Setting up an AlmaLinux server: dnf, EPEL, firewalld and SELinux

AlmaLinux is a free rebuild of Red Hat Enterprise Linux, maintained until 2035. This guide applies to AlmaLinux 10 on an AlmaLinux server, the commands also fit AlmaLinux 9.

What is installed

• dnf with the package sources BaseOS, AppStream, CRB and Extras.
• NetworkManager for the network. The address is set during setup.
• cronie and rsyslog, both run from boot.
• sudo. OpenSSH for logging in is added when the server is set up.

firewalld, dnf-automatic and EPEL are not installed. These details apply to the container. A vServer with KVM starts from the official cloud image of AlmaLinux and is set up with cloud-init at first boot. The package selection there can be slightly larger.

1. Updating

dnf upgrade

2. Automatic security updates

dnf-automatic installs updates on a schedule. Set apply_updates = yes in /etc/dnf/automatic.conf, then enable the timer:

dnf install dnf-automatic
systemctl enable --now dnf-automatic.timer

3. Setting up a firewall

dnf install firewalld
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Allow the SSH port first, then switch the firewall on. If SSH runs on a port other than 22, enter that port. If you still lock yourself out, the console in the customer portal helps.

4. Services, logs and cron

systemctl status nginx
systemctl enable --now nginx
journalctl -u nginx -e

crond is already running, crontab -e adds your own jobs. Logs are in journalctl and under /var/log, for example in /var/log/messages.

Additional packages from EPEL

EPEL adds many programs that are not in the base sources, for example htop or fail2ban. EPEL needs CRB. In the container CRB is already enabled, on a KVM server the second command enables it:

dnf install epel-release
dnf install dnf-plugins-core && dnf config-manager --set-enabled crb
dnf install htop

SELinux

On a vServer with KVM, SELinux is enabled, getenforce shows Enforcing. If web files are in an unusual location, restorecon -Rv /path sets the matching labels. In the container the host provides the isolation, SELinux is not active there.

Releases and upgrades

AlmaLinux 10 is maintained until 2035, AlmaLinux 9 until 2032. A change of the major version is done by reinstalling in the customer portal. Data can be saved beforehand with the Rettungsverzeichnis, see Reinstalling a server without losing data.

Frequently asked questions

AlmaLinux or Rocky Linux?

Both are rebuilds of Red Hat Enterprise Linux with the same commands. AlmaLinux also fixes bugs ahead of time, Rocky Linux sticks strictly to the original. In everyday use the difference is rarely noticeable.

See also: First steps on your vServer Setting up a Rocky Linux server Setting up a Fedora server

View AlmaLinux servers