Wissensdatenbank

This guide adapts the core SSH and security hardening practices to AlmaLinux/Rocky Linux's specific tooling — firewalld, SELinux, and dnf — rather than duplicating the general concepts covered for Ubuntu/Debian.

Prerequisites

• AlmaLinux 9 or Rocky Linux 9 VPS
• A sudo-enabled user already created
• An active SSH session (keep it open throughout)

Step 1 — Set Up SSH Key Authentication

ssh-copy-id deploy@YOUR_SERVER_IP

Step 2 — Edit sshd_config

sudo nano /etc/ssh/sshd_config

Port 2222
PermitRootLogin no
PasswordAuthentication no

Step 3 — Update firewalld for the New Port

sudo firewall-cmd --permanent --remove-service=ssh
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --reload

Step 4 — Update SELinux to Allow SSH on the Custom Port

Unlike Ubuntu/Debian, SELinux on AlmaLinux/Rocky Linux will block SSH from binding to a non-standard port unless explicitly told the port is valid for SSH:

sudo dnf install policycoreutils-python-utils -y
sudo semanage port -a -t ssh_port_t -p tcp 2222

This step is easy to miss and is a very common cause of SSH failing to start after a port change on RHEL-family systems.

Step 5 — Validate and Restart SSH

sudo sshd -t
sudo systemctl restart sshd

Note the service name is sshd, not ssh.

Step 6 — Test in a New Session Before Closing the Current One

ssh -p 2222 deploy@YOUR_SERVER_IP

Step 7 — Install and Configure Fail2Ban

sudo dnf install epel-release -y
sudo dnf install fail2ban -y
sudo systemctl enable --now fail2ban

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local

[sshd]
enabled = true
port = 2222

sudo systemctl restart fail2ban

Step 8 — Verify SELinux Status

getenforce

Keep it Enforcing — see Understanding SELinux Basics on AlmaLinux/Rocky Linux for working with it rather than disabling it.

Step 9 — Enable Automatic Security Updates

sudo dnf install dnf-automatic -y
sudo nano /etc/dnf/automatic.conf

upgrade_type = security
apply_updates = yes

sudo systemctl enable --now dnf-automatic.timer

Step 10 — Review firewalld Rules

sudo firewall-cmd --list-all

Confirm only genuinely necessary services/ports are allowed.

Quick Reference: Key RHEL-Family Differences from Generic Hardening Guides

Common Errors

SSH fails to start after changing the port — almost always the missing semanage port step; SELinux blocks sshd from binding to a port not registered for the ssh_port_t type.

sudo ausearch -m avc -ts recent | grep sshd

Continue Reading

• Understanding SELinux Basics on AlmaLinux/Rocky Linux
• How to Configure firewalld on AlmaLinux/Rocky Linux
• SSH Hardening: Change the Port, Disable Root Login & Use SSH Keys

Browse more articles in AlmaLinux & Rocky Linux.