Centos9 server setup a practical beginners guide

Step 1 — CentOS Login as Root
To access your server, you'll need its public IP address. You'll also need the password or, if you set up an SSH key for authentication, the private key for the root user's account. If you haven't logged in yet, you might want to check our documentation on connecting to your Droplet via SSH, which explains this process in detail.

If you're not already connected, log in as root now using the following command (replace the highlighted part with your server's public IP address):

ssh root@your_server_ip
If a host authenticity warning appears, accept it. If you use password authentication, enter your root password to log in. If you use an SSH key protected by a passphrase, you may be asked to enter it the first time you use the key each session. If this is your first password login to the server, you might also be prompted to change the root password.

About Root
The root user is the administrative account in a Linux environment, with very extensive privileges. Because of the root account's elevated privileges, it's advised not to use it regularly. This is because the root account's power includes the ability to make highly destructive changes, even accidentally.

Therefore, the next step is to create an alternative user account with a more limited scope for daily tasks. This account will still be able to gain increased privileges when needed.

Step 2 — Creating a New User
Once logged in as root, you can create the new user account that will be used for future logins.

This example creates a user named sammy, but you should replace it with any username you prefer:

adduser sammy
Next, set a strong password for the sammy user:

passwd sammy
You'll be asked to enter the password twice. After that, your user will be ready, but first we'll grant this user additional privileges to use the sudo command. This will let us run commands as root when necessary.

Step 3 — Granting Administrative Privileges
Now we have a new user account with standard privileges. However, we may sometimes need to perform administrative tasks.

To avoid logging out of our normal user and back in as root, we can set up what's called "superuser" or root privileges for our normal account. This will allow our normal user to run commands with administrative privileges by prefixing each command with sudo.

To add these privileges to our new user, we need to add them to the wheel group. By default, on CentOS, members of the wheel group are permitted to use the sudo command.

As root, run this command to add your new user to the wheel group (replace the highlighted word with your new username):

usermod -aG wheel sammy
Now, when logged in as your regular user, you can type sudo before commands to perform actions with superuser privileges.

Step 4 — Setting Up a Basic Firewall
Firewalls provide a basic level of security for your server. These applications are responsible for denying traffic to every port on your server, except for those ports/services you have explicitly approved. CentOS has a service called firewalld to handle this function. A tool called firewall-cmd is used to configure firewalld firewall policies.

Note: If your servers are running on DigitalOcean, you can optionally use DigitalOcean Cloud Firewalls instead of firewalld. We recommend using only one firewall at a time to avoid conflicting rules that may be hard to debug.

First, install firewalld:

dnf install firewalld -y
The default firewalld configuration allows ssh connections, so we can turn the firewall on immediately:

systemctl start firewalld
Check the service status to ensure it started:

systemctl status firewalld
Output
● firewalld.service - firewalld - dynamic firewall daemon
Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
Active: active (running) since Thu 2020-02-06 16:39:40 UTC; 3s ago
Docs: man:firewalld(1)
Main PID: 13180 (firewalld)
Tasks: 2 (limit: 5059)
Memory: 22.4M
CGroup: /system.slice/firewalld.service
└─13180 /usr/libexec/platform-python -s /usr/sbin/firewalld --nofork --nopid
Note that it is both active and enabled, meaning it will start automatically if the server is rebooted.

Now that the service is running, we can use the firewall-cmd utility to get and set policy information for the firewall.

First, let's list which services are already allowed:

firewall-cmd --permanent --list-all
Output
public (active)
target: default
icmp-block-inversion: no
interfaces: eth0 eth1
sources:
services: cockpit dhcpv6-client ssh
ports:
protocols:
masquerade: no
forward-ports:
source-ports:
icmp-blocks:
rich rules:
To see the additional services you can enable by name, type:

firewall-cmd --get-services
To add a service that should be allowed, use the --add-service flag:

firewall-cmd --permanent --add-service=http
This would add the http service and allow incoming TCP traffic to port 80. The configuration will update after you reload the firewall:

firewall-cmd --reload
Remember that you must explicitly open the firewall (with services or ports) for any additional services you may configure later.

Step 5 — Enabling External Access for Your Regular User
Now that we have a regular non-root user for daily use, we need to ensure we can use it to SSH into our server.

Note: Until you verify that you can log in and use sudo with your new user, we recommend staying logged in as root. This way, if problems arise, you can troubleshoot and make any necessary changes as root. If you are using a DigitalOcean Droplet and have issues with your root SSH connection, you can log into the Droplet using the DigitalOcean Console.

The process for configuring SSH access for your new user depends on whether your server's root account uses a password or SSH keys for authentication.

If the Root Account Uses Password Authentication
If you logged in to your root account using a password, then password authentication is enabled for SSH. You can SSH to your new user account by opening a new terminal session and using SSH with your new username:

ssh sammy@your_server_ip
After entering your regular user's password, you will be logged in. Remember, if you need to run a command with administrative privileges, type sudo before it like this:

sudo command_to_run
You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).

To enhance your server's security, we strongly recommend setting up SSH keys instead of using password authentication. Follow our guide on setting up SSH keys on CentOS to learn how to configure key-based authentication.

If the Root Account Uses SSH Key Authentication
If you logged in to your root account using SSH keys, then password authentication is disabled for SSH. You will need to add a copy of your public key to the new user's ~/.ssh/authorized_keys file to log in successfully.

Since your public key is already in the root account's ~/.ssh/authorized_keys file on the server, we can copy that file and directory structure to our new user account.

The simplest way to copy the files with the correct ownership and permissions is with the rsync command. This will copy the root user's .ssh directory, preserve the permissions, and modify the file owners, all in a single command. Make sure to change the highlighted portions of the command below to match your regular user's name:

Note: The rsync command treats sources and destinations that end with a trailing slash differently than those without a trailing slash. When using rsync below, be sure that the source directory (~/.ssh) does not include a trailing slash (check to make sure you are not using ~/.ssh/).

If you accidentally add a trailing slash to the command, rsync will copy the contents of the root account's ~/.ssh directory to the sudo user's home directory instead of copying the entire ~/.ssh directory structure. The files will be in the wrong location and SSH will not be able to find and use them.

rsync --archive --chown=sammy:sammy ~/.ssh /home/sammy
Now, back in a new terminal on your local machine, open up a new SSH session with your non-root user:

ssh
You should be logged in to the new user account without using a password. Remember, if you need to run a command with administrative privileges, type sudo before it like this:

sudo command_to_run
You will be prompted for your regular user password when using sudo for the first time each session (and periodically afterwards).

Conclusion
At this point, you have a solid foundation for your server. You can install any software you need on it now.