AlmaLinux Post-Install Configuration: EPEL, DNF, Static IP, Firewall, SELinux, Cockpit and SSH

A fresh AlmaLinux installation is only the starting point. Before hosting applications or infrastructure services, administrators should configure software repositories, understand DNF, assign the correct network settings, restrict inbound traffic, preserve SELinux enforcement, and choose a secure management method.

This guide is organized as a practical checklist. Commands are shown for common AlmaLinux 8/9/10 environments, but repository names and defaults can vary by major version. Check the release-specific official documentation before applying commands to a production server.

1. Identify your AlmaLinux release

Start by checking the operating-system version, kernel, network interfaces and active NetworkManager connections. This avoids using a repository or network command that does not match your system.

cat /etc/os-release
cat /etc/almalinux-release
uname -r
ip -br addr
nmcli connection show

Keep the major release in mind. For example, AlmaLinux 8 uses the repository name powertools for the builder repository, while AlmaLinux 9 uses crb. AlmaLinux 10 has release-specific defaults; check the current documentation rather than assuming older commands are necessary.

2. Enable EPEL and CRB on AlmaLinux

EPEL (Extra Packages for Enterprise Linux) provides additional packages maintained by the Fedora community for Enterprise Linux distributions. CRB (CodeReady Builder) provides development libraries and other packages that some EPEL packages require. EPEL is an additional repository, not a replacement for AlmaLinux BaseOS or AppStream.

Step 1 — Install the EPEL release package

sudo dnf install -y epel-release

Step 2 — Enable the builder repository for your major release

For AlmaLinux 9:

sudo dnf config-manager --set-enabled crb

For AlmaLinux 8:

sudo dnf config-manager --set-enabled powertools

For AlmaLinux 10, verify the release’s current repository status first. CRB is enabled by default in AlmaLinux 10.2 according to its release notes, so the enable command may be unnecessary or the repository may already be enabled on your system.

Step 3 — Refresh metadata and verify

sudo dnf makecache
dnf repolist --enabled

3. Essential DNF commands for AlmaLinux

DNF installs and updates RPM packages and manages dependencies. These commands cover common administration tasks.

Example: search for and install htop if it is available in your enabled repositories:

dnf search htop
sudo dnf install -y htop
htop

Review package changes before confirming them. Avoid using -y indiscriminately on production servers when you need to inspect the proposed transaction first. Schedule updates, review application compatibility and reboot when a kernel or core system update requires it.

4. Configure a static IPv4 address using nmcli

AlmaLinux commonly uses NetworkManager to manage network connections. The nmcli utility can configure persistent addresses from the terminal. The following is an example only—replace the interface, connection name, IP address, gateway and DNS servers with values assigned for your network.

Step 1 — Find the connection profile

nmcli connection show
nmcli device status
ip route

In the examples below, the connection profile is named System eth0. Use the exact profile name shown by your machine, not necessarily the interface device name.

Step 2 — Set IPv4 address, gateway and DNS

Example addressing: 192.168.1.50/24, gateway 192.168.1.1, DNS 1.1.1.1 and 8.8.8.8. Replace all of these values with your actual network details.

sudo nmcli connection modify "System eth0" \
  ipv4.method manual \
  ipv4.addresses 192.168.1.50/24 \
  ipv4.gateway 192.168.1.1 \
  ipv4.dns "1.1.1.1 8.8.8.8"

Step 3 — Apply the connection

sudo nmcli connection up "System eth0"

This can briefly disconnect your session if the address changes. If the connection profile has another name, substitute it exactly. On a server where remote connectivity is critical, arrange console access before applying changes.

Step 4 — Verify address, route and DNS

ip -br addr
ip route
nmcli device show
getent hosts almalinux.org

If DNS does not resolve, check the DNS values, routing, firewall and upstream resolver reachability. If the server should use DHCP instead, set ipv4.method auto on the correct connection profile.

5. Configure firewalld on AlmaLinux

firewalld provides host-based firewall management using zones, services and ports. Prefer predefined service names where possible, and apply rules to the correct zone for the interface or source network.

Check status and active zones

sudo systemctl status firewalld
sudo firewall-cmd --state
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --list-all

Enable and start firewalld

sudo systemctl enable --now firewalld

Allow common services

Example: allow SSH and Cockpit in the default zone. First check the active zone and ensure these services are intended to be reachable.

sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=cockpit
sudo firewall-cmd --reload
sudo firewall-cmd --list-services

Allow a custom TCP port

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --query-port=2222/tcp

Opening a firewall port alone does not make a service listen on it; the application must also be configured, and SELinux policy may need an appropriate port label. Use the same intended zone for both the rule and the interface/source. Do not disable the firewall as a troubleshooting shortcut.

6. Understand and manage SELinux

SELinux provides mandatory access control that complements Unix permissions and firewalld. On servers, keep SELinux enforcing unless a documented, temporary diagnostic requires another approach. Correct labels and policy are usually better fixes than disabling SELinux.

Check current mode and status

getenforce
sestatus

The main modes are Enforcing (policy is enforced), Permissive (denials are logged but not enforced) and Disabled (SELinux is not enforcing). Prefer Enforcing for production systems.

Restore expected file contexts

If files were copied into a service directory and have incorrect SELinux labels, restore the default labels for that path where appropriate:

sudo restorecon -Rv /var/www/html

Use the actual affected path; this example is for a typical web content directory. For a non-standard directory, review whether a persistent file-context rule is needed instead of changing labels ad hoc.

Inspect recent denials

sudo ausearch -m AVC,USER_AVC -ts recent

If ausearch is unavailable, check the audit service and installed audit tools. Investigate the denial, service context and relevant SELinux booleans before changing policy. Do not generate and apply broad policy modules without understanding what they permit.

7. Install and enable Cockpit

Cockpit is a browser-based administration interface for monitoring system resources, viewing logs, managing services, storage and networking, and performing other administrative tasks. It is commonly available from AlmaLinux’s standard repositories.

Install and start Cockpit

sudo dnf install -y cockpit
sudo systemctl enable --now cockpit.socket
systemctl status cockpit.socket

Allow access through firewalld

sudo firewall-cmd --permanent --add-service=cockpit
sudo firewall-cmd --reload
sudo firewall-cmd --list-services

Open https://SERVER-IP:9090 in a browser, replacing SERVER-IP with the server’s reachable address. Cockpit normally listens on TCP port 9090. Sign in with an authorized system account. A browser certificate warning may appear when the host uses a locally generated certificate; validate the server identity rather than ignoring certificate warnings on untrusted networks.

8. Change the SSH port on AlmaLinux safely

Changing SSH from TCP 22 to another port can reduce background noise from automated scans, but it is not a substitute for strong authentication, patching, access controls or monitoring. The example below uses TCP port 2222; choose an unused port approved by your environment.

Step 1 — Install SELinux management tools if needed

sudo dnf install -y policycoreutils-python-utils

Package availability can vary by release and repository configuration. If the package is already installed, continue.

Step 2 — Allow the new port in SELinux

Check existing SSH port labels first:

sudo semanage port -l | grep ssh_port_t

If port 2222 is not already defined for another SELinux port type, add it to the SSH port type:

sudo semanage port -a -t ssh_port_t -p tcp 2222

If the port is already assigned to another type, do not blindly use -m. Investigate the existing assignment and change it only if doing so is safe for the other service.

Step 3 — Open the new port in firewalld

sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload
sudo firewall-cmd --query-port=2222/tcp

If you use a non-default zone, add the port to the active zone that applies to the server’s management interface. Also update any upstream firewall, NAT rule or cloud security group.

Step 4 — Configure sshd to listen on the new port

Back up the configuration, then edit /etc/ssh/sshd_config. Add or update the directive so it contains:

Port 2222

Check whether an included configuration file under /etc/ssh/sshd_config.d/ overrides the setting. Validate the effective configuration and syntax before reloading:

sudo sshd -t
sudo sshd -T | grep -i '^port'

If validation reports an error, correct it before restarting or reloading the service.

Step 5 — Reload SSH and test a new connection

sudo systemctl reload sshd
sudo systemctl status sshd
sudo ss -ltnp | grep sshd

From a separate terminal, test the new port:

ssh -p 2222 username@SERVER-IP

Only after the new connection works and you have confirmed your access method should you consider removing port 22 from the firewall and configuration. If you leave port 22 enabled temporarily for rollback, limit it to trusted management sources where possible.

9. Final AlmaLinux post-install validation checklist

• Release: confirm cat /etc/almalinux-release matches the intended version.
• Repositories: verify EPEL/CRB only where required with dnf repolist --enabled.
• Updates: review pending updates and package transaction output.
• Networking: verify IP address, default route, DNS and remote reachability.
• Firewall: confirm active zone, intended services and custom ports.
• SELinux: verify getenforce and investigate denials without disabling protection.
• Cockpit: verify the socket and restrict management access to trusted networks.
• SSH: test the new port from a separate session before closing the original one.
• Recovery: confirm backups, console access, monitoring and system documentation.

10. Troubleshooting and frequently asked questions

Related VMoreCloud tutorials

Official documentation and sources

• AlmaLinux After-Installation Guide — post-installation repository and configuration guidance.
• AlmaLinux Extra Repositories — EPEL and CRB/PowerTools notes.
• AlmaLinux repository reference — repository names and enablement.
• Red Hat Enterprise Linux networking documentation — NetworkManager concepts applicable to compatible Enterprise Linux systems.
• RHEL firewall configuration guide — firewalld zones, services and ports.
• Cockpit documentation — web console administration and listener settings.
• RHEL SELinux guide — modes, labels and policy troubleshooting.