Hardening a fresh AlmaLinux box in 30 minutes

A new server has a grace period before the internet starts probing it. The goal is to use that window to close the obvious doors.

Before anything else

1. Create a non-root user with sudo, and lock down SSH key auth for it.
2. Disable root login and password authentication in /etc/ssh/sshd_config.
3. Restart sshd and confirm you can still get in before closing the session.

The firewall baseline

firewall-cmd --permanent --remove-service=dhcpv6-client
firewall-cmd --permanent --add-service={ssh,http,https}
firewall-cmd --reload

Only what the box actually serves. If it's not a mail server, no port 25.

Updates and automatic security patches

dnf update -y is the first real step, but dnf-automatic is what keeps it honest. I configure it for security updates only, so a routine kernel patch doesn't surprise me at 3am.

The honest conclusion

Thirty minutes gets you the baseline, not invulnerability. The real hardening is ongoing: reading logs, reviewing what's listening, and removing what you don't need. The checklist is just the starting line.