After installing AlmaLinux 10, there are a few basic settings to take care of before you start using the server. The first steps are creating a regular user with sudo access, setting a proper hostname, and configuring the firewall with the services you actually need. In this guide, we’ll go through these initial server setup steps and get your AlmaLinux 10 system ready for everyday use.
Table of Content
- Why You Need to Complete Initial Server Setup Before You Install Anything Else
- How to Perform Initial Server Setup After Installing AlmaLinux 10
- Step 1: Log In and Update the System
- Step 2: Set the Hostname
- Step 3: Set the System Timezone
- Step 4: Create a New Sudo User
- Step 5: Set Up SSH Key-Based Authentication
- Step 6: Harden the SSH Configuration
- Step 7: Configure Firewalld
- Step 8: Verify SELinux Is Enforcing
- Step 9: Enable Automatic Security Updates (Optional but Recommended)
- Step 10: Install Essential Tools
- Step 11: Set Up Basic Fail2ban Protection (Optional)
- Recommendation As An Expert
- Frequently Asked Questions
Why You Need to Complete Initial Server Setup Before You Install Anything Else
Skipping initial setup and jumping straight to installing your application stack is one of the most common mistakes on a fresh server. A server running as root with default settings and an unconfigured firewall is exposed the moment it has a public IP address; automated bots scan the internet constantly for exactly this kind of misconfiguration. Spending 15–20 minutes on proper initial setup now prevents a much longer incident response conversation later.
Prerequisites
- A fresh AlmaLinux 10 installation with root or initial sudo access
- Your server’s IP address (find it with ip addr show if you don’t already have it)
- SSH access, either through your provider’s console or a terminal
How to Perform Initial Server Setup After Installing AlmaLinux 10
To perform initial server setup on AlmaLinux 10, create a sudo user, configure firewalld to secure open ports, and update your system packages. Next, set a custom hostname using hostnamectl and strengthen SSH access by disabling root login and enforcing key authentication.
Step 1: Log In and Update the System
Connect to your server in AlmaLinux 10 for the first time, either via your hosting provider’s console or SSH:
ssh root@your-server-ip |
|---|
Before anything else, make sure you’re working with fully current packages and security patches:
sudo dnf update |
|---|
This can take a few minutes on a fresh install. Reboot afterward if a kernel update was included:
reboot |
|---|
Step 2: Set the Hostname
AlmaLinux 10 installs often ship with a generic or provider-assigned hostname (like localhost.localdomain). Setting a proper hostname matters for log clarity, cluster/inventory management, and any monitoring tooling you’ll add later.
sudo hostnamectl set-hostname your-server-name |
|---|
Verify it applied correctly:
hostnamectl |
|---|
If your server needs to resolve its own hostname locally (common for mail servers or certain application stacks), add an entry to /etc/hosts:
sudo tee -a /etc/hosts <<EOF 127.0.0.1 alma10 EOF |
|---|
Note: After setting the hostname, you can apply the changes through the “newgrp” command.
Step 3: Set the System Timezone
Accurate timestamps matter for logs, cron jobs, and SSL certificate validation. Check your current timezone:
timedatectl |
|---|
List available time zones and set the correct one:
timedatectl list-timezones | grep America sudo timedatectl set-timezone America/New_York |
|---|
Confirm time synchronization is active (AlmaLinux 10 uses chronyd by default):
sudo systemctl status chronyd |
|---|
Step 4: Create a New Sudo User
Working directly as root for daily administration is a bad habit that increases the blast radius of any mistake or compromised session. Create a new sudo user or dedicated administrative user instead:
sudo adduser adminuser sudo passwd adminuser |
|---|
Add the new user to the wheel group, which grants sudo privileges on AlmaLinux by default:
sudo usermod -aG wheel adminuser |
|---|
Verify the user has sudo access before logging out of your root session:
su – adminuser sudo whoami |
|---|
This should return root without error, confirming sudo is working correctly before you rely on it.
Step 5: Set Up SSH Key-Based Authentication
Password authentication over SSH is a common brute-force target. Set up key-based login for your new user before disabling passwords entirely.
On your local machine, generate a key pair if you don’t already have one:
ssh-keygen -t ed25519 -C “your_email@example.com” |
|---|
Copy the public key to your server:
ssh-copy-id adminuser@your-server-ip |
|---|
Test that key-based login works:
ssh adminuser@your-server-ip |
|---|
Let’s confirm from the web console.
Step 6: Harden the SSH Configuration
Once key-based login for your new user is confirmed working, tighten SSH access on the server:
sudo nano /etc/ssh/sshd_config |
|---|
Set the following:
PermitRootLogin no PasswordAuthentication no |
|---|
AlmaLinux 10 disables root SSH login by default, but it’s worth confirming explicitly rather than assuming a fresh image was configured the way you expect. Restart SSH to apply changes:
sudo systemctl restart sshd |
|---|
Important: Keep your current session open while testing in a new terminal window, so you’re not locked out if something’s misconfigured.
Step 7: Configure Firewalld
AlmaLinux 10 ships with firewalld active by default, but it needs to be configured for what your server will actually run; a firewall with no rules configured for your services isn’t protecting the things that matter.
Check current status and rules:
sudo systemctl status firewalld sudo firewall-cmd –list-all |
|---|
Allow SSH explicitly (if not already permitted):
sudo firewall-cmd –permanent –add-service=ssh |
|---|
Add rules for any other services your server will run, for example, a web server:
sudo firewall-cmd –permanent –add-service=http sudo firewall-cmd –permanent –add-service=https |
|---|
Apply the changes:
sudo firewall-cmd –reload |
|---|
Confirm the final rule set:
sudo firewall-cmd –list-all |
|---|
Review this list carefully; every open service here is a reachable entry point, so nothing should be present that you can’t account for.
Step 8: Verify SELinux Is Enforcing
SELinux is enabled and enforcing by default on AlmaLinux 10, adding a mandatory access control layer beyond standard file permissions. Confirm it’s active rather than assuming:
sestatus |
|---|
You want to see Current mode: enforcing. If it shows permissive or disabled, something was changed from the default, worth investigating rather than leaving as-is on a production server.
Step 9: Enable Automatic Security Updates (Optional but Recommended)
Manually remembering to patch a server doesn’t scale, and unpatched vulnerabilities get exploited quickly once disclosed. Automate at least security-only updates:
sudo dnf install dnf-automatic -y sudo sed -i ‘s/^apply_updates =.*/apply_updates = yes/’ /etc/dnf/automatic.conf sudo sed -i ‘s/^upgrade_type =.*/upgrade_type = security/’ /etc/dnf/automatic.conf sudo systemctl enable –now dnf-automatic.timer |
|---|
Step 10: Install Essential Tools
A minimal AlmaLinux 10 install lacks some basics most admins want available immediately:
sudo dnf install -y vim wget curl git tar unzip htop |
|---|
Step 11: Set Up Basic Fail2ban Protection (Optional)
For an extra layer of brute-force protection beyond disabled password auth, install fail2ban:
sudo dnf install epel-release -y sudo dnf install fail2ban -y sudo systemctl enable –now fail2ban |
|---|
Recommendation As An Expert
Initial server setup on AlmaLinux 10 comes down to a short, repeatable sequence: update the system, set a proper hostname and timezone, create a sudo user instead of relying on root, lock down SSH with key-based authentication, configure the firewall for exactly what you’re running, and confirm SELinux and automatic updates are active.
None of these steps take more than a couple of minutes individually, but skipping any of them is how servers end up compromised through avoidable misconfiguration rather than a sophisticated attack. Run through this checklist on every new AlmaLinux 10 server before deploying anything else; it’s the foundation everything you build afterward depends on.
Frequently Asked Questions
1. What should I do first after installing AlmaLinux 10?
Update the system with dnf update -y, then create a dedicated sudo user rather than continuing to work as root. These two steps form the foundation that everything else in the initial setup builds on, and skipping them is the most common early mistake on a fresh server.
2. How do I change the hostname permanently on AlmaLinux 10?
Use sudo hostnamectl set-hostname your-server-name, which updates the hostname immediately and persists it across reboots. On cloud servers, also check /etc/cloud/cloud.cfg for preserve_hostname: false, since cloud-init can silently reset a custom hostname on the next boot otherwise.
3. Is firewalld enabled by default on AlmaLinux 10?
Yes, firewalld runs by default with a basic ruleset, but it isn’t automatically configured for whatever services you plan to run. You still need to explicitly allow services like HTTP, HTTPS, or custom application ports with firewall-cmd –add-service before those services will be reachable.
4. How do I add a new user with sudo privileges on AlmaLinux 10?
Create the user with sudo adduser username, set a password with sudo passwd username, then add them to the wheel group using sudo usermod -aG wheel username; membership in wheel is what grants sudo access by default on AlmaLinux.
5. Should I disable SELinux during the initial server setup?
No. SELinux ships enabled and enforcing by default on AlmaLinux 10 for a reason, and disabling it removes a significant security layer rather than fixing whatever problem prompted the idea.
Leave feedback about this