← Back to DevBytes
Developer Tutorial August 14, 2026 8 min read

openSUSE Server Setup: From Installation to Production

openSUSE Server Setup: From Installation to Production

openSUSE is one of the most respected Linux distributions in the enterprise world, serving as the community upstream for SUSE Linux Enterprise Server (SLES). Known for its stability, the powerful YaST configuration tool, and the innovative openSUSE KIWI imaging system, it is an excellent choice for production servers. This tutorial walks you through the complete journey — from a bare-metal installation to a hardened, production-ready server.

What is openSUSE?

openSUSE is a free, open-source Linux distribution sponsored by SUSE. It comes in two main flavors: Leap, a stable release that shares its core with SLES, and Tumbleweed, a rolling release for those who want the latest packages. For server deployments, Leap is the recommended choice because of its long-term stability and binary compatibility with SLES, which means anything you build on Leap will run on SLES with minimal changes.

Why openSUSE Matters for Servers

Step 1: Preparing the Installation Media

Download the openSUSE Leap Network or DVD ISO from the official website. For servers, the Network ISO is preferred because it is small and pulls the latest packages during installation.

# Verify the downloaded ISO checksum
sha256sum openSUSE-Leap-15.5-NET-x86_64.iso

# Compare with the official checksum from the openSUSE site
# Then write the ISO to a USB drive (replace /dev/sdX with your device)
sudo dd if=openSUSE-Leap-15.5-NET-x86_64.iso of=/dev/sdX bs=4M status=progress
sync

Boot the target server from the USB drive. The openSUSE installer (also powered by YaST) will launch automatically.

Step 2: Guided Installation with YaST

The YaST installer is one of the most comprehensive in the Linux world. During installation, pay attention to the following key screens:

Partitioning

Choose the Guided Setup and enable Btrfs with snapshots. This enables Snapper, which is invaluable for production servers because you can roll back a broken update in seconds.

# Recommended partition layout for a 50GB disk:
# /boot/efi   - 500 MB  (FAT32)
# /           - 40 GB   (Btrfs with snapshots enabled)
# /home       - 5 GB    (XFS)
# swap        - 4 GB    (swap)

Software Selection

For a minimal production server, select the Server pattern. Avoid installing a desktop environment to reduce the attack surface.

Network and Hostname

Set a fully qualified domain name (FQDN) immediately. A correct hostname is essential for certificates, mail servers, and logging.

# Example: server01.example.com

User and Root

Disable direct root login over SSH later, but during installation, set a strong root password and create a standard user with sudo privileges.

Step 3: Post-Installation System Update

Once the system boots for the first time, update all packages to ensure you have the latest security patches.

# Refresh repository metadata
sudo zypper refresh

# Update all packages
sudo zypper update

# For a full distribution upgrade (when moving between minor releases)
sudo zypper dup

Step 4: Configuring the Network

While YaST can configure networking via a TUI, modern openSUSE uses wicked as the default network service. For a static IP, edit the configuration file directly.

# Identify your network interface
ip link show

# Edit the interface configuration (replace eth0 with your interface)
sudo nano /etc/sysconfig/network/ifcfg-eth0

Add the following content for a static IP configuration:

BOOTPROTO='static'
STARTMODE='auto'
IPADDR='192.168.1.100'
NETMASK='255.255.255.0'
GATEWAY='192.168.1.1'
DNS1='8.8.8.8'
DNS2='1.1.1.1'

Apply the changes:

sudo systemctl restart wicked
sudo systemctl status wicked

Step 5: Securing SSH Access

SSH is the primary entry point to your server. Harden it immediately after installation.

# Generate an SSH key pair on your local machine
ssh-keygen -t ed25519 -C "admin@example.com"

# Copy the public key to the server
ssh-copy-id -i ~/.ssh/id_ed25519.pub user@192.168.1.100

Once key-based login is verified, disable password authentication and root login:

sudo nano /etc/ssh/sshd_config

Modify the following directives:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222

Changing the default port is optional but reduces automated brute-force noise. Restart the SSH service:

sudo systemctl restart sshd

Step 6: Configuring the Firewall

openSUSE uses firewalld by default. Configure zones and allow only the services you need.

# Check the default zone
sudo firewall-cmd --get-default-zone

# Allow SSH (on custom port if changed)
sudo firewall-cmd --permanent --add-port=2222/tcp

# Allow HTTP and HTTPS for a web server
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Reload the firewall
sudo firewall-cmd --reload

# List all open ports and services
sudo firewall-cmd --list-all

Step 7: Setting Up Automatic Updates

For production servers, automatic security updates are essential. openSUSE provides a dedicated tool for this.

# Install the automatic update package
sudo zypper install yast2-online-update-configuration

# Enable and start the automatic update service
sudo systemctl enable --now chronyd

Alternatively, configure a cron job for controlled patching:

# Create a script for security-only updates
sudo nano /usr/local/bin/security-update.sh

#!/bin/bash
# Apply only security patches
zypper --non-interactive patch --category security --with-interactive
# Optional: reboot if required
if [ -f /var/run/reboot-required ]; then
    systemctl reboot
fi

# Make it executable and schedule it
sudo chmod +x /usr/local/bin/security-update.sh
sudo crontab -e
# Add: 0 3 * * 0 /usr/local/bin/security-update.sh

Step 8: Installing and Configuring a Web Server

As a practical example, let us install Nginx and deploy a basic site.

# Install Nginx
sudo zypper install nginx

# Enable and start the service
sudo systemctl enable --now nginx

# Verify it is running
sudo systemctl status nginx

Create a server block configuration:

sudo nano /etc/nginx/vhosts.d/example.com.conf

server {
    listen 80;
    server_name example.com www.example.com;

    root /srv/www/example.com/public;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    error_page 404 /404.html;
    error_page 500 502 503 504 /50x.html;
}

# Create the document root and a test page
sudo mkdir -p /srv/www/example.com/public
echo "<h1>Hello from openSUSE</h1>" | sudo tee /srv/www/example.com/public/index.html

# Test the configuration and reload
sudo nginx -t
sudo systemctl reload nginx

Step 9: Enabling Btrfs Snapshots with Snapper

One of the standout features of openSUSE is the integration of Snapper with Btrfs. This allows you to take snapshots before system changes and roll back if something breaks.

# Install Snapper if not already present
sudo zypper install snapper

# Create a Snapper configuration for the root filesystem
sudo snapper -c root create-config /

# List existing configurations
sudo snapper list-configs

# Take a manual snapshot before making changes
sudo snapper -c root create -d "Before Nginx update"

# List all snapshots
sudo snapper -c root list

To roll back to a previous snapshot:

# Find the snapshot number from the list, then roll back
sudo snapper -c root undochange 1..2

# For a full system rollback, reboot into the snapshot from the GRUB menu

Step 10: Monitoring and Logging

Install tools for system monitoring and centralized logging.

# Install htop for process monitoring
sudo zypper install htop

# Install and configure rsyslog for centralized logging
sudo zypper install rsyslog
sudo systemctl enable --now rsyslog

# View system logs
journalctl -xe
journalctl -u nginx --since "1 hour ago"

For long-term log retention, consider setting up log rotation:

sudo nano /etc/logrotate.d/nginx

/var/log/nginx/*.log {
    daily
    missingok
    rotate 14
    compress
    delaycompress
    notifempty
    create 640 nginx nginx
    postrotate
        if [ -f /var/run/nginx.pid ]; then
            kill -USR1 `cat /var/run/nginx.pid`
        fi
    endscript
}

Best Practices for Production openSUSE Servers

Managing Repositories

openSUSE uses a powerful repository system. Understanding how to manage repositories is crucial for production systems.

# List all configured repositories
sudo zypper repos

# Add the Packman repository for multimedia codecs (if needed)
sudo zypper ar -f -n "Packman" https://ftp.gwdg.de/pub/linux/misc/packman/suse/openSUSE_Leap_15.5/ packman

# Refresh all repositories
sudo zypper refresh

# Remove a repository
sudo zypper rr packman

# Set repository priority (lower number = higher priority)
sudo zypper mr -p 90 packman

Service Management with systemd

openSUSE uses systemd as its init system. Mastering service management is essential.

# Enable a service to start on boot
sudo systemctl enable nginx

# Start, stop, restart, and reload a service
sudo systemctl start nginx
sudo systemctl stop nginx
sudo systemctl restart nginx
sudo systemctl reload nginx

# Check service status and recent logs
sudo systemctl status nginx
sudo journalctl -u nginx -n 50 --no-pager

# List all enabled services
sudo systemctl list-unit-files --type=service --state=enabled

Conclusion

Setting up an openSUSE server for production is a straightforward process thanks to YaST, Zypper, and the distribution's enterprise-grade design. By following this tutorial, you have installed the base system, configured networking, hardened SSH, set up a firewall, deployed a web server, enabled Btrfs snapshots with Snapper, and established monitoring and logging practices. The combination of stability, snapshot-based rollback, and SLES compatibility makes openSUSE Leap an outstanding choice for production workloads. Remember that security is an ongoing process — keep your system updated, regularly audit your configurations, and leverage Snapper snapshots before any major change. With these foundations in place, your openSUSE server is ready to serve real-world traffic reliably and securely.

— Ad —

Google AdSense will appear here after approval

← Back to all articles