AlmaLinux Initial Server Setup: First Steps After Install

AlmaLinux is a free, community-owned, binary-compatible rebuild of Red Hat Enterprise Linux, a popular choice for cPanel servers, enterprise apps and anyone who wants RHEL behaviour without a subscription. This checklist takes a fresh AlmaLinux 9 or 10 server to a secure, ready-to-use state. The same steps apply to Rocky Linux and RHEL. See Rocky Linux initial setup.

1. Log in and update

ssh [email protected]
cat /etc/almalinux-release
dnf -y upgrade --refresh
reboot          # if a new kernel was installed

2. Set the hostname and time zone

hostnamectl set-hostname web1.example.com
timedatectl set-timezone UTC          # or your region, e.g. Europe/Berlin
timedatectl                           # check NTP is active (chronyd)

chrony is installed and enabled by default. See hostname and chrony.

3. Create an admin user

adduser admin
passwd admin
usermod -aG wheel admin          # 'wheel' = sudo on RHEL-family systems

Copy your SSH key to the new user. From your computer:

ssh-copy-id [email protected]

Test in a new terminal: ssh [email protected], then sudo whoami should print root. See SSH keys.

4. Harden SSH

Create a drop-in, which keeps the main file untouched:

sudo tee /etc/ssh/sshd_config.d/50-hardening.conf > /dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
EOF
sudo sshd -t && sudo systemctl reload sshd

Keep your current session open, and test a new login before logging out.

Changing the SSH port? On AlmaLinux, SELinux must allow it, and so must firewalld:

sudo semanage port -a -t ssh_port_t -p tcp 2222
sudo firewall-cmd --permanent --add-port=2222/tcp

See change SSH port.

5. Firewall: firewalld

firewalld is installed and usually active:

sudo systemctl enable --now firewalld
sudo firewall-cmd --state
sudo firewall-cmd --list-all
sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --reload

ssh is allowed in the default zone. Only open what you need. See firewalld.

6. Keep SELinux enforcing

getenforce        # should print Enforcing

Don’t disable it. When an app hits “Permission denied”, fix the label, boolean or port instead. See SELinux basics.

7. Enable EPEL and CRB

Many useful packages (htop, fail2ban, certbot, ncdu) come from EPEL:

sudo dnf install -y epel-release
sudo dnf config-manager --set-enabled crb      # CodeReady Builder, needed by some EPEL packages
sudo dnf install -y htop ncdu fail2ban tmux vim

8. Automatic security updates

sudo dnf install -y dnf-automatic
sudo sed -i 's/^upgrade_type.*/upgrade_type = security/; s/^apply_updates.*/apply_updates = yes/' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer
systemctl list-timers dnf-automatic.timer

This installs security updates automatically. Kernel updates still need a reboot. Check with sudo dnf needs-restarting -r. See dnf commands.

9. Fail2Ban for SSH

sudo tee /etc/fail2ban/jail.local > /dev/null <<'EOF'
[sshd]
enabled = true
backend = systemd
maxretry = 5
bantime = 1h
EOF
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

See Fail2Ban.

10. Swap (small servers)

sudo fallocate -l 2G /swapfile && sudo chmod 600 /swapfile
sudo mkswap /swapfile && sudo swapon /swapfile
echo '/swapfile none swap sw 0 0' | sudo tee -a /etc/fstab

See swap.

What’s next?

Goal	Guide
Web server	Nginx server blocks
Containers	Podman is built in. See Podman vs Docker
Database	MySQL, PostgreSQL via `dnf module` or PGDG repos
Control panel	cPanel and others support AlmaLinux
Monitoring	Netdata

AlmaLinux on VPS.DO

On VPS.DO, AlmaLinux 8 and 9 can be selected on USA VPS plans (KVM, full root). Other locations offer CentOS Stream as the RHEL-family option. See CentOS VPS for the full list.

Quick reference

Task	Command
Update	`dnf upgrade --refresh`
Admin user	`adduser admin; usermod -aG wheel admin`
Firewall	`firewall-cmd --permanent --add-service=https; firewall-cmd --reload`
SELinux	`getenforce` (keep Enforcing)
EPEL	`dnf install epel-release`
Auto updates	`dnf install dnf-automatic` + timer
Reboot needed?	`dnf needs-restarting -r`

AlmaLinux
Linux
Security