Validated platforms
Obexum ships 24 operating-system scopes. Every scope is a per-SKU file in the scanner that records the platform’s quirks, the false positives that were hunted on it and the level of validation reached. This page is generated from those scope files and the lab records — it is the honest version of “supported platforms”.
What the tiers mean
- Lab-validated — a dedicated host of that exact SKU where we ran the pericial cycle: inject the adversarial condition, confirm the check fires with the right severity and evidence, revert, confirm it clears; plus an independent cold-eye review of the emitted findings, 3-round determinism and (Linux) locale and MAC toggles. 0 false positives in the clean baseline is the exit gate.
- Binary-compatible — the SKU is a bit-for-bit rebuild of a lab-validated one (RHEL/Alma from Rocky, Leap from SLE). Every fix applies transitively; a cross-host run on the fork itself has not been done yet.
- Production-validated (F1–F5) — validated on a real production host for the first five check families, then audited finding-by-finding, but without the full sprint (no service inject cycle, no cold-eye pass).
R1 = rules exercised inject→detect→teardown on that host · F9 = service-specific checks (PostgreSQL, Redis/Valkey, MariaDB, MongoDB, Elasticsearch, Postfix, Docker, Kubernetes) exercised with a real misconfigured install · cold-eye = independent review of every finding of the clean baseline.
| Family | SKU | Scope | Tier | Lab / host | Validation evidence | F9 services | Notes |
|---|---|---|---|---|---|---|---|
| Windows Server | Windows Server 2025 | v1.1.0 | Lab-validated | VMware lab DC + customer host | 152/174 checks R1; cold-eye 74 risks → 25 fixes | — | Reference Windows SKU. Prism ARM emulator, Hotpatch aware. |
| Windows Server | Windows Server 2022 | v1.0.0 | Lab-validated | VMware lab DC (obxlab.local) | 26 R1 cycles (foundational criteria) | — | Validated before the R2/locale protocol existed; retro-sweep pending. |
| Windows Server | Windows Server 2019 | v1.3.0 | Lab-validated | VMware lab | F12 base + F13 AD R1 | — | PowerShell 5.1, LAPS legacy schema. |
| Windows Server | Windows Server 2016 | v1.0.x | Lab-validated | VMware lab (Spanish locale) | F12 base R1; Get-HotFix locale fix | — | Cred Guard opt-in; OpenSSH via optional feature. |
| RHEL family | Rocky Linux 9.7 | v1.3.0 | Lab-validated | obxlab-rocky9 | 17 rules R1 · cold-eye 22 risks · 5 locales · SELinux toggle | 8/8 | Most exhaustive Linux scope; crypto-policies aware. |
| RHEL family | Rocky Linux 8.10 | v1.4.0 | Lab-validated | obxlab-rocky8 | 14 rules R1 · cold-eye 14 · 5 locales · SELinux | 8/8 | glibc 2.28 → static build. |
| RHEL family | RHEL 10.1 | v1.4.0 | Lab-validated | obxlab-rhel10 | 10 rules R1 · cold-eye 5 fixes | 7/8 | systemd 256 eBPF programs, cockpit/wsdd listeners. |
| RHEL family | RHEL 7.9 | v1.4.0 | Lab-validated | obxlab-rhel7 | 10 rules R1 · cold-eye 1 fix | 7/8 | Legacy: multi-arch securetty, no crypto-policies, kernel 3.10. |
| RHEL family | Oracle Linux 9.7 | v1.4.0 | Lab-validated | obxlab-oracle9 | 10 rules R1 · cold-eye 3 fixes · UEK7 + RHCK kernels | 8/8 | Anaconda install marker. |
| RHEL family | RHEL 8 / 9 · AlmaLinux 8 / 9 | v1.0.0-bincompat | Binary-compatible | — (transitive via Rocky 8 / 9) | Inherits every Rocky fix; no own host yet | 8/8 (inherited) | Exact rebuilds of the same sources; cross-host run still pending. |
| Debian family | Debian 12 | v1.5.0 | Lab-validated | obxlab-debian12 | 10 rules R1 · UsrMerge + d-i marker fixes | 8/8 | Reference Debian scope. |
| Debian family | Debian 11 | v1.0.0 | Lab-validated | obxlab-debian11 | 8 rules R1 · 3-round determinism | 8/8 (via Debian 12) | OpenSSL 1.1.1, OpenSSH 8.4, DSA host key detected. |
| Debian family | Ubuntu 22.04 LTS | v1.0.0 | Lab-validated | obxlab-ubuntu22 | 8 rules R1 · 4 Ubuntu-specific FP fixes | 4/8 + 4 inherited | snap-confine, systemd-resolved, AppArmor 40 profiles. |
| Debian family | Ubuntu 24.04 LTS | v1.0.0 | Production-validated (F1–F5) | real SaaS host + 72-agent FP audit | 206 findings audited finding-by-finding; 14 FP families fixed | — | F6–F8 / cold-eye / F9 not run as a formal sprint. |
| SUSE | SLES 15 SP6 | v1.4.0 | Lab-validated | obxlab-sles15 | 10 rules R1 · cold-eye · permissions framework, klog, pam_cracklib | 3/8 | Services beyond 3/8 need an SCC subscription. |
| SUSE | openSUSE Leap 15 | v1.0.0-bincompat | Binary-compatible | — (transitive via SLES 15) | Inherits SLES fixes | 3/8 (inherited) | Community defaults may differ from SLE. |
| Other Linux | Alpine 3.23 | v1.4.0 | Lab-validated | obxlab-alpine | 10 rules R1 · cold-eye · musl/OpenRC/busybox/apk quirks | 2/8 | No auditd / journald by design; OpenRC services need manual init. |
| Other Linux | Arch Linux (rolling) | v1.5.0 | Lab-validated | obxlab-arch | 9/10 rules R1 · pacman ownership, archinstall marker | n/a | Rolling release; validated on kernel 7.0. |
| BSD | FreeBSD 14.2 | v1.4.0 | Lab-validated | obxlab-freebsd | Platform foundation + toor/uucp/login.conf semantics | n/a | Native check coverage is thin (SSH/config + CVE via VuXML); see note. |
| BSD | OpenBSD 7.6 | — | Lab-validated | obxlab-openbsd | 15 lab snapshots; doas, pledge/unveil, pf | n/a | Shares the BSD recipes; native coverage thin. |
| BSD | NetBSD 10.1 | — | Lab-validated | obxlab-netbsd | 7 lab snapshots; pkgsrc, npf | n/a | Shares the BSD recipes; native coverage thin. |
Read this before you buy
- BSD family: the platform foundation, SSH/config controls (146 configuration controls apply wherever the file exists), attack chains and CVE matching (FreeBSD VuXML, OpenBSD errata, NetBSD pkg-vulnerabilities) are validated; only 8 native host checks currently declare BSD, so a FreeBSD scan is mostly SSH posture + CVEs. We say so rather than pad the count.
- Windows CVE matching compares the host build (
CurrentBuild.UBR) against Microsoft’s fixed build per CVE — immune to KB supersedence. Office, SQL Server, .NET and Edge are not inventoried and are never guessed. - Not covered: Windows 10/11 workstations (remediation variants only), Windows Server 2012 R2 and older, Fedora, Amazon Linux 2023, macOS. Containers are audited from the host that runs them.
- A platform you need that is not lab-validated can be validated on your own host as part of an engagement (R3/R4 cycle, typically 2–3 days per SKU).