Keeping AlmaLinux Secure
summary
AlmaLinux security guidance emphasizes concrete practices: use immudb notarizes commits for tamper-evident package history, scan packages and images with OpenSCAP, Trivy and Grype, and generate SBOMs to run Trivy/Grype against SBOMs daily. Expect critical CVEs to need patching in hours to days; AlmaLinux 10 ships ~400 CIS checks. Beware live‑patch blind spots and compromised supply chains (recent Trivy incident affected ~50 repos and widespread downloads). Consider Fleet automation, file‑integrity, Wazuh/SIEM and live‑patching services like CloudLinux Guardian.
AI-written summary · about
chapters (11)
- 0:00Introduction and AlmaLinux overview
- 1:28Security threats and patching urgency
- 3:37Vulnerability management with OVAL and OSV
- 8:56OpenSCAP and automated security scanning
- 11:26Container security with Trivy and Grype
- 16:21Additional open-source security tools
- 19:11System updates and SSH lockdown
- 21:44CloudLinux Guardian security solution
- 23:28CIS benchmarking and hardening automation
- 24:31AI tools for security forensics and mitigation
- 25:56Automated documentation and audit support
related talks
12mAlmaLinux the First Three Years and Beyond
17mAlmaLinux and the Open Source way
33mThe Future of AlmaLinux: Collaborating on Development and Adoption from Japan
16mAlmaLinux in brief
28mAlmaLinux Security Feature Evaluation and Certifications — Efforts Toward FIPS 140-3 and CC Certification
32mALESCo, corporate contribution, and the way forward
32mAlmaLinux in Japan: Progress and Achievements Over the Past Year
30mAlmaLinux from the Linux Technician Training Frontline — Adoption in LinuC Exams and Materials and Reasons for Selection