What Herd ships, what we commit to, and the command that confirms every claim on this page on your own machine.
None of this asks for trust. Every row carries the command that shows the value on your install, so you can compare it against what we claim.
| Area | Default in Herd | Check it yourself |
|---|---|---|
| SELinux | enforcing | getenforce |
| Firewall | only ssh and cockpit open | sudo firewall-cmd --list-services |
| SSH — root | PermitRootLogin no | sshd -T | grep permitrootlogin |
| SSH — password | PasswordAuthentication no | sshd -T | grep passwordauth |
| SSH — attempts | MaxAuthTries 3, LoginGraceTime 30 | sshd -T | grep -E "maxauthtries|logingrace" |
| umask | 027 on login sessions | umask |
| Password — quality | minimum 12 characters, 3 classes | grep -r . /etc/security/pwquality.conf.d/ |
| Password — ageing | maximum 90 days, minimum 7 | grep PASS_ /etc/login.defs |
| Audit | auditd active from boot | systemctl is-active auditd |
| Updates | dnf5-automatic.timer enabled | systemctl is-enabled dnf5-automatic.timer |
These are the defaults of the standard profile, applied at install. Any of them can be changed by you — and the change shows up in the next scan.
herd-compliance-scan uses the SCAP Security Guide, with the datastream embedded in the system — nothing is fetched at run time. All five profiles ship installed and run with one command, no licence.
| Profile | Rules evaluated |
|---|---|
standard | 76 |
pci-dss | 121 |
ospp | 208 |
cis-l1 | 324 |
cis-l2 | 438 |
Count them yourself: the numbers come from the datastream in /usr/share/xml/scap/. The standard profile runs by default because it is a baseline that does not break ordinary services; the stricter ones change a great deal more and deserve an impact assessment first.
Security fixes go to the current stable series. Each series follows its base Fedora release and support ends when that Fedora reaches end of life — the Life Cycle page has every date.
dnf5-automatic.timer ships enabled, so a forgotten server keeps receiving fixes. Herd is maintained by a small team, so we respond on a best-effort basis — we would rather say that than publish a window we cannot hold. What we promise is the process: every report is acknowledged, triaged, fixed in the supported series and disclosed together with whoever reported it.
Packages and metadata are signed with the project key, and repo_gpgcheck is enforced on the transaction — an unsigned or tampered repository fails the install, it does not become a log warning.
The Herd key fingerprint is:
C852 6722 0A81 18C9 864F 0648 BE5B 82AD C8A2 85C0
Compare it against your machine and follow the steps in the security documentation. The private key has never been on the repository server nor on any connected build machine: it stays offline. A compromised server can at most serve files your system refuses.
The ISO is produced with official Fedora tooling — lorax, mock and osbuild — from a kickstart versioned in the repository, not from a hand-configured machine. The package list is the kickstart's: a lean server, with no desktop and no service nobody asked for.
Only sshd, chronyd, firewalld, cockpit.socket, cloud-init and the update timer are enabled. Check with systemctl list-unit-files --state=enabled.
herd-compliance-scan evaluates the running system and writes a readable HTML report alongside XCCDF XML and ARF — the format auditors import straight into their own tooling.
The evidence is produced on your machine, from your configuration. Nothing is uploaded, and no result passes through us.
Herd collects nothing. No telemetry, no usage metrics, no phone-home at boot or at update time, and no account to download, install or receive fixes. The system does not need to reach us to work — which is why it runs air-gapped.
Check it: systemctl list-unit-files --state=enabled lists no telemetry service, and an idle Herd generates no outbound traffic.
Report privately — do not open a public issue. Use GitHub Security Advisories, with private reporting enabled on the project repositories. Without GitHub, use the contact form just to make contact, with no technical detail, and we will agree on a private channel.
It helps to include the version (cat /etc/os-release), steps to reproduce, the impact and, where possible, a proof of concept. We will work with you on a coordinated disclosure.
The report is not something we show you and you believe: it is a command you run on your own server. It produces a readable HTML report, a results XML and the ARF evidence that audit tools can import.
We will publish a reference report here, generated on a clean VM, alongside the Herd 2 release.
sudo herd-compliance-scan standard
It covers the technical controls of CIS (Levels 1 and 2, Server), OSPP, PCI-DSS and the standard profile, plus the evidence to demonstrate them. It is not an organisational certification such as ISO 27001, SOC 2 or a PCI-DSS attestation. Those need your policies, your people and an independent assessor. Herd supports that work; it does not replace it.
Herd runs with fips=1 and the FIPS crypto-policy. That is operational FIPS mode. It is not CMVP validation — Fedora’s cryptographic modules are not validated. If your requirement is validated modules, Herd’s current base does not meet it, and we would rather tell you now than at your audit.
We would rather be precise than impressive.