Securing Rocky Linux Servers: A Practical Checklist

Introduction to Rocky Linux Server Security

Securing a Rocky Linux server involves applying a series of configurations and hardening techniques to protect the system from unauthorized access, vulnerabilities, and malicious attacks. Rocky Linux is an enterprise-grade Linux distribution designed to be 100% bug-for-bug compatible with Red Hat Enterprise Linux (RHEL). Because it is built for enterprise environments, it comes with powerful built-in security tools like SELinux and firewalld.

Why does this matter? When you deploy a new server, it is exposed to the internet by default. Without proper hardening, automated bots and threat actors can quickly exploit weak passwords, outdated software, or misconfigured services. Following a practical security checklist ensures you minimize your attack surface, protect sensitive data, and maintain system availability.

Initial Server Setup and Access Control

The first step in securing any Linux server is controlling who can access it and how. You should never run services or log in directly as the root user. Instead, create a standard user account with sudo privileges and enforce SSH key-based authentication.

Creating a Non-Root User

Log in to your server as root and create a new user. Add the user to the wheel group, which grants sudo privileges on Rocky Linux.

useradd -m -s /bin/bash newadmin
usermod -aG wheel newadmin
passwd newadmin

Switch to the new user to verify sudo access works correctly.

su - newadmin
sudo dnf update

Configuring SSH Key-Based Authentication

Passwords can be brute-forced. SSH keys use cryptographic pairs that are nearly impossible to crack. On your local machine, generate an SSH key pair.

ssh-keygen -t ed25519 -C "admin@rockyserver"

Copy the public key to your Rocky Linux server using the ssh-copy-id utility.

ssh-copy-id newadmin@your_server_ip

Securing the SSH Daemon

Once you have verified that you can log in with your SSH key, you must disable root login and password authentication. Open the SSH configuration file using a text editor.

sudo nano /etc/ssh/sshd_config

Find and modify the following lines to match these values:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes

Restart the SSH service to apply the changes.

sudo systemctl restart sshd

Firewall and Network Security

Rocky Linux uses firewalld as its default firewall management tool. It operates on the concept of zones, allowing you to define different trust levels for network connections. By default, the public zone is active, and only SSH is allowed.

Enabling firewalld

Ensure the firewall is running and enabled to start on boot.

sudo systemctl enable --now firewalld

Check the status and default zone.

sudo firewall-cmd --state
sudo firewall-cmd --get-default-zone

Managing Zones and Services

If you are running a web server, you need to allow HTTP and HTTPS traffic. Add these services to the firewall permanently and reload the configuration.

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

List all currently allowed services to verify your configuration.

sudo firewall-cmd --list-services

System Hardening with SELinux

Security-Enhanced Linux (SELinux) is a mandatory access control (MAC) system built into the Linux kernel. It enforces policies that dictate what processes can access, significantly limiting the damage caused by compromised services. On Rocky Linux, SELinux is enabled by default in enforcing mode.

Checking SELinux Status

Always verify that SELinux is running and enforcing policies.

sestatus

If SELinux is disabled or in permissive mode, you can enable enforcing mode temporarily.

sudo setenforce 1

To make it permanent, edit the configuration file.

sudo nano /etc/selinux/config

Ensure the file contains the following line:

SELINUX=enforcing

Managing SELinux Contexts

If you move files (like web content) to a different directory, SELinux might block the web server from reading them. You must restore the correct SELinux contexts.

sudo restorecon -Rv /var/www/html/

Never disable SELinux to fix a permission issue. Instead, use audit logs to understand the denial and adjust the context or booleans accordingly.

Automatic Updates and System Maintenance

Keeping your system updated is one of the most effective ways to prevent exploitation of known vulnerabilities. Rocky Linux uses the DNF package manager. You can configure automatic updates using the dnf-automatic package.

Using DNF Automatic

Install the dnf-automatic package.

sudo dnf install dnf-automatic

Edit the configuration file to specify what kind of updates you want to apply. For a production server, applying security updates automatically is highly recommended.

sudo nano /etc/dnf/automatic.conf

Modify the following settings:

upgrade_type = security
apply_updates = yes
emit_via = motd

Enable and start the timer to run the automatic updates periodically.

sudo systemctl enable --now dnf-automatic.timer

Intrusion Detection and Fail2Ban

Even with SSH keys, bots will continuously attempt to access your server, filling your logs with failed login attempts. Fail2Ban is an intrusion prevention software that monitors log files and temporarily bans IPs that show malicious signs.

Installing and Configuring Fail2Ban

Fail2Ban is available in the Extra Packages for Enterprise Linux (EPEL) repository. Enable EPEL and install Fail2Ban.

sudo dnf install epel-release
sudo dnf install fail2ban

Create a local configuration file to protect the SSH service. Do not edit the default jail.conf file directly.

sudo nano /etc/fail2ban/jail.local

Add the following configuration to protect SSH:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/secure
maxretry = 3
bantime = 3600
findtime = 600

Enable and start the Fail2Ban service.

sudo systemctl enable --now fail2ban

Check the status of the SSH jail to ensure it is running.

sudo fail2ban-client status sshd

Best Practices for Ongoing Security

Securing a server is not a one-time task but an ongoing process. To maintain a strong security posture, adhere to the following best practices:

• Principle of Least Privilege: Only install the software you absolutely need and grant permissions strictly on a need-to-know basis.
• Regular Audits: Periodically review user accounts, sudo logs, and firewall rules to ensure no unauthorized changes have occurred.
• Monitor Logs: Use tools like journalctl or set up a centralized logging server to monitor system events for suspicious activity.
• Implement Backups: Regularly back up your data and configurations. Ensure backups are stored securely and test your restoration process periodically.
• Disable Unused Services: Run sudo ss -tulpn to list listening ports and disable any services that are not required for your server's function.

Conclusion

Securing a Rocky Linux server requires a layered approach, combining access control, network filtering, kernel-level MAC systems, and proactive maintenance. By following this practical checklist—creating non-root users, enforcing SSH keys, configuring firewalld, maintaining SELinux, enabling automatic updates, and deploying Fail2Ban—you significantly reduce your server's vulnerability to common attacks. Security is an ongoing journey, and consistently applying these practices will ensure your Rocky Linux infrastructure remains robust, reliable, and safe in any production environment.