Herd by CapivaraOS 1.0.1: one-command hardening
CapivaraOS's server line got an update — and a new name. It's now called Herd by CapivaraOS, and version 1.0.1 ships the most requested feature: security hardening in one command.
One-command hardening
The new herd-harden applies an entire compliance profile at once,
using Fedora's SCAP Security Guide content underneath. Pick the
profile — ospp, cis-l1, cis-l2 or
pci — and it hardens the system via Ansible. By default it runs a
dry-run (shows what would change, without touching anything);
it only applies for real with --apply.
Compliance with evidence
herd-compliance-scan now accepts the same profile aliases and also
produces an ARF file — the machine-readable evidence
that auditing tools consume and that you can re-render into a report later — on
top of the usual HTML and XML.
FIPS and disk encryption
The documentation gained the opt-in paths for
FIPS mode (on Fedora 44, via fips=1 on the kernel)
and disk encryption (LUKS) at install time — each with its
caveats, including the care needed with SSH keys under FIPS.
Get 1.0.1
The x86_64 images (installer ISO and cloud qcow2) are on the download page, with SHA-256 checksums. Everything is documented — in English and Portuguese — in the Herd documentation.
Same philosophy as always: quality and security, no rush. Hit a problem or want to contribute? Get in touch.