Build an Ubuntu 24.04 CIS Level 1 evaluation image

This guide produces an Ubuntu 24.04 image that requests OpenFactory’s pinned CIS Level 1 remediation path and collects guest evidence. It does not produce a certified or automatically production-ready server.

For other distributions, the cis-benchmarks feature currently applies only a limited portable baseline. Do not adapt this guide by changing base_image and retaining the CIS claim.

Prompt

Create an Ubuntu 24.04 headless evaluation image with SSH, firewall,
audit logging, and the cis-benchmarks feature. Use key-only SSH,
disable root login, and add a locked-password operator account in sudo.
Add a scenario that waits for first-boot CIS remediation and runs the
Ubuntu 24.04 Level 1 server benchmark plus service and network smoke tests.
Do not call the result compliant; preserve failed controls and exceptions.

Review the normalized recipe

The important fields should resemble:

{
  "name": "ubuntu24-cis-l1-evaluation",
  "base_image": "ubuntu-24.04",
  "os": {
    "features": [
      "headless",
      "ssh",
      "firewall",
      "audit-logging",
      "cis-benchmarks"
    ],
    "services": [
      {
        "name": "ssh",
        "enabled": true,
        "config": {
          "port": 22,
          "allow_root": false,
          "disable_password_auth": true
        }
      }
    ],
    "users": [
      {
        "username": "operator",
        "groups": ["sudo"],
        "shell": "/bin/bash"
      }
    ],
    "security": {
      "hardening_level": "standard",
      "audit_logging": true,
      "fail2ban": false
    }
  },
  "scenarios": [
    {
      "id": "ubuntu24-cis-evidence",
      "name": "Ubuntu 24.04 CIS Level 1 evidence",
      "enabled": true,
      "tests": ["boot", "login", "packages", "services"],
      "cis_benchmark": "CIS_Ubuntu_Linux_24.04_LTS_Benchmark_v1.0.0",
      "cis_level": "L1"
    }
  ]
}

The account has no recipe password, so it should remain password-locked until an approved key or deployment-time credential is supplied. Confirm that the generated access path matches your environment before disabling password authentication.

What the build path does

For Ubuntu 24.04, the feature stages a digest-verified archive of the pinned ansible-lockdown/UBUNTU24-CIS role. First boot applies the selected Level 1 server profile and writes readiness or failure evidence. The build also carries feature assertions for account controls, warning banners, service state, filesystem settings, provenance, and selected network behavior.

The role is adapted for OpenFactory’s image workflow. Review the generated manifest and patches rather than assuming it is identical to a default upstream run.

Acceptance criteria

Do not stop at “build completed.” Require:

• a usable artifact with its digest;
• first-boot remediation readiness and no failure marker;
• all applicable selected benchmark checks accounted for;
• explicit disposition of every failed, skipped, or not-applicable control;
• successful SSH access through the approved key workflow;
• firewall, time synchronization, logging, update, reboot, and recovery tests;
• application smoke tests after hardening; and
• an owner-approved deployment runbook.

Level 2 is not the current pinned remediation profile and must not be requested as though this path provides it. If Level 2 is a requirement, treat that as a separate engineering and validation project.

See CIS benchmark evidence for result interpretation.