# Initial server setup with AlmaLinux and Rocky Linux 9 and 10 > The first steps on a new AlmaLinux or Rocky Linux server: updates, a real hostname, accurate time, a firewall, automatic security updates and key-only SSH. Source: https://www.corepanel.net/tutorials/initial-server-setup-almalinux-rocky Author: CorePanel Team Published: 2026-10-05 Track: Server stack · beginner · ~15 min Tested on: AlmaLinux 9.8 (2026-10-05) Tested on: AlmaLinux 10.2 (2026-10-05) Tested on: Rocky Linux 9.8 (2026-10-05) Tested on: Rocky Linux 10.2 (2026-10-05) CorePanel edition needed: Personal (free) Tags: almalinux, rocky-linux, firewalld, ssh, security From CorePanel Tutorials — https://www.corepanel.net/tutorials --- Your provider has handed you a server with AlmaLinux or Rocky Linux already installed and a root login. This tutorial covers the next fifteen minutes. Every other tutorial on this site assumes a server prepared this way, and each step prevents a specific problem later: - outdated packages with known vulnerabilities - mail rejected because the server introduces itself with the wrong name - certificates and signatures failing because the clock has drifted - services exposed to the internet that never needed to be - a root password that bots can guess It is written for AlmaLinux and Rocky Linux **9 and 10**, where every command below is identical. Run everything as `root`. ## Bring the system up to date A fresh image is usually weeks behind its repositories. Update before installing anything else. ```bash dnf -y upgrade --refresh ``` If the update pulled in a new kernel, reboot when you finish this tutorial so it takes effect. ## Set a fully qualified hostname Mail servers check that a sending host introduces itself with a real name that resolves back to it. Pick a name under a domain you control. `server.example.com` stands in for yours throughout. ```bash hostnamectl set-hostname server.example.com ``` At your DNS provider, create an `A` record for that name pointing at the server's public IP. Then ask your hosting provider to set the **reverse DNS** (PTR) of that IP to the same name, usually from their control panel. No command on the server can do either of these, and mail delivery depends on both. ## Keep the clock accurate TLS handshakes, Let's Encrypt and DKIM signatures all fail when the clock is wrong. `chrony` keeps it in sync, and UTC keeps logs comparable across servers and time zones. ```bash timedatectl set-timezone UTC dnf -y install chrony systemctl enable --now chronyd ``` ## Open only what a web server needs `firewalld` is the standard firewall on RHEL-family systems, but cloud images do not always include it. Allow SSH, HTTP and HTTPS, and nothing else for now. Later tutorials open the ports they need, one service at a time. ```bash dnf -y install firewalld systemctl enable --now firewalld firewall-cmd --permanent --add-service=ssh --add-service=http --add-service=https firewall-cmd --reload ``` `firewall-cmd --list-services` shows what is open at any time. ## Install security updates automatically Waiting for someone to log in and run `dnf upgrade` is how servers end up months behind on fixes. `dnf-automatic` installs security updates on its own, once a day. Feature updates stay manual, so nothing changes under you without a security reason. ```bash dnf -y install dnf-automatic sed -i -e 's/^upgrade_type *=.*/upgrade_type = security/' -e 's/^apply_updates *=.*/apply_updates = yes/' /etc/dnf/automatic.conf systemctl enable --now dnf-automatic.timer ``` The two settings say what to install (security fixes only) and that installing them does not need you to approve it. `systemctl list-timers dnf-automatic.timer` shows when it runs next. ## Log in with a key, not a password Every server on the internet gets password-guessing attempts on SSH within minutes of booting. A key cannot be guessed. Most providers already put your public key in `/root/.ssh/authorized_keys` when they create the server. > **Caution** > > **Check that you have a key before you turn passwords off.** If you log in with a > password, you will lock yourself out. Add your key first (`ssh-copy-id root@your-server` > from your own computer), open a **second** session with it, and only then continue. This command fails, and the tutorial stops here, if there is no key on the server: ```bash test -s /root/.ssh/authorized_keys ``` Then turn off password logins. Root can still log in, but only with a key: ```bash cat > /etc/ssh/sshd_config.d/10-key-only.conf <<'EOF' PasswordAuthentication no KbdInteractiveAuthentication no PermitRootLogin prohibit-password EOF sshd -t systemctl reload sshd ``` The file name starts with `10-` because the first value sshd reads wins. Cloud images often ship a `50-cloud-init.conf` that turns passwords back on, and `10-` is read before it. `sshd -t` checks the configuration before the reload, so a typo cannot take SSH down. Sessions that are already open stay open. ## Check the result Each of these lines fails loudly if its step did not take: ```bash hostnamectl --static | grep -x server.example.com timedatectl show -p Timezone --value | grep -x UTC systemctl is-active chronyd firewall-cmd --list-services | tr ' ' '\n' | grep -x https systemctl is-enabled dnf-automatic.timer grep -x 'upgrade_type = security' /etc/dnf/automatic.conf sshd -T | grep -x 'passwordauthentication no' sshd -T | grep -x 'permitrootlogin without-password' ``` `sshd -T` prints the configuration sshd is actually using, after every included file, so it is the only reliable way to check the last step. (`without-password` is the old name for `prohibit-password`, and it is how `sshd -T` reports it.) ## The CorePanel way This is the server CorePanel expects: a fresh AlmaLinux, Rocky Linux or RHEL 8, 9 or 10 install, up to date. From here, one command installs the whole hosting stack — web server, PHP, MariaDB, mail, DNS and free SSL — and opens the firewall ports each service needs: ```bash curl -fsSL https://get.corepanel.net/install.sh | bash ``` [Getting started](https://www.corepanel.net/docs/getting-started) lists the requirements and what the installer asks for.