AlmaLinux 8 LVM on AWS User Guide

Overview

This guide covers launching and verifying the AlmaLinux 8 LVM AMI from cloudimg on Amazon EC2. It is one version of the cloudimg AlmaLinux listing on AWS Marketplace; you pick it as the software version when you subscribe and launch. Every release and variant in the listing is described at /guides/almalinux-aws/.

AlmaLinux 8 is a free, community-built enterprise Linux distribution that is binary compatible with Red Hat Enterprise Linux 8, with security updates until 2029. This image starts from the official AlmaLinux 8.10 image for EC2 and adds four things:

• A hardened LVM disk layout. The root filesystem and six benchmark mount points are separate XFS logical volumes in the volume group almalinux: /home, /tmp, /var, /var/tmp, /var/log and /var/log/audit. Each is mounted nodev,nosuid, and /tmp, /var/tmp, /var/log and /var/log/audit are also noexec. A full log or temp volume cannot fill the root filesystem, and you can grow any volume on its own (Step 12).
• CIS Level 1 Server remediation. The image is remediated with the OpenSCAP CIS Level 1 Server profile from SCAP Security Guide 0.1.82 (AlmaLinux's own signed scap-security-guide package), then rebooted and evaluated. Because the partitions are real, the benchmark's partition and mount option rules are applied and scored rather than waived. On this build all 311 scored rules pass (100.0%). Seven rules are waived because they cannot work on an EC2 image, each with its reason. The HTML report, the machine-readable results, the waiver list and a summary ship in /usr/share/doc/cloudimg/.
• EC2 defaults that keep you in control. Key-only SSH as ec2-user, root locked, no password on any account, SELinux enforcing, IMDSv2 required, a host firewall (firewalld) that allows SSH in and everything out, the current AWS Systems Manager agent, and time from the Amazon Time Sync Service. EC2 Instance Connect, which the base image carried as an unsigned package from outside the AlmaLinux repositories, is removed (see Step 11).
• Fully patched at build time, with dnf-automatic applying security updates on your instance.

What is on the image: AlmaLinux 8.10 (the RHEL 8 compatible 4.18 kernel), LVM2, cloud-init, OpenSSH, firewalld, chrony, SELinux (targeted policy, enforcing), the AWS Systems Manager agent, auditd, rsyslog, AIDE file integrity checking, dnf-automatic, Python 3.6, OpenSCAP and the pinned SCAP Security Guide content used for the evaluation.

Default user: ec2-user · Architecture: x86_64 · Boot mode: legacy BIOS · Root volume: 12 GiB gp3, one LVM physical volume holding seven XFS logical volumes

These images are remediated with an OpenSCAP profile and ship their own evaluation report. They are not CIS Hardened Images, and CIS has not reviewed or certified them.

Connecting to your instance

Version	SSH user	Root device
AlmaLinux 8 LVM	ec2-user	/dev/xvda (12 GiB gp3)

Security posture

• No known credential. There is no default password and no baked in SSH key. The only key that works is the EC2 key pair you choose at launch, which cloud-init installs for ec2-user on first boot. The SSH server has no other way to look up keys (no AuthorizedKeysCommand).
• Key-only SSH. PasswordAuthentication no, PermitRootLogin no, challenge-response off. The root account has no password and is locked.
• Per-instance identity. SSH host keys and the machine ID are generated fresh on every instance, so no two instances share a host key. The private host keys are readable by root only.
• IMDSv2 required. The AMI is registered with ImdsSupport v2.0, so instances launched from it refuse token-less (IMDSv1) metadata requests by default.
• SELinux enforcing with the targeted policy, as AlmaLinux ships it.
• Separate, restricted volumes. Temporary and log directories cannot hold device files, set-user-ID programs or executables, and filling one of them does not fill the root filesystem.
• Host firewall. firewalld's public zone allows only SSH and the DHCPv6 client inbound and allows all outbound traffic, so the SSM agent, metadata service, DNS, time and package updates keep working.
• Only SSH listens on the network. Nothing else on the image listens on any address.

Prerequisites

1. An AWS account and permission to launch EC2 instances
2. An EC2 key pair in the Region you launch in
3. A security group that allows TCP 22 from your own address (not from the whole internet)

Recommended instance type: m5.large. The image runs on any current x86_64 instance type.

Step 1: Launch the instance

Option A: AWS Marketplace console

1. Open the cloudimg AlmaLinux listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every version in the listing.
2. Once the subscription is active, choose Launch your software.
3. Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control), then in Version choose AlmaLinux 8 LVM - YYYY-MM-DD (the date is when the version was added) and your Region.
4. Instance type: m5.large is recommended; any current x86_64 type works. The software charge is $0.04 per vCPU per hour.
5. Key pair: choose your EC2 key pair. It is the only way in. RSA and ED25519 keys both work.
6. Security group: allow inbound TCP 22 from your own IP address or network only.
7. Storage: the root volume is 12 GiB gp3 by default. You can choose a larger size; the extra space stays unallocated in the LVM physical volume until you give it to the volumes you choose (Step 12).
8. Metadata: leave the defaults. The image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run this on your own workstation. Replace the AMI ID with the one shown for your Region on the Marketplace launch page, and the key pair, security group and subnet with your own. The root device of this AMI is /dev/xvda:

aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids sg-0123456789abcdef0 \
  --subnet-id subnet-0123456789abcdef0 \
  --block-device-mappings 'DeviceName=/dev/xvda,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=almalinux-8-lvm}]'

You do not need --metadata-options: the AMI already makes IMDSv2 required.

Step 2: Connect via SSH

From your workstation, connect as ec2-user with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

There is no password to enter. If SSH asks for one, or says Too many authentication failures, see Troubleshooting below.

You can also connect without opening port 22 at all through AWS Systems Manager Session Manager, if the instance has an instance profile that allows Systems Manager. The agent is installed and running on this image.

Step 3: Confirm the release

cat /etc/almalinux-release
grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID|PRETTY_NAME)=' /etc/os-release
uname -srm

Expected output:

AlmaLinux release 8.10 (Cerulean Leopard)
NAME="AlmaLinux"
VERSION="8.10 (Cerulean Leopard)"
ID="almalinux"
VERSION_ID="8.10"
PLATFORM_ID="platform:el8"
PRETTY_NAME="AlmaLinux 8.10 (Cerulean Leopard)"
Linux 4.18.0-553.174.1.el8_10.x86_64 x86_64

AlmaLinux 8.10 is the final minor release of AlmaLinux 8. Updates keep arriving through normal dnf updates until AlmaLinux 8 reaches its end of life in 2029. Your kernel version may be newer if updates have installed since this image was built.

Step 4: See the LVM layout

The disk and its volumes:

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT /dev/nvme0n1

Expected output with the default 12 GiB root volume:

NAME                         SIZE TYPE FSTYPE      MOUNTPOINT
nvme0n1                       12G disk             
├─nvme0n1p1                    1M part             
├─nvme0n1p2                  200M part vfat        /boot/efi
├─nvme0n1p3                    1G part xfs         /boot
└─nvme0n1p4                 10.8G part LVM2_member 
  ├─almalinux-root             4G lvm  xfs         /
  ├─almalinux-home             1G lvm  xfs         /home
  ├─almalinux-tmp              1G lvm  xfs         /tmp
  ├─almalinux-var            1.5G lvm  xfs         /var
  ├─almalinux-var_tmp        512M lvm  xfs         /var/tmp
  ├─almalinux-var_log          1G lvm  xfs         /var/log
  └─almalinux-var_log_audit    1G lvm  xfs         /var/log/audit

The volume group, its logical volumes and the mount options each volume carries:

sudo vgs
sudo lvs -o lv_name,lv_size,lv_path almalinux
for m in / /home /tmp /var /var/tmp /var/log /var/log/audit /boot /dev/shm; do printf '%-15s %-36s %s\n' "$m" "$(findmnt -no SOURCE "$m")" "$(findmnt -no OPTIONS "$m" | tr , '\n' | grep -xE 'rw|ro|nodev|nosuid|noexec' | paste -sd, -)"; done

Expected output:

  VG        #PV #LV #SN Attr   VSize  VFree  
  almalinux   1   7   0 wz--n- 10.80g 820.00m
  LV            LSize   Path                        
  home            1.00g /dev/almalinux/home         
  root            4.00g /dev/almalinux/root         
  tmp             1.00g /dev/almalinux/tmp          
  var             1.50g /dev/almalinux/var          
  var_log         1.00g /dev/almalinux/var_log      
  var_log_audit   1.00g /dev/almalinux/var_log_audit
  var_tmp       512.00m /dev/almalinux/var_tmp      
/               /dev/mapper/almalinux-root           rw
/home           /dev/mapper/almalinux-home           rw,nosuid,nodev
/tmp            /dev/mapper/almalinux-tmp            rw,nosuid,nodev,noexec
/var            /dev/mapper/almalinux-var            rw,nosuid,nodev
/var/tmp        /dev/mapper/almalinux-var_tmp        rw,nosuid,nodev,noexec
/var/log        /dev/mapper/almalinux-var_log        rw,nosuid,nodev,noexec
/var/log/audit  /dev/mapper/almalinux-var_log_audit  rw,nosuid,nodev,noexec
/boot           /dev/nvme0n1p3                       rw,nosuid,nodev
/dev/shm        tmpfs                                rw,nosuid,nodev,noexec

• The disk has a 1 MiB BIOS boot partition, a 200 MiB EFI system partition, a 1 GiB /boot (XFS) and one LVM physical volume. The AMI boots in legacy BIOS mode.
• The mount options are set in /etc/fstab by filesystem UUID, so they survive reboots and apply on every instance launched from the image. The last column shows the options that matter for the benchmark; findmnt lists the rest.
• The volume group keeps 820 MiB free at the default size, so you can grow the volume that fills first without touching EBS (Step 12).

The kernel finds its root filesystem on the logical volume. On AlmaLinux 8 every boot entry takes its kernel arguments from the kernelopts variable in the GRUB environment block, and that names the logical volume too, so every kernel that a future update installs boots from the logical volume as well:

grep -o 'root=[^ ]*\|rd.lvm[^ ]*' /proc/cmdline | sort -u
sudo grub2-editenv list | grep -o 'root=[^ ]*\|rd.lvm[^ ]*' | sort -u
sudo sh -c 'grep -h "^options" /boot/loader/entries/*.conf' | sort -u
rpm -q lvm2 cloud-utils-growpart xfsprogs

Expected output:

rd.lvm.lv=almalinux/root
root=/dev/mapper/almalinux-root
rd.lvm.lv=almalinux/root
root=/dev/mapper/almalinux-root
options $kernelopts $tuned_params
lvm2-2.03.14-15.el8_10.3.x86_64
cloud-utils-growpart-0.33-0.el8.noarch
xfsprogs-5.0.0-12.el8.x86_64

Step 5: Read the compliance evidence

The evaluation the build ran after its reboot ships on the image:

ls -lh /usr/share/doc/cloudimg/
python3 -c "import json; s=json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json')); print('profile:      ', s['profileLabel'], '(SCAP Security Guide', s['ssgVersion'] + ')'); print('scored rules: ', s['scored'], ' pass:', s['pass'], ' fail:', s['fail'], ' rate:', str(s['ratePct']) + '%'); print('waived:       ', s['waived'], ' not applicable:', s['notapplicable']); print('evaluated at: ', s['evaluatedAt'])"

Expected output:

total 38M
-rw-r--r--. 1 root root  36M Oct 19 18:01 cis-l1-arf.xml
-rw-r--r--. 1 root root 2.5M Oct 19 18:01 cis-l1-report.html
-rw-r--r--. 1 root root 1.2K Oct 19 18:01 cis-l1-summary.json
-rw-r--r--. 1 root root 1.8K Oct 19 18:01 cis-l1-tailoring.xml
-rw-r--r--. 1 root root 2.9K Oct 19 18:01 cis-l1-waivers.txt
-rw-r--r--. 1 root root 1.6K Oct 19 17:50 scap-security-guide-LICENSE.txt
profile:       CIS Level 1 Server (SCAP Security Guide 0.1.82)
scored rules:  311  pass: 311  fail: 0  rate: 100.0%
waived:        7  not applicable: 22
evaluated at:  2026-10-19T18:01:34Z

• cis-l1-report.html is the full OpenSCAP report, rule by rule. Copy it to your workstation and open it in a browser.
• cis-l1-arf.xml is the same evaluation in the machine-readable ARF format, for compliance tooling.
• cis-l1-tailoring.xml is the exact tailoring used, so you can re-run the same evaluation (Step 6).
• The pass rate is pass / (pass + fail + error + unknown). Rules that are not applicable to this machine, not selected, or waived are not counted.
• Compared with the single-volume versions of this listing, the partition rules (/tmp, /var, /var/tmp, /var/log, /var/log/audit and /home on their own partitions, and their mount options) are scored here and pass.

To copy the report to your workstation, run this on the workstation:

scp -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>:/usr/share/doc/cloudimg/cis-l1-report.html .

The seven waived rules

grep -v '^#' /usr/share/doc/cloudimg/cis-l1-waivers.txt | cut -f1,2

Expected output:

grub2_password  [serial-console-and-boot]
grub2_uefi_password [serial-console-and-boot]
ensure_root_password_configured [serial-console-and-boot]
accounts_maximum_age_login_defs [key-only-account-aging]
account_disable_post_pw_expiration  [key-only-account-aging]
sshd_limit_user_access  [ssh-access-list]
service_systemd-journal-upload_enabled  [log-remote-destination]

The full reason for each is the third column of the same file. In short:

• Boot loader and root passwords: a GRUB or root password would have to be baked into the image, giving every instance the same secret. Root stays locked with no password. Set your own if you need serial console access (see Step 11).
• Password ageing defaults: the accounts cloud-init creates are key-only. An ageing limit would expire them and lock the SSH key out. Accounts that do have a password are still aged.
• SSH AllowUsers/AllowGroups: a list fixed at build time would refuse accounts you create later. Your security group restricts who can reach port 22.
• Remote journal upload: the benchmark switches on systemd-journal-upload, which sends the system journal to a remote log server, but the image cannot know your log server. Switched on with no destination, the service fails at every boot. systemd-journal-remote is installed and the upload service is left off; to use it, see "Send the journal to your own log server" below.

Every scored rule passes

python3 -c "import json; print(json.load(open('/usr/share/doc/cloudimg/cis-l1-summary.json'))['failingRules'])"

Expected output:

[]

The list of failing rules is empty: every rule the profile scores on this image passes, including the partition and mount option rules. Rules that do not apply to an EC2 instance (for example wireless interfaces) are reported as not applicable and are not counted.

Send the journal to your own log server

If you run a systemd-journal-remote collector, point the image at it and switch the upload service on (replace the address with your collector's):

echo 'URL=https://logs.example.internal:19532' | sudo tee -a /etc/systemd/journal-upload.conf
sudo systemctl enable --now systemd-journal-upload

Step 6: Re-run the evaluation yourself

You can repeat the evaluation at any time with the same content and tailoring. It takes about a minute:

sudo oscap xccdf eval \
  --tailoring-file /usr/share/doc/cloudimg/cis-l1-tailoring.xml \
  --profile xccdf_co.cloudimg_profile_cis-l1_ec2_lvm \
  --results /tmp/cis-check-results.xml --report /tmp/cis-check-report.html \
  /usr/share/xml/scap/ssg/content/ssg-almalinux8-ds.xml > /tmp/cis-check.log 2>&1
echo "oscap exit code: $? (0 = every rule passed, 2 = at least one rule did not pass)"
sudo python3 -c "import re,collections; c=collections.Counter(re.findall(r'<result>(\w+)</result>', open('/tmp/cis-check-results.xml').read())); s=sum(c[k] for k in ('pass','fail','error','unknown')); print(dict(sorted(c.items()))); print('pass rate: %.1f%%' % (100.0*c['pass']/s))"

Expected output:

oscap exit code: 0 (0 = every rule passed, 2 = at least one rule did not pass)
{'notapplicable': 22, 'notselected': 1368, 'pass': 311}
pass rate: 100.0%

Your own report is at /tmp/cis-check-report.html. As you install software and change settings, re-run this to see how your changes affect the result. /tmp is noexec, which does not affect oscap: it runs its remediation and check scripts through their interpreter.

Step 7: Confirm IMDSv2 is required

curl -s -o /dev/null -w 'IMDSv1 request without a token: HTTP %{http_code}\n' http://169.254.169.254/latest/meta-data/instance-id
TOKEN=$(curl -s -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token)
curl -s -H "X-aws-ec2-metadata-token: $TOKEN" -w '\n' http://169.254.169.254/latest/meta-data/placement/region

Expected output (your Region may differ):

IMDSv1 request without a token: HTTP 401
us-east-1

A request without a session token is refused with HTTP 401, and the same request with a token works. Scripts and SDKs on the instance must use IMDSv2; every current AWS SDK and the AWS CLI do this automatically.

Step 8: The host firewall and listening ports

sudo firewall-cmd --state
sudo firewall-cmd --list-all
sudo ss -tlnp

Expected output:

running
public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources: 
  services: dhcpv6-client ssh
  ports: 
  protocols: 
  forward: no
  masquerade: no
  forward-ports: 
  source-ports: 
  icmp-blocks: 
  rich rules: 
State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess                        
LISTEN 0      128          0.0.0.0:22        0.0.0.0:*    users:(("sshd",pid=1025,fd=3))
LISTEN 0      128             [::]:22           [::]:*    users:(("sshd",pid=1025,fd=4))

• Only sshd listens, on port 22. Nothing else on the image opens a TCP port.
• The public zone allows ssh and dhcpv6-client (replies to the instance's IPv6 DHCP client, which is how an instance in an IPv6-enabled subnet gets its address). The AlmaLinux default cockpit service is removed from the zone; Cockpit is not installed.
• The loopback interface sits in firewalld's trusted zone, with rules that drop traffic claiming a loopback source from anywhere else (a CIS requirement).

Opening a port for your own service takes two steps: allow it in the instance's security group, and allow it in firewalld. For example, for a web server on 443, run on the instance:

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

If a port is open in the security group but not in firewalld (or the other way round), the traffic will not arrive.

Step 9: Time sync and the Systems Manager agent

systemctl is-active chronyd amazon-ssm-agent
chronyc -n sources

Expected output (the pool servers and timings vary):

active
active
MS Name/IP address         Stratum Poll Reach LastRx Last sample               
===============================================================================
^- 47.89.241.172                 3   6    17    19  -4062us[-4144us] +/-  114ms
^- 172.233.157.223               2   6    17    18    -13ms[  -13ms] +/-  135ms
^- 5.254.77.191                  2   6    17    19    -13us[  -95us] +/- 2897us
^- 40.160.237.131                2   6    17    15  -2446us[-2528us] +/-   50ms
^* 169.254.169.123               3   4    37     4   -446ns[  -83us] +/-  618us

The ^* marks the source chrony is using: 169.254.169.123, the Amazon Time Sync Service. It is reachable from every instance without internet access, so time stays correct in a private subnet too. The public AlmaLinux pool servers are fallbacks.

The AWS Systems Manager agent is installed from Amazon's own package at its current release (3.3.5390.0 on this build). It is not in the AlmaLinux repositories, so dnf does not update it; Systems Manager can keep it current for you (the AWS-UpdateSSMAgent document, or the Auto update SSM Agent setting in Fleet Manager).

Step 10: Patch level and automatic updates

The image is fully patched at build time. Check what is pending now:

sudo dnf -q check-update --refresh
echo "dnf check-update exit code: $? (0 = nothing to update, 100 = updates available)"
grep -E '^(upgrade_type|apply_updates)' /etc/dnf/automatic.conf
systemctl is-enabled dnf-automatic.timer
uname -r

Expected output on an instance launched soon after the image was built (later launches list the updates released since, with exit code 100):

dnf check-update exit code: 0 (0 = nothing to update, 100 = updates available)
upgrade_type = security
apply_updates = yes
enabled
4.18.0-553.174.1.el8_10.x86_64

dnf-automatic runs daily (06:00, with a random delay of up to an hour) and installs security updates automatically. To update everything now, run:

sudo dnf -y upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

A new kernel boots from the logical volume like the current one, because its boot entry reads the same kernelopts (Step 4).

Step 11: Security settings on the instance

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|maxauthtries|clientaliveinterval|banner|authorizedkeyscommand) '
cat /etc/issue.net
rpm -q --quiet ec2-instance-connect && echo "EC2 Instance Connect: installed" || echo "EC2 Instance Connect: not installed"
sudo ls -l /etc/ssh/ssh_host_ecdsa_key /etc/ssh/ssh_host_ed25519_key /etc/ssh/ssh_host_rsa_key

Expected output:

Enforcing
root LK 2026-09-28 0 99999 7 -1 (Password locked.)
maxauthtries 4
clientaliveinterval 300
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
banner /etc/issue.net
authorizedkeyscommand none
Authorized users only. All activity may be monitored and reported.
EC2 Instance Connect: not installed
-rw-------. 1 root ssh_keys  537 Oct 19 18:16 /etc/ssh/ssh_host_ecdsa_key
-rw-------. 1 root ssh_keys  432 Oct 19 18:16 /etc/ssh/ssh_host_ed25519_key
-rw-------. 1 root ssh_keys 2622 Oct 19 18:16 /etc/ssh/ssh_host_rsa_key

• Enforcing means SELinux is on and enforcing the targeted policy. Keep it on; if your own software is denied, check sudo ausearch -m avc -ts recent rather than disabling SELinux.
• LK means the root account is locked.
• maxauthtries 4 and clientaliveinterval 300 come from the CIS profile: SSH allows four authentication attempts per connection and checks idle sessions every five minutes.
• authorizedkeyscommand none: SSH reads keys only from each user's authorized_keys file.
• The banner text is shown before login.
• The SSH host keys are created on your instance's first boot and are readable by root only (-rw-------). AlmaLinux creates them group-readable by ssh_keys; a small boot service, cloudimg-sshd-hostkey-perms.service, tightens them to 0600 before the SSH server starts, which is what the CIS rule for host key permissions checks.

EC2 Instance Connect is not installed. The AlmaLinux 8 base image carried it as an unsigned package from outside the AlmaLinux repositories, so dnf could never update it, and it added a second way to authorise SSH keys (keys pushed through the EC2 Instance Connect API). It is removed so that your key pair is the only SSH credential. Use Session Manager (Step 2) for browser-based access.

EC2 Serial Console and recovery. No account on this image has a password, so the serial console cannot log in until you set one. If you want serial console access, set a password for your own user on your running instance (the password is yours and is not on the image):

sudo passwd ec2-user

Step 12: Growing a volume, swap and file integrity

sudo vgs almalinux
df -h / /var /var/log
sudo grep -E 'cc_growpart.py.*(SKIPPED|resized|NOCHANGE)' /var/log/cloud-init.log | tail -1 | cut -c1-150
swapon --noheadings --show | wc -l
sudo grep -h aide /etc/crontab

Expected output with the default 12 GiB root volume:

  VG        #PV #LV #SN Attr   VSize  VFree  
  almalinux   1   7   0 wz--n- 10.80g 820.00m
Filesystem                     Size  Used Avail Use% Mounted on
/dev/mapper/almalinux-root     4.0G  2.8G  1.3G  69% /
/dev/mapper/almalinux-var      1.5G  474M  1.1G  32% /var
/dev/mapper/almalinux-var_log 1014M   57M  958M   6% /var/log
2026-10-19 18:16:21,144 - cc_growpart.py[DEBUG]: '/' SKIPPED: Resizing mapped device (/dev/mapper/almalinux-root) skipped as it is not encrypted.
0
05 4 * * * root /usr/sbin/aide --check

The root volume has about 1.3 GiB free at the default size. Most of the 2.8 GiB in use is the operating system under /usr, including the linux-firmware package (about 1.6 GiB of firmware files that AlmaLinux 8 installs by default). Before you install large software, give / more space as shown below. The AlmaLinux 8 Minimal version of this listing removes linux-firmware if you want a smaller root.

cloud-init does not grow LVM volumes. On a single-volume AlmaLinux image cloud-init grows the root filesystem to the volume size on first boot. On this image the root filesystem is a logical volume, so cloud-init skips it (the SKIPPED line above). That is deliberate: you decide which volume gets the space. When you launch with a bigger root volume, or grow the EBS volume later with aws ec2 modify-volume, add the space in three steps on the instance:

1. Grow partition 4 (the LVM physical volume) to the end of the disk, and tell LVM:

sudo growpart /dev/nvme0n1 4
sudo pvresize /dev/nvme0n1p4

1. Give space to the volumes that need it. --resizefs grows the XFS filesystem in the same step, online, with no reboot:

sudo lvextend --resizefs -L +4G /dev/almalinux/root
sudo lvextend --resizefs -L +2G /dev/almalinux/var

1. Check the result:

sudo vgs almalinux
df -h / /var

Example output after growing a 12 GiB volume to 20 GiB and running the commands above (the filesystem geometry that xfs_growfs prints is shortened to ...):

CHANGED: partition=4 start=2510848 old: size=22654943 end=25165790 new: size=39432159 end=41943006
  Physical volume "/dev/nvme0n1p4" changed
  1 physical volume(s) resized or updated / 0 physical volume(s) not resized
  Size of logical volume almalinux/root changed from 4.00 GiB (1024 extents) to 8.00 GiB (2048 extents).
  Logical volume almalinux/root successfully resized.
meta-data=/dev/mapper/almalinux-root isize=512    agcount=8, agsize=131072 blks
...
data blocks changed from 1048576 to 2097152
  Size of logical volume almalinux/var changed from 1.50 GiB (384 extents) to 3.50 GiB (896 extents).
  Logical volume almalinux/var successfully resized.
meta-data=/dev/mapper/almalinux-var isize=512    agcount=8, agsize=49152 blks
...
data blocks changed from 393216 to 917504
  VG        #PV #LV #SN Attr   VSize  VFree
  almalinux   1   7   0 wz--n- 18.80g 2.80g
Filesystem                  Size  Used Avail Use% Mounted on
/dev/mapper/almalinux-root  8.0G  2.8G  5.3G  35% /
/dev/mapper/almalinux-var   3.5G  531M  3.0G  15% /var

To give a volume all the remaining free space instead, use -l +100%FREE, for example sudo lvextend --resizefs -l +100%FREE /dev/almalinux/var_log. Leaving some space unallocated is useful: you can grow whichever volume fills first without touching EBS. XFS volumes grow online but cannot shrink, so add space in steps.

• Adding a data volume. Attach a new EBS volume, then give it its own volume group (for example sudo pvcreate /dev/nvme1n1, sudo vgcreate datavg /dev/nvme1n1, sudo lvcreate -n data -l 100%FREE datavg, sudo mkfs.xfs /dev/datavg/data) and mount it from /etc/fstab by UUID with the nofail option, so the instance still boots if the volume is ever detached. Check the device name with lsblk first: on Nitro instances the second EBS volume is usually /dev/nvme1n1. The image ships no LVM devices file (/etc/lvm/devices/system.devices), so LVM sees every attached disk.
• Swap. The image has no swap. If your workload needs it, create a logical volume for it (for example sudo lvcreate -L 2G -n swap almalinux, then sudo mkswap /dev/almalinux/swap and an /etc/fstab entry), or a swap file on / or /var.
• AIDE. The file integrity database is built from the image's own files, and the CIS profile schedules aide --check daily at 04:05 from /etc/crontab.

Step 13: Install software and add users

The instance uses the standard AlmaLinux 8 repositories (BaseOS, AppStream and Extras):

sudo dnf -q list --available nginx

Expected output (the version changes over time):

Available Packages
nginx.x86_64      1:1.14.1-9.module_el8.10.0+4171+d7eec01b.alma.1      appstream

AlmaLinux 8 ships several versions of some software as application streams (for example sudo dnf module list nginx); sudo dnf module enable nginx:1.24 before installing picks a newer stream. Install and start software in the usual way, for example sudo dnf -y install nginx then sudo systemctl enable --now nginx, and open its port in the security group and firewalld (Step 8). Most software installs under /usr and /etc on the root volume and keeps its data and logs under /var, so watch the / and /var volumes as you add software and grow them as needed (Step 12). The AWS CLI is not on the image; install the current version from AWS (the AWS CLI install guide) if you need it.

To add another administrator, create the account, add it to the wheel group and give it an SSH key:

sudo useradd -m -G wheel alice
sudo install -d -m 700 -o alice -g alice /home/alice/.ssh
echo "ssh-ed25519 AAAA... alice@laptop" | sudo tee /home/alice/.ssh/authorized_keys
sudo chown alice:alice /home/alice/.ssh/authorized_keys && sudo chmod 600 /home/alice/.ssh/authorized_keys
sudo restorecon -R /home/alice/.ssh

Because SSH is key-only, a new account needs its key in authorized_keys (and restorecon gives the file the SELinux label sshd expects). The new account has no password, so sudo cannot authenticate it until you give it one with sudo passwd alice. SSH stays key-only; the password is used by sudo. (Only ec2-user, created by cloud-init, has password-free sudo.)

Common use cases

• A base for workloads that must show CIS Level 1 alignment on an enterprise Linux 8 with the partition rules applied, not waived, and the evaluation report already on the machine
• Servers whose logs, temporary files or home directories must not be able to fill the root filesystem
• Software certified or packaged for RHEL 8 compatible systems, with SELinux enforcing from the first boot
• Fleets managed through Systems Manager, with IMDSv2 required from the first boot
• A starting point for your own golden image: add your software, re-run Step 6, and keep the report with your build

Troubleshooting

SSH says "Too many authentication failures"

The SSH server allows four authentication attempts per connection. If your SSH agent holds several keys, it can use them up before it offers the right one. Tell SSH to offer only the key you name:

ssh -o IdentitiesOnly=yes -i ~/.ssh/my-key-pair.pem ec2-user@<public-ip>

Cannot connect via SSH

1. Check the instance is running and has passed its status checks.
2. Check the security group allows TCP 22 from your current public address.
3. Use the user name ec2-user and the key pair chosen at launch. Password login is disabled, so a wrong key never falls back to a password prompt.
4. If you changed firewalld, make sure the ssh service is still allowed. Session Manager (Step 2) still works if SSH is blocked, provided the instance has a Systems Manager instance profile.

I launched with a bigger volume but df shows the same size

That is expected on this image: cloud-init does not grow logical volumes. Follow Step 12 to grow the physical volume and then the logical volumes you choose.

A volume is full

Check which one with df -h. If the volume group has free space (sudo vgs), grow the full volume with lvextend --resizefs (Step 12). If not, grow the EBS volume first with aws ec2 modify-volume or the console, then run the three steps in Step 12.

"Permission denied" running a script or binary

/tmp, /var/tmp, /var/log and /var/log/audit are mounted noexec. Run scripts through their interpreter (bash script.sh) or move them to your home directory or /opt.

My service is running but not reachable

Allow the port in both the security group and firewalld (Step 8). sudo firewall-cmd --list-all shows the firewalld rules; sudo ss -tlnp shows whether the service listens on all addresses or only on loopback. If the service runs on a non-standard port, SELinux may also need to allow it: install the SELinux management tools with sudo dnf -y install policycoreutils-python-utils, then, for example, sudo semanage port -a -t http_port_t -p tcp 8080 for a web server on 8080.

A tool that uses instance metadata fails

The image requires IMDSv2. Old scripts that call http://169.254.169.254/ without a token get HTTP 401. Update them to request a token first (Step 7), or use the AWS CLI or a current SDK.

Package manager issues

Refresh the metadata first:

sudo dnf -q makecache --refresh && echo "repository metadata refreshed"

If the repositories are unreachable, check that the instance has outbound internet access (a public IP or a NAT gateway) and that DNS resolves:

getent hosts repo.almalinux.org

Important notes

AlmaLinux is free and open source software. It is a distribution of thousands of packages, each under its own licence (GPL, LGPL, MIT, BSD, Apache 2.0 and others); rpm -qi <package> shows each package's licence. No subscription or licence key is needed to run this image. The compliance tooling is OpenSCAP (LGPL 2.1 or later) and SCAP Security Guide content (BSD 3-Clause, licence text in /usr/share/doc/cloudimg/scap-security-guide-LICENSE.txt).

AlmaLinux 8 receives security updates from the AlmaLinux OS Foundation until 2029. 8.10 is its last minor release, so this version stays on 8.10 and takes updates through dnf. For a longer support window, the listing also offers AlmaLinux 9 and 10.

The CIS Level 1 Server profile used here is the OpenSCAP profile published in SCAP Security Guide. These images are not CIS Hardened Images and are not certified by the Center for Internet Security. A pass rate measures this image as built; your own changes affect it, which is why the evaluation can be re-run (Step 6).

AlmaLinux is a trademark of the AlmaLinux OS Foundation. Red Hat Enterprise Linux is a trademark of Red Hat, Inc. CIS is a trademark of the Center for Internet Security. These names are used only to identify the software, its compatibility and the profile. cloudimg is not affiliated with or endorsed by the AlmaLinux OS Foundation, Red Hat or the Center for Internet Security.

Support

For help with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• User Guides: www.cloudimg.co.uk/guides
• AlmaLinux on AWS hub: www.cloudimg.co.uk/guides/almalinux-aws