Hardened Neo4j-5 on Debian12

This is a repackaged open source software product wherein additional charges apply for a hardened, AWS-optimized image with verifiable provenance evidence and maintenance. Neo4j Community Edition 5 runs on a Debian 12 base with its listening attack surface reduced, tuned for Amazon EC2 workloads, and shipped with a complete provenance evidence pack and Software Bill of Materials (SBOM).

Neo4j Community Edition 5 Deployment:

1. Best-Practice Deployment: Neo4j Community Edition 5 is fully configured and starts with the instance, with Java 17 included as required by the 5.x series.

2. Memory Pre-Tuned for the Instance: Heap size and page cache are pre-configured to use the EC2 instance RAM efficiently, preventing out-of-memory failures during complex Cypher queries.

3. Production Defaults: Connection handling, transaction management, and high-concurrency parameters are adjusted for enterprise workloads rather than left at desktop defaults.

Comprehensive Evidence Pack:

Every AMI carries a provenance evidence pack under /opt/optimization-report/:

• Tuning_Parameters.txt: Every change, shown against its base-image value, with the reasoning and how to reverse it.
• Security_Parameters.txt: Every security setting applied, shown against its base-image value, with the reasoning and how to reverse it.
• package_changes.txt: Packages added, upgraded and removed versus the base image.
• sbom.spdx.json: Software Bill of Materials in SPDX format, generated from the dpkg database.
• cve_scan.txt / cve_scan_full.txt.gz: Vulnerability scan reports categorizing CVEs by upstream patch availability.
• key_files.sha256: SHA-256 checksums of every file this image changed, so the delivered state can be verified.
• README.txt: Index of artifact contents, operational guidelines, and configuration defaults.

Security & Attack Surface:

1. Listening Surface Reduced: LLMNR and multicast DNS are turned off, closing UDP port 5355, verified against an unmodified base instance of the same source AMI.

2. Kernel Network Hardening: 19 network-related kernel parameters are fixed in /etc/sysctl.d/99-security.conf: ICMP redirects are neither accepted nor sent, source-routed packets are rejected, and the rest are pinned at safe values.

3. Unused Kernel Modules Disabled: 12 unused filesystem and protocol modules are blocked from loading via /etc/modprobe.d/99-disable-unused.conf. squashfs is deliberately left loadable so snap, AppImage and container workflows keep working.

4. SSH Login Window Tightened: LoginGraceTime is reduced from 120 to 60 seconds in /etc/ssh/sshd_config.d/99-security.conf. Root login policy, authentication retries and forwarding are unchanged.

5. Fully Patched at Release: Zero packages with a pending update at build time, taken from what apt-get upgrade actually offers rather than from a scanner opinion. The complete CVE scan ships inside the image, reported in three tiers.

6. Kernel Hygiene: Exactly two kernel generations are retained and older ones are removed automatically, so superseded kernels do not accumulate in the boot menu.

System Footprint & Reliability Optimization:

1. Log Growth Bounded: The systemd journal is capped at 200 MB, so logs cannot fill the root filesystem.

2. Validation Testing: Functional verification on clean AMI launches through multi-round integration testing, with every changed value compared against an unmodified base instance.

AWS Network & Kernel Tuning:

1. Network Stack: TCP BBR congestion control with fair queueing, increased connection backlogs, buffer adjustments, and MTU probing enabled.

2. System Tuning: tuned daemon active with an aws-optimized profile, transparent hugepages moved to madvise, and modified memory writeback parameters.

3. EC2 Integration: Amazon Time Sync and the SSM agent are left exactly as the base image ships them; size-capped persistent journald logging is configured on top.

Operational Tools:

1. Preinstalled Tools: AWS SSM Agent active, CloudWatch Agent installed (disabled by default).

Maintenance:

1. Maintenance Specifications: Rebuilt and updated bi-weekly to monthly incorporating upstream Neo4j and Debian 12 security updates, with artifact documentation refreshed per release.

About Neo4j

A native graph database whose Cypher query planner and relationship-first storage suit knowledge graphs, recommendation engines, and fraud detection networks.

About Debian 12

Debian 12 (Bookworm) follows the project's conservative release engineering, where every package is frozen and tested before release, with ongoing coverage from the Debian security team. As the upstream for Ubuntu and many other distributions it offers broad ecosystem compatibility and a predictable APT upgrade path.