports.

# Start a session (requires AWS CLI v2 + session-manager-plugin)
aws ssm start-session --target INSTANCE_ID

# Verify SSM agent is running
sudo systemctl status amazon-ssm-agent

Default user reference

Post-Launch Validation

Run these commands after every launch to confirm all security controls are active. Under 5 minutes manually — or use the PTG validation playbook for automated reporting.

Full verification script

#!/bin/bash
# PTG RHEL 9 — Post-launch verification

echo "=== SELinux ==="
getenforce

echo "=== Auditd ==="
sudo systemctl is-active auditd
sudo auditctl -s | grep enabled

echo "=== Firewalld ==="
sudo systemctl is-active firewalld
sudo firewall-cmd --state

echo "=== Fail2ban ==="
sudo systemctl is-active fail2ban
sudo fail2ban-client status sshd

echo "=== SSH Hardening ==="
sudo grep -E "^(PermitRootLogin|PasswordAuthentication|MaxAuthTries)" /etc/ssh/sshd_config

echo "=== Compliance Manifest ==="
cat /opt/PTG/compliance/manifest.txt

echo "=== Lynis Score ==="
sudo lynis audit system 2>/dev/null | grep "Hardening index"

Expected outputs

Compliance Manifest

Every instance built from this AMI contains a compliance manifest generated at build time at /opt/PTG/compliance/manifest.txt.

cat /opt/PTG/compliance/manifest.txt

Sample manifest

------------------------------------------------
PTG HARDENED IMAGE MANIFEST
Build Date: 2026-04-09
OS: RHEL 9 / AlmaLinux 9
Compliance Level: CIS Level 2
SSH Hardening: Enabled
Firewall: firewalld Active
SELinux: Enforcing
Auditd: Enabled
Fail2ban: Active (SSH jail enabled)
Process Accounting: psacct + sysstat Active
Lynis Sysctl Hardening: Applied (99-ptg-lynis.conf)
Firewire: Blacklisted
Core Dumps: Disabled
File Permissions: Hardened
Legal Banners: /etc/issue + /etc/issue.net
Compiler Access: Restricted to root
PTG Standard: Secure at Every Stage
------------------------------------------------

Changelog

v1.0 — April 2026 Initial Release

• CIS Level 2 hardening via ansible-lockdown RHEL9-CIS role
• SELinux enforcing mode — targeted policy
• auditd with full CIS ruleset and -e 2 immutable flag
• firewalld active — default zone drop, SSH explicitly allowed
• fail2ban with SSH jail — 5 retries, 1-hour ban
• AIDE file integrity monitoring pre-installed and configured
• rkhunter rootkit detection pre-installed
• dnf-automatic enabled for unattended daily security updates
• Lynis sysctl hardening profile — 99-ptg-lynis.conf
• Firewire blacklisted, core dumps disabled via limits.conf
• Compiler access restricted to root — gcc and make chmod 750
• psacct and sysstat process accounting enabled
• Legal banners on /etc/issue and /etc/issue.net
• Compliance manifest at /opt/PTG/compliance/manifest.txt
• No baked-in SSH authorized keys — regenerated on first boot
• Available in us-east-1, us-west-2, eu-west-1, ap-southeast-1
• Lynis hardening score: 87 / 100

Support

PTG provides email support for all AWS Marketplace subscribers. 48-hour response time Monday through Friday, Eastern Time.

Contact

What support covers

• Questions about pre-installed security controls and their configuration
• Guidance on CIS compliance controls applied in this image
• Assistance verifying hardening settings after launch
• Explanation of Lynis findings and which are intentional design decisions
• Help running or interpreting the PTG validation playbook output

What support does not cover

• Application-level configuration built on top of the base image
• AWS account, billing, or EC2 service issues — contact AWS Support
• Modifications that intentionally reduce the hardening level