Setting up a Rocky Linux server: dnf, EPEL, firewalld and SELinux

Rocky Linux rebuilds Red Hat Enterprise Linux as closely as possible and is maintained until 2035. This guide applies to Rocky Linux 10 on a Rocky Linux server, the commands also fit Rocky Linux 9.

What is installed

• dnf with the package sources BaseOS, AppStream and Extras. CRB is disabled.
• NetworkManager for the network. The address is set during setup.
• cronie and rsyslog, both run from boot.
• sudo. OpenSSH for logging in is added when the server is set up.

firewalld, dnf-automatic, EPEL and the dnf tool config-manager are not installed. These details apply to the container. A vServer with KVM starts from the official cloud image of Rocky Linux and is set up with cloud-init at first boot. The package selection there can be slightly larger.

1. Updating

dnf upgrade

2. Automatic security updates

dnf-automatic installs updates on a schedule. Set apply_updates = yes in /etc/dnf/automatic.conf, then enable the timer:

dnf install dnf-automatic
systemctl enable --now dnf-automatic.timer

3. Setting up a firewall

dnf install firewalld
systemctl enable --now firewalld
firewall-cmd --permanent --add-service=ssh
firewall-cmd --permanent --add-service=https
firewall-cmd --reload

Allow the SSH port first, then switch the firewall on. If SSH runs on a port other than 22, enter that port. If you still lock yourself out, the console in the customer portal helps.

4. Services, logs and cron

systemctl status nginx
systemctl enable --now nginx
journalctl -u nginx -e

crond is already running, crontab -e adds your own jobs. Logs are in journalctl and under /var/log, for example in /var/log/messages.

Enabling CRB and EPEL

Many programs such as htop or fail2ban come from EPEL. EPEL needs the CRB package source, which is disabled on Rocky Linux. The tool for this comes with dnf-plugins-core:

dnf install dnf-plugins-core
dnf config-manager --set-enabled crb
dnf install epel-release
dnf install htop

SELinux

On a vServer with KVM, SELinux is enabled, getenforce shows Enforcing. If web files are in an unusual location, restorecon -Rv /path sets the matching labels. In the container the host provides the isolation, SELinux is not active there.

Releases and upgrades

Rocky Linux 10 is maintained until 2035, Rocky Linux 9 until 2032. A change of the major version is done by reinstalling in the customer portal. Data can be saved beforehand with the Rettungsverzeichnis, see Reinstalling a server without losing data.

Frequently asked questions

Do programs for Red Hat Enterprise Linux run on Rocky Linux?

As a rule, yes. Rocky Linux follows Red Hat Enterprise Linux as closely as possible, packages and paths are the same.

See also: First steps on your vServer Setting up an AlmaLinux server Setting up a Fedora server

View Rocky Linux servers