Operating system

Kasm Workspaces requires an underlying Linux system to run on. Workspaces runs on several Linux-based operating systems, but organizations concerned with security, or that run in an air-gapped network without internet access, typically face restrictions that dictate the operating system. The US Federal Government and Department of Defense (DoD) were historically tied to Red Hat. That changed when DISA released a STIG checklist for Ubuntu Pro, created to help organizations meet FedRAMP, FISMA, FIPS, or DISA STIG compliance. Current STIG documentation from the DoD is available on its official public portal. Stigviewer is a community tool that provides a user-friendly interface for working with STIGs.

For organizations that need to meet DISA STIG requirements or NIST 800-53 controls, Kasm Technologies recommends Ubuntu 22.04 LTS, with a strong preference for the paid support version, which is required to enable FIPS enforcement. Kasm Technologies has worked directly with many DoD organizations using both Red Hat and Ubuntu 22.04 LTS, and this recommendation is based on that experience. Kasm Technologies does not support the underlying operating system or its hardening.

The following table lists hardening requirements on the underlying operating system to consider carefully on systems that support Kasm Workspaces.

Name	Severity	Summary	Caution
V-260517	Medium	Configure rate limiting on the host-based firewall.	All Kasm components use HTTPS for client communication and inter-service communication. Because Kasm is a server application that handles requests from many users, use a high limit on the Kasm port. The default port is 443, but this guide recommends a high port number during installation. The DISA documented method for rate limiting with ufw on Ubuntu is an on-or-off proposition. Kasm recommends rate limiting on a traditional firewall in the security stack, the front-end reverse proxy, or both. When per-server rate limiting is required, edit iptables manually rather than using ufw for the Kasm port, so you can specify the limits. Choose a higher limit to accommodate the high traffic expected for your deployment.
V-257939	Medium	Configure rate limiting on the host-based firewall.	All Kasm components use HTTPS for client communication and inter-service communication. Because Kasm is a server application that handles requests from many users, do not rate limit the Kasm port aggressively. The default port is 443, but this guide recommends a high port number during installation. Choose a higher limit for the Kasm port to accommodate the high traffic expected for your deployment.