CapivaraOS logo
Herd 1.0.1

Trust Center

Straight answers about how Herd protects a server: what is hardened by default, what compliance-ready means (and doesn't), the honest scope of FIPS mode, and how to report a vulnerability. We'd rather be precise than impressive.

Compliance overview Security docs

Security posture

What Herd 1.0.1 does to protect the system, out of the box.

🔒

Hardened by default

SELinux enforcing, SSH restricted to keys (no root login), a minimal firewall and system auditing (auditd) enabled from first boot.

🛡️

Hardening & assessment

herd-harden applies a security profile via Ansible; herd-compliance-scan evaluates the system with OpenSCAP and produces HTML + ARF evidence.

🔑

Encryption & FIPS mode

Full-disk encryption with LUKS (opt-in) and an optional FIPS mode that operates with FIPS-approved algorithms. Scope note below.

Compliance-ready

Herd ships hardened configuration, standard security profiles and verifiable evidence that address the technical controls of widely used baselines — CIS (Levels 1 and 2, Server), OSPP, PCI-DSS and a lightweight standard profile — using OpenSCAP / SCAP Security Guide. This reduces the work of a security audit: you can hand over machine-readable (ARF) and human-readable (HTML) reports instead of screenshots.

To be precise: "compliance-ready" is about the technical controls the system addresses. It is not the same as an organizational certification (e.g., ISO 27001, SOC 2, PCI-DSS attestation), which is a formal process involving your policies, people and an independent assessor. Herd gives you a strong technical starting point and the evidence to support that process — it does not replace it. We say "compliance-ready", and we mean exactly that.

FIPS mode

Herd can operate in FIPS mode: the system is configured to use FIPS-approved cryptographic algorithms (fips=1 plus the FIPS crypto-policy). This is operational FIPS mode. It is not the same as running CMVP-validated cryptographic modules — Fedora's crypto modules are not CMVP-validated. So we say "FIPS mode", and never "FIPS-certified". If your requirement is specifically for validated modules, that is a different bar, and we're transparent that Herd's current base does not meet it.

Report a vulnerability

Found a security issue? Please report it privately via GitHub Security Advisories (private vulnerability reporting is enabled on our repositories). If you can't use GitHub, get in touch and we'll route it privately. Please give us a reasonable window to fix and release before public disclosure.

See also our Privacy Policy and the security documentation.