Combined Cloud Managed Services

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.

====== OS Patching and Hardening ======

Gaudi nodes run the same base OS as the rest of our fleet, so they follow the same patching discipline — with one extra check because of the driver.

**Supported OS:** Ubuntu 22.04 LTS (preferred — best driver compatibility) or Ubuntu 24.04 LTS; RHEL 9.x for customers who need it for compliance reasons.

==== Patch SLA (same as everywhere else in the fleet) ====

^ Severity              ^ Patch within                          ^
| Critical (CVSS 9.0+)  | 14 days                               |
| High (7.0–8.9)        | 30 days                               |
| Medium (4.0–6.9)       | Next quarterly maintenance window     |
| Low                   | Annually                              |

> **The Gaudi-specific catch:** the Gaudi driver is tied to a specific kernel version through DKMS. Before applying any kernel update, we check it against Intel's compatibility list. After the update, we confirm with ''dkms status'' that the driver rebuilt cleanly. If it didn't, we roll back to the previous kernel via GRUB and hold that node until a compatible driver build is available — we never leave a node running with a broken accelerator driver.

==== Hardening baseline (applied at provisioning, same as NVIDIA nodes) ====

  * SSH: key-only authentication, no root login.
  * Kernel-level hardening via sysctl.
  * ''/tmp'' mounted with ''noexec,nosuid,nodev''.
  * ''auditd'' enabled and shipping logs to our central log aggregator.
  * Unnecessary services disabled.

**Verification:** a quarterly OpenSCAP compliance scan against the CIS Benchmark (Level 1) confirms the hardening baseline hasn't drifted.

----

[[gaudi-software-firmware|← Previous]] | [[gaudi-guide|Guide Index]] | [[gaudi-storage-nvme|Next →]]

Combined Cloud Managed Services

Site Tools

Page Tools