30 điều phải làm sau cài cài Minimal Centos 7 P1

CentOS is a Industry Standard Linux Distribution which is a derivative of RedHat Enterprise Linux. You may start using the OS as soon as you install it, but to make the most out of your system you need to perform a few updates, install a few packages, configure certain services and application.

This article aims at “30 Things to Do After Installing RHEL/CentOS 7”. The post is written keeping in mind you have installed RHEL/CentOS Minimal Install which is preferred in Enterprise and production environment, if not you can follow below guide that will show you minimal installations of both.

1. Installation of CentOS 7 Minimal
2. Installation of RHEL 7 Minimal

The following are the list of important things, which we’ve covered in this guide based on industry standard requirements. We hoping that, these things will be very helpful in setting up your server.

1. Register and Enable Red Hat Subscription

2. Configure Network with Static IP Address

3. Set Hostname of Server

4. Update or Upgrade CentOS Minimal Install

5. Install Command Line Web Browser

6. Install Apache HTTP Server

7. Install PHP

8. Install MariaDB Database

9. Install and Configure SSH Server

10. Install GCC (GNU Compiler Collection)

11. Install Java

12. Install Apache Tomcat

13. Install Nmap to Monitor Open Ports

14. FirewallD Configuration

15. Installing Wget

16. Installing Telnet

17. Installing Webmin

18. Enable Third Party Repositories

19. Install 7-zip Utility

20. Install NTFS-3G Driver

21. Install Vsftpd FTP Server

22. Install and Configure sudo

23. Install and Enable SELinux

24. Install Rootkit Hunter

25. Install Linux Malware Detect (LMD)

26. Server Bandwidth Testing with Speedtest-cli

27. Configure Cron Jobs

28. Install Owncloud

29. Enable Virtualization with Virtualbox

30. Password Protect GRUB

1. Register and Enable Red Hat Subscription

After minimal RHEL 7 installation, it’s time to register and enable your system to Red Hat Subscription repositories and perform a full system update. This is valid only if you have a valid RedHat Subscription. You need to register your in order to enable official RedHat System repositories and update the OS from time-to-time.

We have already covered a detailed instructions on how to register and active RedHat subscription at the below guide.

1. Register and Enable Red Hat Subscription Repositories in RHEL 7

Note: This step is only for RedHat Enterprise Linux having a valid subscription. If you are running a CentOS server immediately move to further steps.

2. Configure Network with Static IP Address

The first thing you need to do is to configure Static IP address, Route and DNS to your CentOS Server. We will be using ip command the replacement of ifconfig command. However, ifconfig command is still available for most of the Linux distributions and can be installed from default repository.

# yum install net-tools             [Provides ifconfig utility]

But as I said we will be using ip command to configure static IP address. So, make sure you first check the current IP address.

# ip addr show

Now open and edit file /etc/sysconfig/network-scripts/ifcfg-enp0s3 using your choice of editor. Here, I’m using Vi editor and make sure you must be root user to make changes…

# vi /etc/sysconfig/network-scripts/ifcfg-enp0s3

Now we will be editing four fields in the file. Note the below four fields and leave everything else untouched. Also leave double quotes as it is and enter your data in between.

IPADDR = “[Enter your static IP here]” 
GATEWAY = “[Enter your Default Gateway]”
DNS1 = “[Your Domain Name System 1]”
DNS2 = “[Your Domain Name System 2]”

After making the changes ‘ifcfg-enp0s3‘, looks something like the image below. Notice your IP, GATEWAY and DNS will vary, please confirm it with your ISP. Save and Exit.

Network Details

Restart service network and check the IP is correct or not, that was assigned. If everything is ok, Ping to see network status…

# service network restart

Restart Network Service

After restarting network, make sure to check the IP address and network status…

# ip addr show
# ping -c4 google.com

Verify IP Address

Check Network Status

3. Set Hostname of Server

The next thing to do is to change the HOSTNAME of the CentOS sever. Check the currently assignedHOSTNAME.

# echo $HOSTNAME

Check System Hostname

To set new HOSTNAME we need to edit ‘/etc/hostsname‘ and replace old hostname with the desired one.

# vi /etc/hostname

Set System Hostname

After setting hostname, make sure to confirm hostname by logout and login again. After login check new hostname.

$ echo $HOSTNAME

Confirm New Hostname

Alternatively you may use command ‘hostname‘ command to view your current hotsname.

$ hostname

4. Update or Upgrade CentOS Minimal Install

This will not install any new packages other than updating and installing the latest version of installed packages and security updates. Moreover Update and Upgrade are pretty same except the fact that Upgrade = Update + enable obsoletes processing during updates.

# yum update && yum upgrade

Update Minimal CentOS Server

Important: You can also run the below command which will not prompt for the packages update and you do not need to type ‘y‘ for accepting the changes.

However it is always a good idea to review the changes which is going to take place on the sever specially in production. Hence using the below command may automate the update and upgrade for you but it is not recommended.

# yum -y update && yum -y upgrade

5. Install Command Line Web Browser

In most cases, specially in production environment, we usually install CentOS as command line with no GUI, in this situation we must have a commandline browsing tool to check websites via terminal. For this, we going to install a most famous tool called ‘links‘.

# yum install links

Links: Commandline Web Browsing

For usage and examples to browse web sites u links tool, read our article Command Line Web Browsing with Links Tool

6. Install Apache HTTP Server

No matter for what purpose you will be using the server, in most of the cases you need a HTTP server to run websites, multimedia, client side script and many other things.

# yum install httpd

Install Apache Server

If you would like to change default port (80) of Apache HTTP Server to any other port. You need to edit the configuration file ‘/etc/httpd/conf/httpd.conf‘ and search for the line that starts typically like:

LISTEN 80 

Change port number ‘80‘ to any other port (say 3221), save and exit.

Change Apache Port

Add the port you just opened for Apache through firewall and then reload firewall.

Allow service http through firewall (Permanent).

# firewall-cmd –add-service=http

Allow port 3221 through firewall (Permanent).

# firewall-cmd –permanent –add-port=3221/tcp

Reload firewall.

# firewall-cmd –reload

After making all above things, now it’s time to restart Apache HTTP server, so that the new port number is taken into effect.

# systemctl restart httpd.service

Now add the Apache service to system-wide to start automatically when system boots.

# systemctl start httpd.service
# systemctl enable httpd.service

Now verify the Apache HTTP Server by using links command line tool as shown in the below screen.

# links 127.0.0.1

Verify Apache Status

7. Install PHP

PHP is a server-side scripting language for web based services. It is frequently used as general-purpose programming language as well. Install PHP on CentOS Minimal Server as.

# yum install php

After installing php, make sure to restart Apache service to render PHP in Web Browser.

# systemctl restart httpd.service

Next, verify PHP by creating following php script in the Apache document root directory.

# echo -e "<?php\nphpinfo();\n?>"  > /var/ww/html/phpinfo.php

Now view the PHP file, we just created (phpinfo.php) in Linux Command Line as below.

# php /var/www/html/phpinfo.php
OR
# links http://127.0.0.1/phpinfo.php

Verify PHP

8. Install MariaDB Database

MariaDB is a fork of MySQL. RedHat Enterprise Linux and its derivatives have shifted to MariaDB from MySQL. It is the Primary Database management System. It is again one of those tools which is necessary to have and you will need it sooner or later no matter what kind of server you are setting. Install MariaDB on CentOS Minimal Install server as below.

# yum install mariadb-server mariadb

Install MariaDB Database

Start and configure MariaDB to start automatically at boot.

# systemctl start mariadb.service
# systemctl enable mariadb.service

Allow service mysql (mariadb) through firewall.

# firewall-cmd –add-service=mysql

Now it’s time to secure MariaDB server.

# /usr/bin/mysql_secure_installation

Secure MariaDB Database

Read Also:

1. Installing LAMP (Linux, Apache, MariaDB, PHP/PhpMyAdmin) in CentOS 7.0
2. Creating Apache Virtual Hosts in CentOS 7.0

9. Install and Configure SSH Server

SSH stands for Secure Shell which is the default protocol in Linux for remote management. SSH is one of those essential piece of software which comes default with CentOS Minimal Server.

Check Currently Installed SSH version.

# SSH -V

Check SSH Version

Use Secure Protocol over the default SSH Protocol and change port number also for extra Security. Edit the SSH configuration file ‘/etc/ssh/ssh_config‘.

Uncomment the line below line or delete 1 from the Protocol string, so the line seems like:

# Protocol 2,1 (Original)
Protocol 2 (Now)

This change force SSH to use Protocol 2 which is considered to be more secure than Protocol 1 and also make sure to change the port number 22 to any in the configuration.

Secure SSH Login

Disable SSH ‘root login‘ and allow to connect to root only after login to normal user account for added additional Security. For this, open and edit configuration file ‘/etc/ssh/sshd_config‘ and changePermitRootLogin yes t PermitRootLogin no.

# PermitRootLogin yes (Original) 
PermitRootLogin no (Now)

Disable SSH Root Login

Finally, restart SSH service to reflect new changes..

# systemctl restart sshd.service

Read Also:

1. 5 Best Practices to Secure and Protect SSH Server
2. SSH Passwordless Login Using SSH Keygen in 5 Easy Steps
3. No Password SSH Keys Authentication” with PuTTY

10. Install GCC (GNU Compiler Collection)

GCC stands for GNU Compiler Collection is a compiler system developed by GNU Project that support various programming languages. It is not installed by default in CentOS Minimal Install. To install gcc compiler run the below command.

# yum install gcc

Install GCC GNU Compiler

Check the version of installed gcc.

# gcc --version

Check GCC Version

11. Install Java

Java is a general purpose class based, object-oriented Programming language. It is not installed by default in CentOS Minimal Server. Install Java from repository as below.

# yum install java

Install Java

Check version of Java Installed.

# java -version

Check Java Version

12. Install Apache Tomcat

Tomcat is a servlet container designed by Apache to run Java HTTP web server. Install tomcat as below but it is necessary to point out that you must have installed Java prior of installing tomcat.

# yum install tomcat

Install Apache Tomcat

After tomcat has been installed, star the tomcat service.

# systemctl start tomcat

Check Version of tomcat.

# /usr/sbin/tomcat version

Check Tomcat Version

Add service tomcat and default port (8080) through firewall and reload settings.

# firewall-cmd --zone=public --add-port=8080/tcp --permannet
# firewall-cmd –reload

Now it’s time to secure tomcat server, create a user and a password to access and manage. We need to edit file ‘/etc/tomcat/tomcat-users.xml‘. See the section which looks like:

<tomcat-users>
....
</tomcat-users>


<role rolename="manager-gui"/>
 <role rolename="manager-script"/>
 <role rolename="manager-jmx"/>
 <role rolename="manager-status"/>
 <role rolename="admin-gui"/>
 <role rolename="admin-script"/>
 <user username="tecmint" password="tecmint" roles="manager-gui,manager-script,manager-jmx,manager-status,admin-gui,admin-script"/>
</tomcat-users>

Secure Tomcat

Here we added user “tecmint” to administer/manage tomcat using password “tecmint”. Stop and start the service tomcat so that the changes are taken into effect and enable tomcat service to start at system boot.

# systemctl stop tomcat
# systemctl start tomcat
# systemctl enable tomcat.service

Read Also: Installing and Configuring Apache Tomcat 8.0.9 in RHEL/CentOS 7.0/6.x

13. Install Nmap to Monitor Open Ports

Nmap for Network Mapper creates a map of the network by discovering host on which it is running as well as by analyzing network. nmap is not included in the default installation and you have to install it from repository.

# yum install nmap

Install Nmap Monitoring Tool

List all open ports and corresponding services using them on host.

# nmap 127.0.01

Monitor Open Ports

You may also use firewall-cmd to list all the ports, however I find nmap more useful.

# firewall-cmd --list-ports

Check Open Ports in Firewall

Read Also: 29 Useful Nmap Command to Monitor Open Ports

14. FirewallD Configuration

firewalld is a firewall service which manages the server dynamically. Firewalld removed iptables in CentOS 7. Firewalld is installed by default on RedHat Enterprise Linux and its derivatives by default. With iptables every change in order to be taken into effect needs to flush all the old rules and create new rules.

However with firewalld, no flushing and recreating of new rules required and only changes are applied on the fly.

Check if Firewalld is running or not.

# systemctl status firewalld
OR
# firewall-cmd –state

Check Firewalld Status

Get a list of all the zones.

# firewall-cmd --get-zones

Check Firewalld Zones

To get details on a zone before switching.

# firewall-cmd --zone=work --list-all

Check Zone Details

To get default zone.

# firewall-cmd --get-default-zone

Firewalld Default Zone

To switch to a different zone say ‘work‘.

# firewall-cmd --set-default-zone=work

Swich Firewalld Zones

To list all the services in the zone.

# firewall-cmd --list-services

List Firewalld Zone Services

To add a service say http, temporarily and reload firewalld.

# firewall-cmd  --add-service=http
# firewall-cmd –reload

Add http Service Temporarily

To add a service say http, permanently and reload firewalld.

# firewall-cmd --add-service=http --permanent
# firewall-cmd --reload

Add http Service Permanent

To remove a service say http, temporarily.

# firewall-cmd  --remove-service=http
# firewall-cmd --reload

Remove Firewalld Service Temporarily

To remove a service say http, permanently.

# firewall-cmd --zone=work --remove-service=http --permanent
# firewall-cmd --reload

Remove Service Permanently

To allow a port (say 331), temporarily.

# firewall-cmd --add-port=331/tcp
# firewall-cmd --reload

Open Port Temporarily

To allow a port (say 331), permanently.

# firewall-cmd --add-port=331/tcp --permanent
# firewall-cmd --reload

Open Port Permanently

To block/remove a port (say 331), temporarily.

# firewall-cmd --remove-port=331/tcp
# firewall-cmd --reload

Remove Port Temporarily

To block/remove a port (say 331), permanently.

# firewall-cmd --remove-port=331/tcp --permanent
# firewall-cmd --reload

Remove Port Permanently

To disable firewalld.

# systemctl stop firewalld
# systemctl disable firewalld
# firewall-cmd --state

Disable Firewalld Service

To enable firewalld.

# systemctl enable firewalld
# systemctl start firewalld
# firewall-cmd --state

Enable Firewalld

1. How to Configure ‘FirewallD’ in RHEL/CentOS 7
2. Useful ‘FirewallD’ Rules to Configure and Manage Firewall

15. Installing Wget

wget is a Linux command line based utility that retrieves (downloads) content from web servers. It is an important tool you must have to retrieve web contents or download any files using wget command.

# yum install wget

Install Wget Tool

For more usage and practical examples on how to use wget command to download files on the terminal, read 10 Wget Command Examples.

16. Installing Telnet

Telnet is a network protocol that enables a user to login into another computer on the same network over TCP/IP. Once connection etablished to the remote computer it becomes a virtual terminal and allow you to communicate with the remote host within your computer as per whatever privileges provided to you.

Telnet also very useful for checking listening ports on remote computer or host.

# yum install telnet
# telnet google.com 80

Telnet Port Checking