Ctrlk
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Platform9 OS CIS Hardening

Review the CIS compliance posture of a Platform9 OS host, reported live from the OS Hardening page in the Host Management Console.

Overview

Platform9 OS ships pre-hardened against the CIS RHEL 10 Benchmark. Every host reports its live compliance status through the OS Hardening page in the Host Management Console, rather than through a static document. This page explains what that report shows, why some controls are intentionally relaxed, and how to export the full report. It assumes you have already reached the Host Management Console (see Host Management Console).

In this guide, you will learn how to read the OS Hardening page's compliance breakdown and export a report for audit purposes.

Hardening Baseline

Platform9 OS is scanned against:

  • Benchmark: CIS RHEL 10 Benchmark v1.0.1 (2025-09-30)

  • Profile: Level 1 - Server

  • Baseline: PCD Hardening Baseline v1

  • Scanner: OpenSCAP 1.4.4

First-Boot Hardening Flow

On first boot, a pcd-hardening-remediate service runs oscap xccdf eval --remediate against the baseline, applying the CIS controls to the host. Once remediation completes, a pcd-hardening-scan service re-scans the host without remediating, producing the compliance report shown on the OS Hardening page. Both services run automatically as part of first boot; no operator action is needed.

Artifacts from both runs are written to /var/log/pcd-hardening/, including the remediation results and the final compliance report in HTML, XCCDF, and ARF formats.

Reading the OS Hardening Page

The OS Hardening page shows a real-time breakdown of every control in the baseline, categorized as:

  • Passed: the control is compliant.

  • Failed: the control is not compliant.

  • Not Applicable: the control does not apply to this host's configuration.

  • Relaxed for PCD: the control is intentionally not enforced at the OS level, because PCD owns the equivalent behavior at a different layer.

Each control also reports a compliance score summarizing the overall pass rate for the host.

Each Relaxed for PCD control carries a stated reason on the page. Representative categories of why a control is relaxed include:

  • Firewall and IP forwarding controls: the Networking Service manages firewalld/nftables rules and IP forwarding sysctl settings directly, so the equivalent OS-level firewall lockdown controls are relaxed.

  • SELinux enforcement: the host runs SELinux in permissive mode rather than enforcing mode.

  • AIDE and USBGuard: these controls are disabled.

  • GRUB password for unattended reboot: the control requiring a GRUB bootloader password is relaxed so that hosts can reboot unattended.

  • /tmp and /var/tmp noexec: the controls requiring noexec on these mounts are relaxed because QEMU/libvirt helper processes need to execute from these paths.

  • rpcbind: the control requiring rpcbind to be disabled is relaxed as an intentional hardening relaxation.

Because the live page always reflects the host's current, authoritative compliance state, this page does not reproduce the full control list. Use the OS Hardening page (or its exported report) as the source of truth for a specific host's compliance detail.

Exporting a Report

The OS Hardening page supports exporting the full compliance report for audit or record-keeping, in any of the following formats:

  • HTML

  • XCCDF

  • ARF

Limitations

  • First-boot remediation takes time. Because oscap --remediate runs synchronously as part of first boot, SSH or console access to the host may be unresponsive for up to a few minutes immediately after first boot while remediation completes.

  • CIS Level 2 partition-layout rules are deferred. The current baseline covers CIS Level 1 in full; Level 2 partition-layout controls are not yet implemented.

Related Pages

PreviousNetwork Boot (PXE)
NextAccept Certificate Authority

Last updated

Was this helpful?