Version 2.9.0

Released 9 September 2026

SCE for Linux v2.9.0 introduces support for the Debian Linux 12 (Bookworm) operating system and Puppet 9. This release also implements security and reliability improvements to help you maintain a secure and stable Puppet estate.

SCE for Linux v2.9.0 does not introduce known breaking changes. New parameters are additive and use default values to minimize the impact on existing configurations.

New features and enhancements

  • Support for Debian 12. You can now implement Center for Internet Security (CIS) recommendations in a Debian Linux 12 (Bookworm) environment by applying the Debian Linux 12 Benchmark V2.0.0, Level 1, 2 – Server.

  • Puppet 9 compatibility. To take advantage of the latest Puppet platform updates and security improvements, you can now run SCE for Linux with Puppet 9. Compatibility was verified through continuous integration (CI) testing. Dependency bounds were updated accordingly.

Resolved issues

  • PAM profiles not applied on Ubuntu Linux. Previously, pluggable authentication module (PAM) profiles were enabled but not applied, causing some 5.3.x controls to fail on nodes reported as compliant. The issue was resolved to ensure that the profiles are applied and the PAM stack is hardened.

  • Logging service incorrectly implemented on Ubuntu Linux 22.04 and 24.04. Previously, an incorrect path was hard-coded for the rsyslog logging service on Debian-family operating systems, resulting in "Permission denied" errors. The configuration template hard-coded $WorkDirectory /var/lib/rsyslog, while Ubuntu Linux 22.04 and 24.04 require /var/spool/rsyslog. The path was corrected to resolve the issue.

  • AIDE initialization fails on Ubuntu Linux. The issue was resolved to ensure that the Advanced Intrusion Detection Environment (AIDE) is initialized correctly.

  • Crypto controls incorrectly configured on Rocky Linux 8. Crypto controls are intended to prevent the use of weak Message Authentication Code (MAC) algorithms. On Rocky Linux 8, the controls were not working as designed. The manage_crypto_policies block was updated to resolve the issue and enforce strong algorithms.

  • Failure to re-create the time synchronization file. If the Chrony configuration file was deleted from a node, a subsequent Puppet run did not re-create the file. The issue occurred because the time sync utility used the file_line resource type to manage the file without a corresponding file resource. The fix adds file { ...: ensure => file } to each configuration path when manage_package => true.

  • Invalid configuration causes boot entries to fail on Ubuntu Linux. With the grub2 bootloader, a setting of set_grub2_password: true specifies that a superuser password is required to edit boot entries, but not to boot the entries. On Ubuntu Linux, the grub2 bootloader failed to work as designed. The true setting wrote an /etc/grub.d/50_password script in which the password requirement was not restricted to menu entries. As a result, the bootloader prompted for a password on every boot, and nodes could not be booted unattended. In addition, the script remained active even with a setting of no. The issues were corrected to restore expected bootloader behavior.

  • Error occurs when specifying active zone target for firewalld. Previously, an error occurred when users set an active zone target for the firewalld solution by specifying {"public"=>{"target"=>"DROP"}}. The "unable to parse" error was displayed because the {"public"=>{"target"=>"DROP"}} example shown on the Puppet Forge Reference page was invalid. To resolve the issue, the Reference page was updated to display only the valid example:

    • Copy 
    control_configs: 
      Ensure firewalld active zone target is configured: 
      zones: 
      trusted: 
      target: ACCEPT 
      interfaces: <interface>