Initial server setup with AlmaLinux and Rocky Linux 9 and 10

Your provider has handed you a server with AlmaLinux or Rocky Linux already installed and a root login. This tutorial covers the next fifteen minutes. Every other tutorial on this site assumes a server prepared this way, and each step prevents a specific problem later:

• outdated packages with known vulnerabilities
• mail rejected because the server introduces itself with the wrong name
• certificates and signatures failing because the clock has drifted
• services exposed to the internet that never needed to be
• a root password that bots can guess

It is written for AlmaLinux and Rocky Linux 9 and 10, where every command below is identical. Run everything as root.

Bring the system up to date

A fresh image is usually weeks behind its repositories. Update before installing anything else.

dnf -y upgrade --refresh

If the update pulled in a new kernel, reboot when you finish this tutorial so it takes effect.

Set a fully qualified hostname

Mail servers check that a sending host introduces itself with a real name that resolves back to it. Pick a name under a domain you control. server.example.com stands in for yours throughout.

hostnamectl set-hostname server.example.com

At your DNS provider, create an A record for that name pointing at the server’s public IP. Then ask your hosting provider to set the reverse DNS (PTR) of that IP to the same name, usually from their control panel. No command on the server can do either of these, and mail delivery depends on both.

Keep the clock accurate

TLS handshakes, Let’s Encrypt and DKIM signatures all fail when the clock is wrong. chrony keeps it in sync, and UTC keeps logs comparable across servers and time zones.

timedatectl set-timezone UTC
dnf -y install chrony
systemctl enable --now chronyd

Open only what a web server needs

firewalld is the standard firewall on RHEL-family systems, but cloud images do not always include it. Allow SSH, HTTP and HTTPS, and nothing else for now. Later tutorials open the ports they need, one service at a time.

dnf -y install firewalld
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh --add-service=http --add-service=https
firewall-cmd --reload

firewall-cmd --list-services shows what is open at any time.

Install security updates automatically

Waiting for someone to log in and run dnf upgrade is how servers end up months behind on fixes. dnf-automatic installs security updates on its own, once a day. Feature updates stay manual, so nothing changes under you without a security reason.

dnf -y install dnf-automatic
sed -i -e 's/^upgrade_type *=.*/upgrade_type = security/' -e 's/^apply_updates *=.*/apply_updates = yes/' /etc/dnf/automatic.conf
systemctl enable --now dnf-automatic.timer

The two settings say what to install (security fixes only) and that installing them does not need you to approve it. systemctl list-timers dnf-automatic.timer shows when it runs next.

Log in with a key, not a password

Every server on the internet gets password-guessing attempts on SSH within minutes of booting. A key cannot be guessed. Most providers already put your public key in /root/.ssh/authorized_keys when they create the server.

This command fails, and the tutorial stops here, if there is no key on the server:

test -s /root/.ssh/authorized_keys

Then turn off password logins. Root can still log in, but only with a key:

cat > /etc/ssh/sshd_config.d/10-key-only.conf <<'EOF'
PasswordAuthentication no
KbdInteractiveAuthentication no
PermitRootLogin prohibit-password
EOF
sshd -t
systemctl reload sshd

The file name starts with 10- because the first value sshd reads wins. Cloud images often ship a 50-cloud-init.conf that turns passwords back on, and 10- is read before it. sshd -t checks the configuration before the reload, so a typo cannot take SSH down. Sessions that are already open stay open.

Check the result

Each of these lines fails loudly if its step did not take:

hostnamectl --static | grep -x server.example.com
timedatectl show -p Timezone --value | grep -x UTC
systemctl is-active chronyd
firewall-cmd --list-services | tr ' ' '\n' | grep -x https
systemctl is-enabled dnf-automatic.timer
grep -x 'upgrade_type = security' /etc/dnf/automatic.conf
sshd -T | grep -x 'passwordauthentication no'
sshd -T | grep -x 'permitrootlogin without-password'

sshd -T prints the configuration sshd is actually using, after every included file, so it is the only reliable way to check the last step. (without-password is the old name for prohibit-password, and it is how sshd -T reports it.)

curl -fsSL https://get.corepanel.net/install.sh | bash