Rocky Linux is a community enterprise distribution, binary-compatible with Red Hat Enterprise Linux. It was founded by one of CentOS’s original creators after CentOS Linux was discontinued. It’s a natural home for anyone coming from CentOS. Here’s how to turn a fresh Rocky 9 or 10 server into a secure base for your applications.

1. Update the system

ssh [email protected]
cat /etc/rocky-release
dnf -y upgrade --refresh
dnf needs-restarting -r || reboot

2. Basics: hostname, time zone, essentials

hostnamectl set-hostname app1.example.com
timedatectl set-timezone UTC
dnf -y install epel-release
dnf config-manager --set-enabled crb
dnf -y install vim tmux htop wget curl git tar bash-completion policycoreutils-python-utils

policycoreutils-python-utils provides semanage for SELinux changes. See timezone.

3. Admin user with sudo

useradd -m -G wheel admin
passwd admin

From your own computer:

ssh-copy-id [email protected]
ssh [email protected] 'sudo whoami'     # → root

Members of wheel can use sudo. See sudo and sudoers.

4. Key-only SSH, no root login

sudo tee /etc/ssh/sshd_config.d/50-hardening.conf > /dev/null <<'EOF'
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
MaxAuthTries 3
EOF
sudo sshd -t && sudo systemctl reload sshd

Test a new login in a second terminal before closing the first. See disable root SSH login.

5. firewalld

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service={http,https}
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

Allow a service only from one IP (for example, a database port for an app server):

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.21" port port="5432" protocol="tcp" accept'
sudo firewall-cmd --reload

See firewalld guide.

6. SELinux: keep it enforcing

getenforce

Typical adjustments you’ll need, instead of disabling it:

sudo setsebool -P httpd_can_network_connect on            # Nginx reverse proxy to an app
sudo semanage port -a -t http_port_t -p tcp 8081          # web server on a custom port
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/www(/.*)?" && sudo restorecon -Rv /srv/www

See SELinux basics.

7. Automatic security updates

sudo dnf -y install dnf-automatic
sudo sed -i 's/^upgrade_type.*/upgrade_type = security/; s/^apply_updates.*/apply_updates = yes/' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer

8. Fail2Ban

sudo dnf -y install fail2ban
printf '[sshd]\nenabled = true\nbackend = systemd\n' | sudo tee /etc/fail2ban/jail.local
sudo systemctl enable --now fail2ban

See Fail2Ban.

9. Application streams (modules)

On Rocky 9, some software is available in several versions through AppStream modules:

dnf module list nodejs
sudo dnf module enable nodejs:20 -y
sudo dnf install nodejs

Rocky 10 relies less on modules and ships newer default versions. For the newest runtimes, vendor repositories (NodeSource, PGDG, Remi for PHP) are common choices.

Rocky Linux vs AlmaLinux

Both are free RHEL rebuilds with long support (10 years per major version), and behave practically identically for server use:

Rocky Linux AlmaLinux
Governance Rocky Enterprise Software Foundation AlmaLinux OS Foundation
Compatibility goal Bug-for-bug with RHEL ABI-compatible with RHEL
Extras — Builds for some extra architectures and variants
Migration tool migrate2rocky almalinux-deploy, ELevate

Pick either. Your software’s support list (control panels, vendor software) is usually the deciding factor. See AlmaLinux initial setup and choosing a Linux distro for a server.

Quick reference

Task Command
Update dnf upgrade --refresh
Sudo user useradd -m -G wheel admin
Open HTTPS firewall-cmd --permanent --add-service=https
SELinux boolean setsebool -P name on
EPEL + CRB dnf install epel-release; dnf config-manager --set-enabled crb
Auto updates dnf-automatic.timer

Related: dnf commands and CentOS 7 migration.

  • Rocky Linux
  • Linux
  • Security