Initial Server Setup for AlmaLinux 8, 9, 10 & Rocky Linux 8, 9, 10

This guide covers the recommended initial configuration of a newly deployed AlmaLinux or Rocky Linux VPS or dedicated server.

The instructions are suitable for:

• AlmaLinux 8.x, including AlmaLinux 8.10
• AlmaLinux 9.x, including AlmaLinux 9.8
• AlmaLinux 10.x, including AlmaLinux 10.2
• Rocky Linux 8.x, including Rocky Linux 8.10
• Rocky Linux 9.x, including Rocky Linux 9.8
• Rocky Linux 10.x, including Rocky Linux 10.2

Most commands are identical across AlmaLinux and Rocky Linux because both distributions are designed for compatibility with the Red Hat Enterprise Linux ecosystem.

Important: Commands in this article assume that you initially have root access to the server. Replace example usernames, hostnames and IP addresses with your own values.

1. Check Your Linux Version

Before making changes, confirm the operating system and version installed on your server.

cat /etc/os-release

You can also check the kernel:

uname -r

For AlmaLinux:

cat /etc/almalinux-release

For Rocky Linux:

cat /etc/rocky-release

2. Update the Server

The first task on a newly deployed server should normally be installing the latest available security patches and package updates.

dnf clean all
dnf makecache
dnf upgrade -y

On these distributions, dnf update can also be used:

dnf update -y

If a kernel, systemd, glibc or other major system component was upgraded, reboot the server:

reboot

After reconnecting, confirm that the server is running normally:

uptime
uname -r

3. Configure the Server Hostname

A correctly configured hostname is important for logging, monitoring, email services, control panels and SSL/TLS configuration. After DNS and hostname changes, you can use the Systron online server and webmaster tools to verify DNS, SSL and related configuration from outside the server.

For example:

hostnamectl set-hostname server1.example.com

Verify the change:

hostnamectl

or:

hostname -f

For a production server, using a fully qualified domain name such as server1.example.com is recommended.

4. Configure the Timezone

Correct system time is essential for logs, backups, scheduled jobs, databases, SSL certificates and authentication services.

Check the current configuration:

timedatectl

List available timezones:

timedatectl list-timezones

For UTC:

timedatectl set-timezone UTC

For India:

timedatectl set-timezone Asia/Kolkata

Verify:

timedatectl

5. Verify Network Time Synchronization

AlmaLinux and Rocky Linux normally use chronyd for network time synchronization.

Install it if necessary:

dnf install chrony -y

Enable and start the service:

systemctl enable --now chronyd

Check synchronization:

chronyc tracking
chronyc sources -v

6. Install Useful Administrative Tools

A minimal cloud image may not contain many commonly used administration utilities.

dnf install -y nano vim wget curl tar unzip zip rsync bind-utils net-tools lsof htop git bash-completion

Some packages may require the EPEL repository.

7. Enable the EPEL Repository

EPEL, or Extra Packages for Enterprise Linux, provides additional packages commonly used on production servers.

dnf install epel-release -y

Refresh the repository metadata:

dnf makecache

Verify enabled repositories:

dnf repolist

8. Create a Non-Root Administrator Account

Routine administration directly through the root account is not recommended.

Create a normal administrator account. In this example the username is adminuser.

adduser adminuser
passwd adminuser

Add the user to the wheel group, which provides sudo privileges:

usermod -aG wheel adminuser

Verify membership:

id adminuser

Test sudo access:

su - adminuser
sudo whoami

The result should be:

root

9. Configure SSH Key Authentication

SSH public-key authentication is considerably safer than relying only on passwords.

If root already has an authorized SSH key and you want the newly created user to use the same key:

mkdir -p /home/adminuser/.ssh
cp /root/.ssh/authorized_keys /home/adminuser/.ssh/authorized_keys
chown -R adminuser:adminuser /home/adminuser/.ssh
chmod 700 /home/adminuser/.ssh
chmod 600 /home/adminuser/.ssh/authorized_keys

Open a second terminal window and verify that you can log in:

ssh adminuser@YOUR_SERVER_IP

Do not close your existing root session until the new account has been successfully tested.

10. Harden the SSH Server

After confirming that your sudo account and SSH key work correctly, you can tighten SSH security.

Back up the SSH configuration first:

cp /etc/ssh/sshd_config /etc/ssh/sshd_config.backup

Edit the configuration:

nano /etc/ssh/sshd_config

Recommended settings for a key-based server include:

PermitRootLogin no
PubkeyAuthentication yes
PasswordAuthentication no
PermitEmptyPasswords no
X11Forwarding no

Before restarting SSH, validate the configuration:

sshd -t

If the command returns no error, reload SSH:

systemctl reload sshd

Important: Always test a new SSH connection before closing your existing session.

11. Optional: Change the SSH Port

Changing the SSH port does not replace proper SSH security, but it can reduce automated scans against port 22.

For example, to use TCP port 2222, configure:

Port 2222

If SELinux is enforcing, register the new SSH port:

semanage port -a -t ssh_port_t -p tcp 2222

If the semanage command is not available:

dnf install policycoreutils-python-utils -y

Allow the new port through firewalld before restarting SSH:

firewall-cmd --permanent --add-port=2222/tcp
firewall-cmd --reload

Then validate and reload SSH:

sshd -t
systemctl reload sshd

12. Configure Firewalld

AlmaLinux and Rocky Linux use firewalld as the standard firewall management service.

Install it if necessary:

dnf install firewalld -y

Enable it:

systemctl enable --now firewalld

Before making changes, make sure SSH is permitted:

firewall-cmd --permanent --add-service=ssh

For a normal web server, allow HTTP and HTTPS:

firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Check the configuration:

firewall-cmd --list-all

Do not open ports unless the server actually requires them.

13. Verify SELinux

SELinux provides an important additional security layer and should normally remain enabled.

Check its status:

sestatus

You will normally want to see:

SELinux status: enabled
Current mode: enforcing

You can also use:

getenforce

A production server should normally return:

Enforcing

Do not disable SELinux simply because an application encounters a permissions problem. Investigate and configure the correct SELinux policy instead.

14. Install SELinux Troubleshooting Utilities

dnf install policycoreutils-python-utils setroubleshoot-server -y

SELinux-related denials can be inspected using:

ausearch -m AVC -ts recent

or by checking:

/var/log/audit/audit.log

15. Install and Configure Fail2Ban

Fail2Ban can automatically block IP addresses that repeatedly fail authentication.

After enabling EPEL:

dnf install fail2ban -y

Create a local SSH jail configuration:

nano /etc/fail2ban/jail.local

Example:

[sshd]
enabled = true
maxretry = 5
findtime = 600
bantime = 3600

Enable Fail2Ban:

systemctl enable --now fail2ban

Check its status:

fail2ban-client status
fail2ban-client status sshd

16. Check Existing Swap Space

Check whether your VPS already has swap configured:

swapon --show
free -h

If swap is already configured, you normally do not need to create another swap file.

17. Create a Swap File if Required

The following example creates a 2 GB swap file.

fallocate -l 2G /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile

Make it persistent across reboots:

echo '/swapfile none swap sw 0 0' >> /etc/fstab

Verify:

swapon --show
free -h

Note: Some VPS virtualization platforms or container-based systems may restrict swap configuration.

18. Configure Automatic Security Updates

AlmaLinux and Rocky Linux support dnf-automatic for unattended updates.

Install it:

dnf install dnf-automatic -y

Edit:

/etc/dnf/automatic.conf

For security-only updates, make sure the [commands] section contains:

[commands]
upgrade_type = security

Enable the automatic installation timer:

systemctl enable --now dnf-automatic-install.timer

Verify it:

systemctl status dnf-automatic-install.timer
systemctl list-timers --all

Administrators of mission-critical servers may prefer controlled maintenance windows instead of automatically installing every update.

19. Verify DNS Resolution

Confirm that the server can resolve external hostnames correctly:

getent hosts example.com
dig example.com

Check the currently configured DNS resolver:

cat /etc/resolv.conf

For an external confirmation, especially after changing nameservers or DNS records, use the Systron DNS, WHOIS and propagation tools to compare what public resolvers are seeing with the configuration on your server.

20. Check Server IP Addresses and Routing

ip address
ip route

To check the public IPv4 address:

curl -4 ifconfig.me

For IPv6:

curl -6 ifconfig.me

When troubleshooting latency, packet loss or routing from outside the server, the Systron network diagnostic tools provide browser-based Ping, Traceroute and related checks that complement the command-line tests performed on the server.

21. Check Listening Network Ports

Review services currently listening for incoming connections:

ss -tulpn

This is useful for identifying unnecessary services and confirming that applications are listening on the expected ports. You can also use the Systron network and port diagnostic tools to verify externally reachable services from outside your server network.

22. Review Running Services

systemctl --type=service --state=running

To see failed services:

systemctl --failed

Investigate any unexpected failed service before placing the server into production.

23. Check Disk Space

df -hT

Check block devices:

lsblk

Check inode usage:

df -i

24. Check RAM and CPU Resources

free -h
lscpu
uptime

For an interactive process view:

top

If htop is installed:

htop

25. Review System Logs

Systemd logs can be inspected through journalctl.

Show recent critical errors:

journalctl -p err -b

Show logs from the current boot:

journalctl -b

Check SSH service logs:

journalctl -u sshd

26. Verify Reverse DNS

For servers that will send email, correct reverse DNS or PTR configuration is particularly important.

You can check the reverse DNS record of your server IP with:

dig -x YOUR_SERVER_IP +short

Ideally, the PTR hostname should resolve back to the same server IP.

Reverse DNS is normally configured through your VPS or dedicated-server provider rather than inside AlmaLinux or Rocky Linux itself. Once the PTR record has been configured, the Systron DNS and WHOIS tools can be used as an additional external verification step.

27. Optional: Configure a Basic Web Server Firewall

If this server will host websites, the minimum common inbound services are SSH, HTTP and HTTPS.

firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=http
firewall-cmd --permanent --add-service=https
firewall-cmd --reload
firewall-cmd --list-all

Do not expose MariaDB/MySQL port 3306 publicly unless remote database access is specifically required and appropriately restricted.

28. Optional: Install Nginx

dnf install nginx -y
systemctl enable --now nginx

Verify:

systemctl status nginx

If you are migrating an existing Apache website to Nginx, the Systron webmaster tools include utilities that can help with common Apache, .htaccess and Nginx configuration tasks.

29. Optional: Install Apache

On RHEL-family distributions the Apache service is provided by the httpd package.

dnf install httpd -y
systemctl enable --now httpd

Verify:

systemctl status httpd

30. Optional: Install MariaDB

The exact MariaDB version available depends on the operating-system release and enabled module streams.

dnf install mariadb-server -y
systemctl enable --now mariadb

Run the database security wizard:

mariadb-secure-installation

On some older installations the command may be:

mysql_secure_installation

31. Optional: Allow Web Applications to Make Network Connections Through SELinux

If a web application must access external APIs or remote services:

setsebool -P httpd_can_network_connect 1

If the web application must connect to a database over the network:

setsebool -P httpd_can_network_connect_db 1

Only enable SELinux booleans required by the applications running on your server.

32. Check Whether a Reboot Is Required

After significant updates, particularly kernel or core-library updates, rebooting may be appropriate.

If the needs-restarting utility is available:

dnf needs-restarting -r

If a reboot is recommended:

reboot

33. Final Server Health Check

After completing the initial configuration, run the following checks:

cat /etc/os-release
hostnamectl
timedatectl
uptime
free -h
df -hT
ip address
ip route
ss -tulpn
firewall-cmd --list-all
sestatus
systemctl --failed

You should confirm that:

• The operating system is fully updated.
• The correct hostname is configured.
• The timezone and NTP synchronization are correct.
• A non-root sudo administrator account exists.
• SSH key authentication works.
• Root SSH login is restricted when appropriate.
• Only required firewall ports are open.
• SELinux remains enabled and enforcing.
• Automatic or scheduled security updates are configured.
• There are no unexpected failed services.
• Disk, RAM and swap resources are sufficient.
• Backups and external monitoring are configured before production use.

AlmaLinux and Rocky Linux Major-Version Notes

AlmaLinux / Rocky Linux 8

Version 8 remains suitable for existing production workloads receiving supported security maintenance. New deployments should normally evaluate newer major releases unless application compatibility requires version 8.

Do not assume that a major-version upgrade from version 8 to 9 or 10 can be performed simply with dnf upgrade. Plan major migrations separately and maintain verified backups.

AlmaLinux / Rocky Linux 9

Version 9 remains a widely deployed enterprise-server platform and is suitable for most hosting, web, database and application workloads.

AlmaLinux / Rocky Linux 10

Version 10 is the newest major-generation platform. Before migrating an existing production application, verify compatibility with third-party repositories, hosting control panels, database software, backup agents, security software and proprietary applications.

For Rocky Linux, major-version in-place upgrades are not officially supported; moving from Rocky Linux 8 or 9 to Rocky Linux 10 should be treated as a fresh operating-system installation and migration.

Recommended Security Practices

• Keep the operating system and applications regularly patched.
• Use SSH keys rather than passwords wherever possible.
• Disable direct root SSH login after verifying sudo access.
• Do not expose unnecessary ports to the Internet.
• Keep SELinux enabled.
• Use firewalld or another properly configured host firewall.
• Use unique, strong credentials for every service.
• Do not expose database ports publicly unless required.
• Maintain off-server backups.
• Test restoration procedures periodically.
• Configure monitoring for disk usage, memory, load, services and network availability.
• Review authentication and system logs regularly.

Important Warning Before Disconnecting

Never close your original root SSH session immediately after changing SSH, firewall or user-access settings.

Open a second SSH session first and verify that:

• Your new administrator account can log in.
• SSH key authentication works.
• The user can execute commands with sudo.
• The firewall permits your SSH connection.

This simple precaution can prevent accidental lockout from a remote VPS or dedicated server.

Conclusion

A fresh AlmaLinux or Rocky Linux server should not normally be placed directly into production immediately after deployment. Updating the operating system, configuring time synchronization, creating a non-root administrator, hardening SSH, enabling the firewall, keeping SELinux enforcing and establishing an update and backup strategy provide a much safer starting point.

Administrators who want full root access and prefer to perform these steps themselves can deploy an Unmanaged SSD VPS. For workloads where server setup, security hardening, software updates and ongoing administration should be handled by an experienced technical team, a Fully Managed NVMe VPS may be more appropriate. Larger or resource-intensive production workloads can also be deployed on Systron Dedicated Servers.

The same general procedure applies across AlmaLinux 8, 9 and 10 and Rocky Linux 8, 9 and 10, although individual package versions and application streams may differ between major releases.