PTG Hardened RHEL 9 CIS Level 2 | SELinux Enforcing | Lynis Score 85/100
Powell Technology Group LLC · Cybersecurity & IT
Certification per AWS Marketplace.
Evidence tier Source Confirmed · 4 captures on record
What the publisher says
As described on AWS Marketplace.
PTG Hardened RHEL 9 delivers a production-ready, CIS Level 2 compliant
base image for teams that need secure infrastructure without the setup
Show the rest of the publisher’s description (40 more lines)
overhead.
COMPLIANCE AND HARDENING
- CIS Level 2 hardening via ansible-lockdown RHEL9-CIS role
- SELinux enforcing mode (targeted policy)
- auditd with full CIS audit ruleset and immutable rules (-e 2)
- Lynis hardening score: 85/100
- OpenSCAP compatible
NETWORK AND ACCESS SECURITY
- firewalld active, default zone set to drop, SSH explicitly allowed
- fail2ban active with SSH jail (5 retries, 1-hour ban)
- SSH hardened: PermitRootLogin no, PasswordAuthentication no, MaxAuthTries 3
- AllowTcpForwarding no, X11Forwarding no, AllowAgentForwarding no
KERNEL AND SYSTEM HARDENING
- CIS + Lynis sysctl profile applied
- Firewire blacklisted, core dumps disabled
- Compiler access restricted to root only
- Legal banners on /etc/issue and /etc/issue.net
- PATH hardened for all users
MONITORING AND ACCOUNTING
- psacct and sysstat enabled for process accounting
- rkhunter rootkit detection
- AIDE file integrity monitoring
- dnf-automatic for unattended security updates
AWS NATIVE
- amazon-ssm-agent active; no SSH key required for Systems Manager
- cloud-init compatible, clean on every customer launch
- Compliance manifest generated at /opt/PTG/compliance/manifest.txt
WHO THIS IS FOR
Security teams, MSPs, healthcare organizations, fintech companies, and
any team that needs a hardened RHEL 9 base they can build on immediately
without spending days on manual CIS hardening.
QUICKSTART
- Launch on t3.medium or larger
- SSH: ssh -i your-key.pem ec2-user@PUBLIC_IP
- sudo getenforce > Enforcing
- sudo systemctl status auditd > active (running)
- sudo systemctl status firewalld > active (running)
- cat /opt/PTG/compliance/manifest.txt
- sudo lynis audit system > score 85+
SUPPORT: admin@powelltechnologygroup.com
Highlights
Highlighted by the publisher on AWS Marketplace.
CIS Level 2 Compliant Out of the Box, Full ansible-lockdown RHEL9-CIS hardening applied at the build time. SELinux enforcing, auditd with immutable rules, and firewalld active. Lynis hardening score 85/100. Skip weeks of manual hardening work and launch compliant from minute one.
Built for AWS. Works Natively With Your Stack, SSM Agent pre-installed and active. No SSH password auth. Cloud-init compatible. IAM-ready. Compliance manifest at /opt/PTG/compliance/manifest.txt on every instance. Designed for teams that need hardened Linux on EC2 without the setup overhead.
Active Security Stack Included, fail2ban with SSH jail enabled, rkhunter, AIDE file integrity monitoring, dnf-automatic for unattended security updates, compiler access is restricted to root, firewire blacklisted, and core dumps are disabled. Everything a security-conscious team expects, pre-configured and verified.
Preview
3 images
Agent build and provenance
See the full provenance
The layer-by-layer build, the evidence behind each claim, the risk basis and the cross-marketplace links are open to any account. Some rows are disclosed, some the source leaves Unknown; a free account shows you which.
Plans and pricing as listed
7 listed- Hrs
- Hrs
- Hrs
- Hrs
- Hrs
- Hrs
- Hrs
Refund terms
As stated by the publisher on AWS Marketplace.
Refunds are available within 7 days of the initial subscription date for any reason. To request a refund, contact admin@powelltechnology-group.com with your AWS account ID and subscription date. Pro-rated refunds are provided for annual subscriptions cancelled after the 7-day window on a case-by-case basis. No refunds are issued for hourly usage already consumed.
Sources
Linked repositories
Unknown means this listing does not publish a repository. It is not a statement that the code is closed, and a linked repository is not a claim that the publisher wrote it: the registry computes that relationship privately and does not publish it.
Evidence risk is the share of the build you cannot see before you deploy, not a security rating. Sign in to see the layer-by-layer basis for this band.