Getting started on Google Cloud

This page explains how to launch the ToTheNOC Hardened AlmaLinux 9 image on Google Compute Engine, how to connect to it, and how to check that it is healthy and hardened. How the image is built and verified, and the evidence for each release: Hardened images.

Status: submitted to Google Cloud Marketplace, in review. The steps below apply once the listing is live.

What you get

  • AlmaLinux 9, x86_64, fully updated at build time, hardened with the ComplianceAsCode “CIS Level 1 Server” profile.
  • On a running instance: 265 automated checks pass, 0 fail, 30 not applicable.
  • SELinux enforcing, firewalld in the “public” zone with only SSH open, /tmp mounted noexec, a GRUB password and a root password generated at first boot, unique to the instance and stored nowhere.
  • No application layer: the image is the OS foundation. You add your own software on top.

1. Launch

  1. Open the listing on Google Cloud Marketplace and click Launch.
  2. Choose the project, zone and machine type. The image is built and tested on E2 machine types; any x86_64 machine type that runs AlmaLinux 9 works.
  3. Keep the boot disk at 20 GB or more.
  4. Network: make sure a VPC firewall rule allows TCP 22 from the addresses you connect from. Allow only what you need; the image itself accepts nothing but SSH.

2. Connect over SSH

The image accepts SSH keys only. Root cannot log in over SSH, passwords are refused, and only members of the sshusers group can connect. The Google guest agent creates the user for each SSH key in the instance or project metadata and adds it to sshusers and to google-sudoers, so a key added through Compute Engine works without any change inside the VM:

gcloud compute ssh INSTANCE_NAME --zone ZONE

or add your public key under Edit > SSH Keys on the instance and connect with your own client as that user.

OS Login is not supported in this release. OS Login users are not members of sshusers, so sshd refuses them. If OS Login is enabled on your project, set the metadata key enable-oslogin to FALSE on these instances, or tell us that you need it (see Support).

3. Check that it is healthy

After you connect, these commands should give these answers:

Command Expected
systemctl is-system-running running (no failed units)
getenforce Enforcing
sudo firewall-cmd --get-active-zones public, with your network interface
sudo firewall-cmd --list-services ssh
findmnt /tmp tmpfs, with noexec

If the instance does not answer on SSH, read its boot log without logging in:

gcloud compute instances get-serial-port-output INSTANCE_NAME --zone ZONE

4. Check that it is hardened

sudo ttn-cis-audit; echo "exit code: $?"

It runs the same OpenSCAP scan, with the same tailoring, that we run on every release before it is published. The report and the raw results go to /var/tmp/ttn-audit. Exit code 0 means every rule passed, 2 means at least one failed. Run it again after you change the system, to see what your changes did to the result.

5. Open another port

Two layers decide what reaches the instance: the VPC firewall rule in Google Cloud and firewalld inside the VM. A service is reachable only when both allow it. For example, for HTTPS:

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

and a VPC firewall rule for TCP 443 on the instance’s network tag.

6. Send the journal to your log collector

The CIS profile expects the journal to be sent to a remote collector. The URL is yours, so the image ships the service installed and off. To turn it on:

sudo ttn-journal-upload https://your-collector:19532

You can also put the same command in a startup script at launch. From then on sudo ttn-cis-audit checks those rules too, against the URL you configured. sudo ttn-journal-upload --off turns it off again.

Passwords and recovery

There is no password in the image. The GRUB password and the root password are generated at first boot, on the instance, and are not stored or sent anywhere, so nobody (including us) can use them. You get in with your SSH key and sudo. If you lose SSH access, do what you would do for any Compute Engine instance with no console password: add a new SSH key to the metadata, or stop the instance, attach its boot disk to another VM and repair it there.

Updates

Update the instance as you would any AlmaLinux 9 system: sudo dnf upgrade. We rebuild and re-verify the image when a fix for a high or critical vulnerability is available in AlmaLinux, and publish each new release with its evidence on the Hardened images page.

Support

Questions, problems, or a rule you need changed for your environment: support@tothenoc.com. You get an answer from the engineer who builds the image.