After provisioning a new CentOS or AlmaLinux server on Data Mammoth, a few essential configuration steps ensure your server is secure, up to date, and ready for production workloads. This guide covers user creation, SSH hardening, firewall setup, and system updates for CentOS Stream 9 and AlmaLinux 9.

Prerequisites

• A newly provisioned Data Mammoth CentOS or AlmaLinux server.
• Root credentials (from the provisioning email or dashboard) or an SSH key configured during setup.
• An SSH client on your local machine.

Step 1 — Connect to Your Server

ssh [email protected]

Accept the host key fingerprint by typing yes when prompted. Enter your root password or use your SSH key.

Step 2 — Update the System

Update all packages to the latest versions:

dnf update -y

This installs the latest security patches and package updates. A reboot may be required if the kernel was updated — you can do that at the end of the setup.

Step 3 — Create a Non-Root User

Create a regular user with sudo access:

adduser deploy
passwd deploy

Enter and confirm a strong password. Then add the user to the wheel group (which grants sudo privileges):

usermod -aG wheel deploy

Verify sudo access:

su - deploy
sudo whoami

The output should be root. Type exit to return to the root session.

Step 4 — Set Up SSH Key Authentication

Set up SSH key authentication for the new user:

# From your local machine
ssh-copy-id [email protected]

Or manually configure it on the server:

su - deploy
mkdir -p ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste your public key content, save, and set permissions:

chmod 600 ~/.ssh/authorized_keys
exit

Test the key-based login from your local machine:

ssh [email protected]

For more on SSH keys, see Managing SSH Keys.

Step 5 — Harden SSH

Edit the SSH configuration:

sudo nano /etc/ssh/sshd_config

Apply these security settings:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
MaxAuthTries 5
LoginGraceTime 60

Restart the SSH service:

sudo systemctl restart sshd

Critical: Keep your current session open and test the new user login in a separate terminal before closing it. If something goes wrong, use the web console to recover.

Step 6 — Configure the Firewall (firewalld)

CentOS and AlmaLinux use firewalld by default. Ensure it is running and configured:

# Start and enable firewalld
sudo systemctl start firewalld
sudo systemctl enable firewalld
Allow SSH
sudo firewall-cmd --permanent --add-service=ssh
Reload to apply changes
sudo firewall-cmd --reload
Verify active rules
sudo firewall-cmd --list-all

To allow web traffic later:

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

For advanced firewall configuration, see Server Firewall Hardening Guide.

Step 7 — Set the Hostname

sudo hostnamectl set-hostname web01.example.com

Update /etc/hosts:

sudo nano /etc/hosts

Add:

127.0.0.1   localhost
203.0.113.10 web01.example.com web01

Verify with hostnamectl. See Changing Your Server Hostname for more details.

Step 8 — Configure the Timezone

# List available timezones
timedatectl list-timezones
Set your timezone
sudo timedatectl set-timezone America/New_York
Verify
timedatectl

Step 9 — Enable SELinux

SELinux (Security-Enhanced Linux) provides mandatory access control and is enabled by default on CentOS and AlmaLinux. Verify it is in enforcing mode:

sestatus

If SELinux is disabled or in permissive mode, enable it:

sudo nano /etc/selinux/config

Set:

SELINUX=enforcing

A reboot is required for SELinux changes to take effect.

Note: SELinux can cause issues with some applications. If you encounter permission errors, check SELinux logs before disabling it:

sudo ausearch -m avc -ts recent

Step 10 — Install Essential Tools

sudo dnf install -y \
  curl \
  wget \
  git \
  htop \
  net-tools \
  vim \
  epel-release \
  fail2ban

Configure Fail2ban

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Create a local configuration:

sudo nano /etc/fail2ban/jail.local

Add:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/secure
maxretry = 5
bantime = 3600

Restart:

sudo systemctl restart fail2ban

Step 11 — Enable Automatic Updates

Install and configure automatic updates with dnf-automatic:

sudo dnf install -y dnf-automatic

Edit the configuration:

sudo nano /etc/dnf/automatic.conf

Set the following:

[commands]
upgrade_type = security
apply_updates = yes

Enable the timer:

sudo systemctl enable --now dnf-automatic.timer

Step 12 — Reboot

If kernel updates were installed or SELinux was changed:

sudo reboot

Reconnect as your non-root user:

ssh [email protected]

Post-Setup Verification

• [ ] System is up to date: sudo dnf check-update
• [ ] Non-root user works: ssh [email protected]
• [ ] Root login is disabled via SSH
• [ ] Firewall is active: sudo firewall-cmd --state
• [ ] SELinux is enforcing: sestatus
• [ ] Fail2ban is running: sudo systemctl status fail2ban
• [ ] Hostname is set: hostnamectl
• [ ] Timezone is correct: timedatectl

What to Do Next

• Installing LAMP Stack on Your VPS — Set up Apache, MySQL, and PHP.
• Installing Docker & Docker Compose — Containerize your applications.
• Server Firewall Hardening Guide — Advanced firewall rules.
• Complete Server Security Checklist — Full security review.