NKP Node Security: CIS Benchmark Audit on Rocky Linux 9.7

A complete CIS Rocky Linux 9 benchmark audit (Level 1 and Level 2) of a live NKP 2.17 management cluster node. We ran every check against the actual node, show the real commands and output, and explain what Nutanix pre-hardens out of the box versus what requires Kubernetes exceptions.

Executive Summary#

Audit performed on a default NKP 2.17.1 management cluster worker node running Rocky Linux 9.7. No post-deployment hardening was applied. All results reflect the out-of-the-box NKP node image.

We ran two parallel assessments: a manual deep-dive covering every CIS section with real commands, and an automated OpenSCAP scan using the official scap-security-guide CIS profiles.

OpenSCAP Automated Scan Results#

Manual Audit Summary#

CIS Level 1 pass rate: 46/58 (79%) | CIS Level 2 pass rate: 54/76 (71%) | Adjusted (excluding K8s exceptions): 54/70 (77%)

Master Checklist#

Test Environment#

The node was deployed using the standard NKP pre-built Rocky 9.7 OS image from the Nutanix Portal. No additional hardening was applied post-deployment. Everything in this article reflects the default NKP node image.

Section 1: Initial Setup#

1.1 Filesystem Configuration#

Unused kernel modules (cramfs, hfs, jffs2, udf, squashfs, freevxfs) are not loaded but are not explicitly blacklisted via /etc/modprobe.d/. The fat module is loaded (required by the EFI boot partition).

# Check if a module is loaded and disabled
for fs in cramfs freevxfs hfs hfsplus jffs2 squashfs udf; do
  lsmod | grep "^$fs " && echo "LOADED" || echo "not loaded"
  modprobe -n -v $fs 2>/dev/null
done

USB storage L2: The usb-storage module is not loaded but is not blacklisted in /etc/modprobe.d/. On a VM running on Nutanix AHV, USB passthrough is not enabled by default, making this a low risk finding.

Temporary filesystem mounts are properly configured:

1.2 Package Manager#

grep "^gpgcheck" /etc/dnf/dnf.conf

gpgcheck=1

GPG checking is enabled. PASS

1.3 Filesystem Integrity (AIDE)#

rpm -q aide
systemctl is-enabled aidecheck.timer

aide-0.16-105.el9.x86_64
disabled

AIDE is installed PASS but the periodic check timer is not enabled FAIL.

1.4 Bootloader Security#

GRUB bootloader password is not set FAIL. This is typical for VM-based deployments where physical console access is already controlled at the hypervisor level (Nutanix AHV console access requires Prism authentication).

1.5 Process Hardening#

sysctl kernel.randomize_va_space kernel.yama.ptrace_scope fs.suid_dumpable
cat /etc/systemd/coredump.conf | grep -E "^(Storage|ProcessSizeMax)"

kernel.randomize_va_space = 2
kernel.yama.ptrace_scope = 1
fs.suid_dumpable = 2
Storage=none
ProcessSizeMax=0

1.6 SELinux#

getenforce
grep "^SELINUX=" /etc/selinux/config

Enforcing
SELINUX=enforcing
SELINUXTYPE=targeted

SELinux is in enforcing mode with the targeted policy PASS. This is significant: many Kubernetes distributions disable SELinux entirely because of compatibility issues. NKP keeps it enforcing.

The troubleshooting packages setroubleshoot and mcstrans are both absent, which is correct.

1.7 Crypto Policy#

update-crypto-policies --show

DEFAULT:NO-SSHWEAKCIPHERS:NO-SSHWEAKMACS

The system-wide crypto policy is hardened beyond the default PASS. The NO-SSHWEAKCIPHERS and NO-SSHWEAKMACS sub-policies remove weak SSH algorithms system-wide.

CIS v2.0.0 control 1.6.2 requires that sshd does not override the crypto policy with explicit directives. We verified no crypto overrides exist in /etc/ssh/sshd_config or /etc/ssh/sshd_config.d/ PASS. The SSH backend config is managed entirely through the crypto policy:

cat /etc/crypto-policies/back-ends/opensshserver.config

Ciphers aes256-gcm@openssh.com,aes256-ctr,aes128-gcm@openssh.com,aes128-ctr
MACs hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,hmac-sha2-512
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,...
RequiredRSASize 2048

1.8 Warning Banners#

cat /etc/motd
cat /etc/issue
cat /etc/issue.net

All three files contain:

Authorized uses only. All activity may be monitored and reported.

Login banners are properly configured with a legal warning PASS. Note that the SSH Banner directive is not set in sshd_config (covered in Section 4.2).

Section 2: Services#

2.1 Time Synchronization#

systemctl is-active chronyd
chronyc sources

active
^* vps-rtm1.orleans.ddnss.de   2  10  377  332  -950us[-966us] +/- 8485us

Chronyd is active and synchronized PASS. Four NTP pool sources are configured in /etc/chrony.conf. System clock shows synchronized via timedatectl.

2.2 Special Purpose Services#

We checked for 14 unnecessary services (avahi, cups, dhcpd, slapd, nfs-server, named, vsftpd, httpd, dovecot, smb, squid, net-snmp, ypserv, telnet-server, tftp-server). Only one issue:

rpcbind is present but is a dependency of some NFS-related packages. It is not actively running as a service.

2.3 Service Clients#

All unnecessary client packages are absent: telnet, openldap-clients, ftp, ypbind. PASS

2.4 GDM / GUI#

rpm -q gdm
systemctl get-default

package gdm is not installed
multi-user.target

No graphical environment installed. Default target is multi-user.target. PASS

2.5 Autofs#

Autofs is not installed and not enabled. PASS

Section 3: Network Configuration#

3.1 Host Network Parameters#

sysctl net.ipv4.ip_forward
sysctl net.ipv4.conf.all.send_redirects
sysctl net.ipv4.conf.default.send_redirects

net.ipv4.ip_forward = 1
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

3.2 Network Hardening Parameters#

Every network hardening sysctl is properly configured:

3.3 Firewall#

systemctl is-active firewalld
systemctl is-active nftables

inactive
inactive

Neither firewalld nor nftables services are active as standalone K8s N/A. This is expected: Cilium manages all network policy enforcement via eBPF and nftables rules. The nftables ruleset shows Cilium and kube-proxy managed chains:

sudo nft list ruleset | head -10

table ip mangle {
    chain KUBE-IPTABLES-HINT {
    }
    chain POSTROUTING {
        type filter hook postrouting priority mangle; policy accept;
        counter packets 74222 bytes 88691775 jump CILIUM_POST_mangle
    }

Section 4: Access, Authentication & Authorization#

4.1 Cron#

All cron controls pass PASS:

stat -c "%a %U %G" /etc/crontab
ls -ld /etc/cron.{hourly,daily,weekly,monthly,d}

600 root root
drwx------. 2 root root /etc/cron.hourly
drwx------. 2 root root /etc/cron.daily
drwx------. 2 root root /etc/cron.weekly
drwx------. 2 root root /etc/cron.monthly
drwx------. 2 root root /etc/cron.d

/etc/cron.allow and /etc/at.allow exist. /etc/cron.deny and /etc/at.deny are absent.

4.2 SSH Server Configuration#

This is where we find the most gaps. Here is the full sshd configuration audit:

sudo sshd -T | grep -iE "^(permit|max|ignore|hostbased|x11|allowtcp|login|client|banner|log|usepam|allowagent|cipher|macs|kex)"

SSH Ciphers PASS (all strong):

chacha20-poly1305@openssh.com
aes128-ctr, aes192-ctr, aes256-ctr
aes128-gcm@openssh.com, aes256-gcm@openssh.com

SSH MACs WARN include some weak entries:

hmac-sha1-etm@openssh.com    ← weak
hmac-sha1                     ← weak
umac-64-etm@openssh.com       ← weak (short tag)
umac-64@openssh.com            ← weak (short tag)

SSH Key Exchange Algorithms PASS: curve25519-sha256, ECDH (P-256/P-384/P-521), and DH group16/18.

Why PermitRootLogin is without-password: NKP needs root-level access via SSH keys during cluster lifecycle operations (CAPI/CAPX). The without-password setting allows key-based root login while blocking password authentication. This is a deliberate NKP design choice.

4.3 PAM and Password Quality#

NKP uses a custom authselect profile:

authselect current

Profile ID: custom/nkp-sssd-profile
Enabled features:
- with-faillock
- with-pwhistory
- without-nullok

This profile enables faillock, password history, and disables null password authentication. Password quality enforcement is excellent:

cat /etc/security/pwquality.conf | grep -v "^#" | grep -v "^$"

difok = 2
maxrepeat = 3
enforce_for_root
minlen = 14
minclass = 4
maxsequence = 3

Account lockout (faillock):

cat /etc/security/faillock.conf | grep -v "^#" | grep -v "^$"

deny = 5
unlock_time = 900

5 failed attempts triggers a 15-minute lockout PASS. PAM is configured with pam_faillock.so in both password-auth and system-auth using preauth + authfail flow.

Password hashing: SHA512 in both PAM (pam_unix.so sha512) and /etc/login.defs (ENCRYPT_METHOD SHA512) PASS.

Password history: pam_pwhistory.so is configured with use_authtok, preventing password reuse PASS.

4.4 User Accounts and Environment#

grep -E "^(PASS_MAX|PASS_MIN|PASS_WARN|UMASK|ENCRYPT)" /etc/login.defs

UMASK           027
PASS_MAX_DAYS   365
PASS_MIN_DAYS   7
PASS_WARN_AGE   7
ENCRYPT_METHOD  SHA512

Shell idle timeout (TMOUT):

cat /etc/profile.d/tmout.sh

TMOUT=600
export TMOUT
readonly TMOUT

The shell timeout is set to 600 seconds (10 minutes), exported, and marked readonly so users cannot override it PASS.

Three system accounts have interactive shells (sync, shutdown, halt). These are standard RHEL defaults with restricted functionality.

4.5 Sudo Configuration#

sudo grep -E "^Defaults" /etc/sudoers

Defaults   !visiblepw
Defaults    always_set_home
Defaults    env_reset
Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin
Defaults    use_pty
Defaults    logfile="/var/log/sudo.log"
Defaults    timestamp_timeout=15

The konvoy user has NOPASSWD: ALL sudo access. This is required by NKP for cluster lifecycle operations (scaling, upgrades, node management via CAPI).

Section 5: Logging & Auditing#

5.1 System Logging#

Both rsyslog and journald are running. Journal is configured for persistent storage with compression.

Remote log forwarding L2:

rpm -q systemd-journal-remote
grep "ForwardToSyslog" /etc/systemd/journald.conf

package systemd-journal-remote is not installed
ForwardToSyslog=no

No remote log forwarding is configured FAIL. For CIS Level 2, logs should be forwarded to a central log server. In production NKP environments, this is typically handled by deploying a log collector (Fluentd, Vector, or Promtail) as a DaemonSet.

5.2 Auditd#

systemctl is-active auditd
cat /proc/cmdline | grep -o "audit[^ ]*"
sudo auditctl -l | wc -l

active
audit=1
audit_backlog_limit=8192
64

Auditd is active and enabled at boot via GRUB kernel parameters PASS. The system has 64 audit rules PASS covering:

Audit rules immutability L2:

sudo auditctl -s | grep enabled
sudo tail -3 /etc/audit/rules.d/99_auditd.rules

enabled 2
-e 2

The -e 2 flag IS set PASS, making audit rules immutable after loading. Any changes to rules require a system reboot.

Auditd.conf storage and alerting settings:

grep -E "^(max_log_file_action|space_left_action|admin_space_left_action|action_mail_acct|disk_full_action)" /etc/audit/auditd.conf

max_log_file_action = keep_logs
space_left_action = email
action_mail_acct = root
admin_space_left_action = halt
disk_full_action = SUSPEND

Audit logs are kept (not automatically deleted) PASS. Low disk space triggers email to root, critically low space halts the system, and full disk suspends auditing. This is a strong configuration.

5.3 Log Rotation#

daily
rotate 4

Logs are rotated daily with 4 days of retention. This is minimal but acceptable for nodes where centralized log shipping is expected.

Section 6: System Maintenance#

6.1 Critical File Permissions#

Shadow files with permission 000 is stricter than the CIS requirement of 640.

6.2 User and Group Integrity#

All checks pass PASS: no empty passwords, no duplicate UIDs/GIDs, no duplicate user/group names. Only root has UID 0.

6.3 World-Writable Files#

sudo find / -xdev -type f -perm -0002 -not -path "/proc/*" -not -path "/sys/*" 2>/dev/null

Found world-writable files in two locations:

• /usr/local/bin/containerd and /usr/local/bin/ctr (containerd binaries)
• Various files under /var/lib/kubelet/pods/ (ephemeral pod containers)

These are all Kubernetes runtime artifacts K8s N/A. No world-writable files exist on the base OS filesystem.

6.4 Unowned / Ungrouped Files#

All unowned and ungrouped files are located within /var/lib/containerd/ snapshots (container image layers with non-host UIDs). No issues on the base OS filesystem K8s N/A.

6.5 SUID/SGID Binaries#

The host filesystem has the standard minimal set of SUID binaries PASS:

/usr/bin/chage, crontab, gpasswd, mount, newgrp, passwd, pkexec, su, sudo, umount
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/sbin/grub2-set-bootflag, pam_timestamp_check, unix_chkpwd, mount.nfs

All of these are expected for a RHEL-based system. Additional SUID/SGID binaries found inside containerd snapshots are isolated to container image layers.

Kernel Hardening#

sysctl kernel.dmesg_restrict kernel.kptr_restrict kernel.perf_event_paranoid kernel.unprivileged_bpf_disabled
fips-mode-setup --check

kernel.dmesg_restrict = 0
kernel.kptr_restrict = 1
kernel.perf_event_paranoid = 2
kernel.unprivileged_bpf_disabled = 1
FIPS mode is disabled.

OpenSCAP Automated Scan#

We also ran the official OpenSCAP scanner with scap-security-guide CIS profiles to validate our manual findings:

sudo dnf install -y openscap-scanner scap-security-guide
sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_server_l1 \
  --report /tmp/cis-l1-report.html \
  /usr/share/xml/scap/ssg/content/ssg-rl9-ds.xml

OpenSCAP Results#

Where OpenSCAP Differs from Our Manual Audit#

OpenSCAP evaluates each sub-control as an individual rule. For example, our single "audit DAC modifications" check becomes 12 separate rules (chmod, chown, fchmod, fchmodat, fchown, fchownat, setxattr, lsetxattr, fsetxattr, removexattr, lremovexattr, fremovexattr). Our audit rules use combined syscall notation (-S chmod,fchmod,fchmodat) which is functionally equivalent but does not match oscap's per-syscall regex.

Notable OpenSCAP "fails" that are actually working correctly on the node:

Overall Score#

Manual Audit by CIS Level#

Manual Audit by Section#

CIS Level 1 manual: 46/54 (85%) | CIS Level 2 manual: 55/71 (77%) (excluding K8s exceptions)

OpenSCAP CIS L1: 218/260 (84%) | OpenSCAP CIS L2: 284/364 (78%) (excluding N/A)

What NKP Hardens Out of the Box#

The NKP Rocky 9.7 node image ships with substantial security hardening that many Kubernetes distributions lack:

• SELinux enforcing with targeted policy (most K8s distros disable this)
• Hardened crypto policy (DEFAULT:NO-SSHWEAKCIPHERS:NO-SSHWEAKMACS)
• 64 audit rules covering privileged commands, file access, identity changes, and MAC policy
• Audit at boot with audit=1 audit_backlog_limit=8192 in kernel parameters
• AIDE installed for filesystem integrity monitoring
• Strong password policy: 14 chars, 4 character classes, enforce_for_root
• Account lockout: 5 attempts, 15-minute unlock via pam_faillock
• Login banners on all entry points (motd, issue, issue.net)
• Root account locked, password authentication disabled
• Core dumps disabled via systemd (Storage=none, ProcessSizeMax=0)
• Shell idle timeout (TMOUT=600, readonly, exported)
• Full network hardening: martian logging, ICMP filtering, SYN cookies, redirect blocking
• Sudo logging with use_pty enabled, logfile configured
• SHA512 password hashing with password history (pam_pwhistory)
• Cron/at access restricted via allow files
• /tmp isolated with nodev, nosuid, noexec

What Needs Attention#

The items below can theoretically be remediated, but every change must be tested on a non-production cluster first. NKP relies on SSH, sudo, and specific kernel settings for CAPI/CAPX lifecycle operations (scaling, upgrades, node replacement). Blindly applying CIS remediations can break cluster management and leave you with an unrecoverable cluster.

CIS Level 1 Gaps (fixable with testing)#

1. SSH idle timeout: Set ClientAliveInterval 300 and ClientAliveCountMax 3 in sshd_config. Low risk, but verify CAPI SSH sessions are not affected by the timeout during long-running operations.
2. SSH banner: Set Banner /etc/issue.net in sshd_config. Safe change, the banner file already exists.
3. AIDE timer: sudo systemctl enable --now aidecheck.timer. Safe, but configure AIDE exclusions for /var/lib/containerd/ and /var/lib/kubelet/ to prevent thousands of false positives.
4. suid_dumpable: Add fs.suid_dumpable = 0 to /etc/sysctl.d/99-hardening.conf. Low risk.
5. dmesg_restrict: Add kernel.dmesg_restrict = 1 to /etc/sysctl.d/99-hardening.conf. Low risk.
6. Filesystem module blacklisting: Add blacklist entries for cramfs, hfs, jffs2, udf, squashfs in /etc/modprobe.d/cis.conf. Low risk on VMs.
7. Uncommon protocols: Blacklist dccp, tipc, rds, sctp in /etc/modprobe.d/cis.conf. Low risk, but verify Cilium does not use SCTP if you have SCTP services.
8. GRUB bootloader password: Can be set but adds operational complexity for VM console access. On Nutanix AHV, console is already protected by Prism authentication.
9. SSH LogLevel: Change from INFO to VERBOSE for more detailed logging. Safe change.

CIS Level 2 Additional Gaps (higher risk)#

1. Separate partitions (/var, /var/tmp, /var/log, /var/log/audit, /home): Requires building a custom OS image with Nutanix Image Builder (NIB). Cannot be changed post-deployment.
2. SSH forwarding: Disabling AllowTcpForwarding and AllowAgentForwarding can break CAPI pivot operations and kubectl port-forwarding from the node. Test thoroughly.
3. UsePAM: NKP sets UsePAM no. Changing to yes may affect how SSH authentication works for the konvoy user. Test that CAPI can still manage nodes after the change.
4. PermitRootLogin: NKP requires without-password for key-based root access during cluster bootstrap and pivot. Setting to no will break CAPI/CAPX.
5. Remote log forwarding: Deploy a log collector (Fluentd, Vector, or Promtail) as a DaemonSet rather than modifying node-level rsyslog. This is the Kubernetes-native approach.
6. Kernel parameters: Set kptr_restrict=2, perf_event_paranoid=3. Low risk, but verify monitoring tools (node-exporter, etc.) still function.
7. FIPS mode: Must be configured at image build time. Cannot be enabled post-install without risk of system instability. Requires FIPS-validated kernel and crypto modules.
8. USB storage blacklisting: Add to /etc/modprobe.d/cis.conf. Low risk on AHV VMs.
9. sudo NOPASSWD: NKP requires NOPASSWD for the konvoy user for automated cluster lifecycle operations. Removing it will break CAPI.
10. even_deny_root in faillock: Can be enabled but ensure the root account lockout does not interfere with emergency recovery procedures.

Summary#

The NKP 2.17 Rocky Linux 9.7 node image arrives well hardened. Both our manual audit and OpenSCAP confirm consistent results: 84-85% on CIS Level 1 and 77-78% on CIS Level 2. SELinux enforcing, 64+ immutable audit rules, hardened crypto policies, and comprehensive PAM configuration are all configured by default. The main Level 1 gaps are SSH settings (idle timeout, banner) and a couple of kernel parameters. Level 2 gaps are primarily separate disk partitions (inherent to cloud images), remote log forwarding, and stricter kernel parameters. Every remediation must be tested on a non-production cluster first, as NKP relies on SSH and sudo for CAPI/CAPX lifecycle management. For a Kubernetes platform, this is a strong security baseline that exceeds what most distributions provide out of the box.