Hardened RHEL 9 Azure Image
Budget: $30 – $250 USD
I need a reusable golden template of the latest RHEL 9 release, fully aligned with CIS Benchmark Level 1, for a strictly cloud-based Azure deployment. The goal is to spin up secure, compliant VMs in minutes without having to run post-provisioning hardening each time.
You may rely on automation tools you’re comfortable with—Packer, Ansible, Cloud-Init, or Azure Image Builder are all acceptable as long as the end product is an Azure-ready image (or managed image) that I can register in my subscription and launch through the portal, ARM/Bicep, or Terraform.
Acceptance criteria
• Image boots in Azure, attaches to the Red Hat Update Infrastructure, and registers successfully
• A CIS-CAT or comparable scan shows 100 % compliance with CIS RHEL 9 Level 1 recommendations out of the box
• SSH works with key-based login only; root password login remains disabled
• All services not required by CIS Level 1 are removed or masked
• Deliverables include build scripts, a plain-language README, and a compliance report so I can reproduce the image in future updates
If you have recent experience hardening RHEL or building secure Azure images, let’s get started.
mandatorily remediation for env
• SSH hardening controls (e.g., disabling root login, limiting SSH access, enforcing secure configuration)
• Firewall configuration (firewalld enabled)
• Login and SSH warning banners
• Hardening of temporary filesystems (/tmp, /var/tmp, /dev/shm)
• Disabling unnecessary services(e.g., systemd-journal-remote where not required)
You may rely on automation tools you’re comfortable with—Packer, Ansible, Cloud-Init, or Azure Image Builder are all acceptable as long as the end product is an Azure-ready image (or managed image) that I can register in my subscription and launch through the portal, ARM/Bicep, or Terraform.
Acceptance criteria
• Image boots in Azure, attaches to the Red Hat Update Infrastructure, and registers successfully
• A CIS-CAT or comparable scan shows 100 % compliance with CIS RHEL 9 Level 1 recommendations out of the box
• SSH works with key-based login only; root password login remains disabled
• All services not required by CIS Level 1 are removed or masked
• Deliverables include build scripts, a plain-language README, and a compliance report so I can reproduce the image in future updates
If you have recent experience hardening RHEL or building secure Azure images, let’s get started.
mandatorily remediation for env
• SSH hardening controls (e.g., disabling root login, limiting SSH access, enforcing secure configuration)
• Firewall configuration (firewalld enabled)
• Login and SSH warning banners
• Hardening of temporary filesystems (/tmp, /var/tmp, /dev/shm)
• Disabling unnecessary services(e.g., systemd-journal-remote where not required)