Initial server setup checklist on AlmaLinux

A freshly provisioned AlmaLinux VPS is usable out of the box, but it isn’t finished. Before you deploy anything to it, there are a handful of basic steps worth doing every time – they take about ten minutes and they close off the most common ways a new server gets compromised in its first few days online.

1. Update the system

Start by pulling down the latest packages, since the image your VPS was built from may already be a few weeks or months old.

sudo dnf update -y

If you want a deeper look at how AlmaLinux’s package manager works, see our post on managing packages with dnf.

2. Create a non-root sudo user

You should never do day-to-day work as root. Create a separate account with sudo privileges and use that instead – it gives you an audit trail, and it means a single mistyped command can’t wipe out the whole system without at least asking first.

Full steps are in creating a new sudo user on AlmaLinux. In short:

sudo useradd yourusername
sudo passwd yourusername
sudo usermod -aG wheel yourusername

3. Secure SSH

SSH is the door into your server, and it’s the service that gets hammered by automated scanning bots the moment your VPS gets an IP address. Three changes matter most:

• Switch to key-based authentication. Generate an SSH key pair on your own machine and copy the public key to the server with ssh-copy-id yourusername@your-server-ip, or paste it manually into ~/.ssh/authorized_keys for your new user.
• Disable root login over SSH. In /etc/ssh/sshd_config, set PermitRootLogin no.
• Disable password authentication. Once your key logs you in successfully, set PasswordAuthentication no in the same file.

Test your key-based login in a second terminal window before you close your current session – if something’s wrong with the key setup, you want to still be logged in to fix it. Once you’re confident it works, restart SSH to apply the changes:

sudo systemctl restart sshd

Our post on managing services with systemd covers how systemctl works if you’re not familiar with it.

4. Set the hostname and timezone

A correct hostname and timezone make log files, cron jobs, and monitoring output far easier to work with later.

sudo hostnamectl set-hostname your-server-name
sudo timedatectl set-timezone Europe/London

Use timedatectl list-timezones to find the exact timezone name you need if it isn’t London.

5. Set up firewalld

AlmaLinux ships with firewalld enabled by default, but you still need to open the ports your applications actually use and make sure nothing unnecessary is exposed. See firewalld basics on RHEL-family Linux for how zones and services work and how to allow traffic through.

6. Enable automatic security updates

You won’t be logging in every day to run dnf update, so it’s worth letting the system apply security patches on its own. Install and enable dnf-automatic:

sudo dnf install -y dnf-automatic

Edit /etc/dnf/automatic.conf and set upgrade_type = security under the [commands] section so it only applies security fixes automatically, rather than every package upgrade. Then enable the timer:

sudo systemctl enable --now dnf-automatic.timer

That’s the baseline

None of this is exotic – it’s the same handful of steps most sysadmins run through on any new RHEL-family server before putting anything on it. Once these are done, you’ve got a server that’s reasonably resistant to the automated scanning and credential-stuffing attempts that hit every public IP address within minutes of it going live.