CIS Hardened Image Level 2

Gemini

• Aggressive Audit Logging: Implements extensive auditd logging for system calls, file integrity monitoring, and privilege escalation events (which increases storage and CPU/disk I/O usage).

• Kernel & Module Blacklisting: Explicitly disables uncommon filesystems (e.g., cramfs, squashfs), USB storage modules, and rare network protocols at the kernel level.

• Restricted Network Behaviors: Disables IP forwarding and strict network packet handling. (Note: This often breaks container runtimes like Docker or Kubernetes out-of-the-box unless custom exceptions are added).

• Strict Execution Restrictions: Limits memory execution permissions, process creation rights, and places severe limits on administrative actions.

See also

• usg audit
• CIS, CIS AWS Foundations Benchmark controls, CIS Benchmarks, K8s, Security standards, CIS Hardened Images: Level 2, Level 1, Ansible Lockdown