CIS Benchmark-Aligned Partitioning Scheme for Rocky Linux 9.5#

To align your Rocky Linux 9.5 installation with CIS Benchmark recommendations and fully utilize 400 GiB of storage, follow this partitioning scheme and filesystem recommendations.

📌 Partitioning Plan (CIS Benchmark Aligned)#

Partition	Size	Filesystem	Mount Options	Purpose
`/boot`	1024 MiB	`ext4`	`nodev, noexec, nosuid`	Bootloader partition
`/home`	100 GiB	`xfs`	`nodev`	User data storage
`/var`	40 GiB	`xfs`	`nodev`	App & system logs
`/var/log`	60 GiB	`xfs`	`nodev`	System logs
`/var/log/audit`	15 GiB	`xfs`	`nodev`	Security audit logs
`/var/tmp`	20 GiB	`xfs`	`nodev, noexec, nosuid`	Temporary storage
`/tmp`	20 GiB	`xfs`	`nodev, noexec, nosuid`	Prevent script execution in `/tmp`
`/srv`	30 GiB	`xfs`	`nodev`	Application data
`/opt`	30 GiB	`xfs`	`nodev`	Third-party software
`/swap`	16 GiB	`swap`	N/A	Virtual memory swap
`/` (root)	88 GiB	`xfs`	Default	Main OS partition

Total Used: 400 GiB ✅

🔧 Filesystem Choices#

Filesystem	Reason
XFS (for most partitions)	Best for high-performance and large storage
EXT4 (for `/boot`)	Needed for compatibility with bootloaders
Swap	Virtual memory

📌 Security-Hardened `/etc/fstab` Configuration#

1
UUID=<boot-uuid>    /boot         ext4  defaults,nodev,noexec,nosuid  1 2
2
UUID=<home-uuid>    /home         xfs   defaults,nodev                0 2
3
UUID=<var-uuid>     /var          xfs   defaults,nodev                0 2
4
UUID=<log-uuid>     /var/log      xfs   defaults,nodev                0 2
5
UUID=<audit-uuid>   /var/log/audit xfs  defaults,nodev                0 2
6
UUID=<tmp-uuid>     /tmp          xfs   defaults,nodev,noexec,nosuid  0 2
7
UUID=<vtmp-uuid>    /var/tmp      xfs   defaults,nodev,noexec,nosuid  0 2
8
UUID=<srv-uuid>     /srv          xfs   defaults,nodev                0 2
9
UUID=<opt-uuid>     /opt          xfs   defaults,nodev                0 2
10
UUID=<root-uuid>    /             xfs   defaults                      0 1
11
UUID=<swap-uuid>    swap          swap  defaults                      0 0

📝 Replace <UUID> with actual disk UUIDs using blkid command

🛠 Steps to Configure During Installation#

Manual Partitioning: Choose “Custom Partitioning” in Rocky Linux installer.
Format the Partitions:
- Set /boot as ext4.
- Set all other partitions as XFS.
- Set swap as swap.
Assign Mount Points as per the table.
Apply Mount Options:
- Click on Modify Mount Options → Set nodev, noexec, nosuid as needed.
Confirm Total Usage is ~400 GiB and proceed with installation.

🔍 Additional Hardening#

✔ Enable Automatic fsck (Filesystem Check) on Boot ✔ Ensure SELinux is Enforcing (getenforce should return Enforcing) ✔ Set correct file permissions (chmod 1777 /tmp /var/tmp)

🔥 Final Thoughts#

✅ This layout follows CIS Benchmark best practices.
✅ Provides security, prevents attacks on /tmp, and separates logs.
✅ Optimized for server use (Rocky Linux, CentOS, RHEL-based).
✅ Will scale well for both production and development workloads.

Automation with Ansible#

This partitioning scheme can be automated using Ansible for consistent deployments across multiple servers. A basic playbook structure would include:

1
---
2
- name: Configure CIS-compliant partitioning
3
  hosts: rocky_servers
4
  become: true
5
  tasks:
6
    - name: Install required packages
7
      dnf:
8
        name:
9
          - parted
10
          - lvm2
11
        state: present
12

13
    - name: Configure partitions
14
      block:
15
        - name: Create partitions
16
          # Commands to create partitions
17
          # This would typically involve parted commands
18

19
        - name: Format partitions
20
          # Format each partition with the correct filesystem
21

22
        - name: Update fstab
23
          # Add entries to /etc/fstab
24

25
        - name: Set correct permissions
26
          file:
27
            path: "{{ item }}"
28
            mode: "1777"
29
          with_items:
30
            - /tmp
31
            - /var/tmp

For production use, a more detailed playbook with proper error handling and idempotence checks would be necessary.

By following this partitioning scheme and security recommendations, you’ll have a solid foundation for a secure Rocky Linux 9.5 server that aligns with CIS Benchmark standards.