Hardened Debian12 Minimal

This is a repackaged open source software product wherein additional charges apply for a hardened, AWS-optimized image with verifiable provenance evidence and maintenance. Based on Debian 12, this AMI has its listening attack surface reduced, is tuned for Amazon EC2 workloads, and ships a complete provenance evidence pack with a Software Bill of Materials (SBOM).

Security & Attack Surface:

1. Comprehensive Evidence Pack: Every AMI includes a provenance evidence pack located under /opt/optimization-report/:

   • Tuning_Parameters.txt: Every change, shown against its base-image value, with the reasoning and how to reverse it.
   • Security_Parameters.txt: Every security setting applied, shown against its base-image value, with the reasoning and how to reverse it.
   • package_changes.txt: Packages added, upgraded and removed versus the base image.
   • sbom.spdx.json: Software Bill of Materials (SBOM) in SPDX format generated from the dpkg database.
   • cve_scan.txt / cve_scan_full.txt.gz: Vulnerability scan reports categorizing CVEs by upstream patch availability.
   • key_files.sha256: SHA-256 checksums of every file this image changed, so the delivered state can be verified.
   • README.txt: Index file detailing artifact contents, administrative operational guidelines, and configuration defaults.

2. Listening Surface Reduced: LLMNR and multicast DNS are turned off, closing UDP port 5355. The delivered image listens on port 22 only, verified against an unmodified base instance of the same source AMI.

3. Kernel Network Hardening: 19 network-related kernel parameters are fixed in /etc/sysctl.d/99-security.conf: ICMP redirect acceptance and sending are off, source-routed packets rejected, and the rest pinned at safe values so they cannot drift.

4. Unused Kernel Modules Disabled: 12 rarely used filesystem and network protocol modules are blocked from loading via /etc/modprobe.d/99-disable-unused.conf. squashfs is deliberately left loadable so snap, AppImage and container workflows keep working.

5. SSH Login Window Tightened: LoginGraceTime is reduced from 120 to 60 seconds in /etc/ssh/sshd_config.d/99-security.conf. Root login policy, authentication retries and forwarding are left as the base image ships them.

6. Fully Patched at Release: Zero packages with a pending update at build time, taken from what apt-get upgrade actually offers rather than from a scanner opinion. The complete CVE scan ships inside the image, reported in three tiers.

7. Kernel Hygiene: Exactly two kernel generations are retained and older ones are removed automatically, so superseded kernels do not accumulate in the boot menu. The base image left the cleanup options commented out.

System Footprint & Reliability Optimization:

1. Log Growth Bounded: The systemd journal is capped at 200 MB, so log growth cannot fill the root filesystem on a long-running instance.

2. Validation Testing: Functional verification conducted on clean AMI launches through multi-round integration testing, with every changed value compared against an unmodified base instance rather than against documentation.

AWS Network & Kernel Tuning:

1. Network Stack: TCP BBR congestion control with fair queueing, increased connection backlogs, buffer adjustments, and MTU probing enabled.

2. System Tuning: tuned daemon active with an aws-optimized profile, transparent hugepages moved to madvise, and modified memory writeback parameters.

3. EC2 Integration: Amazon Time Sync and the SSM agent are already active in the base image and are left exactly as shipped; size-capped persistent journald logging is configured on top.

Operational Tools

1. Preinstalled Tools: AWS SSM Agent active, CloudWatch Agent installed (disabled by default).

Maintenance:

1. Maintenance Specifications: Rebuilt and updated bi-weekly to monthly incorporating upstream Debian 12 security updates, updated artifact documentation per release, and administrative documentation.

About Debian 12

1. Debian 12 Foundation: A renowned Linux distribution celebrated for its exceptional stability, vast software repository, and strict adherence to open-source principles. Serving as the foundational upstream for Ubuntu and numerous other distributions, it provides unparalleled ecosystem compatibility while delivering a clean, bloat-free, and secure enterprise-grade core.

2. Rock-Solid Debian Stability: Debian 12 (Bookworm) follows the project's famously conservative release engineering, where every package is frozen and tested before release, with ongoing coverage from the Debian security team. This delivers exceptional predictability and uptime for long-lived servers, backed by the vast APT ecosystem for painless package management and upgrades.