DISA STIG Automation for AlmaLinux OS 9

Key points

TuxCare has contributed a DISA STIG profile for AlmaLinux OS 9 to the ComplianceAsCode project, and the maintainers merged it on October 20, 2026. OpenSCAP can now scan an AlmaLinux OS 9 system and report which STIG requirements it meets.

Background

• A STIG (Security Technical Implementation Guide) is a secure configuration standard published by the US Defense Information Systems Agency (DISA) for products used on Department of Defense networks. It is freely available and usable as a general hardening baseline.
• Each requirement has a severity category, from CAT I (most serious) to CAT III. STIGs resemble CIS benchmarks, with extra national-security requirements.
• DISA first released the "Cloud Linux AlmaLinux OS 9 STIG" in December 2024, after more than a year of work with TuxCare. Before this contribution, it could only be checked automatically with commercial scanners such as Tenable Nessus.

What the profile contains

• Simon John of TuxCare wrote the profile, submitted upstream as pull request #15208. ComplianceAsCode is the source of the SCAP Security Guide content that OpenSCAP reads.
• It targets STIG version V1R8. Its controls file lists 439 requirements, 434 of which have automated checks.
• Of the remaining five, two need manual review and one check is still pending. Two cover quagga and ypserv, which are not shipped on AlmaLinux OS 9, so they do not apply.
• Example: ALMA-09-009590 (CAT I) requires GPG signature checking for packages from external repositories. The check looks for gpgcheck=1 in the [main] section of /etc/dnf/dnf.conf.
• ComplianceAsCode also generates Bash scripts and Ansible playbooks for remediation. These include fixes for the new rules, such as enabling the TuxCare Extended Security Updates (ESU) repository on licensed systems.

Caution before remediating

• Review remediation scripts before running them. Some STIG settings can lock administrators out of a machine if no other access method exists, including SmartCard authentication and SSH and login restrictions.
• The authors recommend trying remediation on a test VM first.

Availability and trying it

• The profile is in ComplianceAsCode's main branch and is assigned to release 0.1.83, scheduled for November 26, 2026.
• To use it before then, build the content from source on an AlmaLinux OS 9 system and run a scan:

sudo dnf install git cmake make openscap-utils openscap-scanner python3 python3-setuptools python3-pip
git clone https://github.com/ComplianceAsCode/content.git
cd content
pip3 install -r requirements.txt
./build_product almalinux9
sudo oscap xccdf eval --profile xccdf_org.ssgproject.content_profile_stig --results results.xml --report report.html build/ssg-almalinux9-ds.xml

• On systems with internet access, add --fetch-remote-resources so OpenSCAP can download AlmaLinux security advisory data and check patch status. Without it, that check is reported as "notchecked".
• Results for every check appear in report.html, which opens in a browser.

Passing the full STIG

• Anyone can use the profile to scan and harden an AlmaLinux OS 9 system at no cost. Fully passing the STIG is a separate matter, because the STIG names specific components.
• FIPS cryptography is mandatory under the STIG.
• ALMA-09-004310 (CAT I) requires the TuxCare ESU repository. A community AlmaLinux OS 9 install fails this check, and the report says so.
• AlmaLinux 9.2 and 9.6 are no longer supported by the AlmaLinux OS Foundation. A passing system must run TuxCare ESU for 9.2 or 9.6 with TuxCare's FIPS 140-3 validated packages.
• TuxCare plans to begin FIPS validation work for AlmaLinux 9.10 in November 2026. ESU, the FIPS packages and hardening support are paid TuxCare offerings.

Feedback

• Report false positives, rules that do not fit AlmaLinux, or typos as issues or pull requests on the ComplianceAsCode GitHub project, ideally before 0.1.83 ships.
• Questions about the profile can go to chat.almalinux.org.

Summary by DistroNews, based on the original post.