inicio/Rocky Linux 10/Install / Initial Config

Initial Settings : Firewall

rev 2025/06/13

	Configure Firewall and SELinux.
[1]	It's possible to display FireWall Service Status like follows. (enabled by default)

[root@localhost ~]#

systemctl status firewalld

● firewalld.service - firewalld - dynamic firewall daemon
     Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; preset>
     Active: active (running) since Fri 2025-06-13 08:34:50 JST; 19min ago
 Invocation: 9fb2f06dcc024b068c56cae49df88783
       Docs: man:firewalld(1)
   Main PID: 858 (firewalld)
      Tasks: 2 (limit: 24773)
     Memory: 47.4M (peak: 48.8M)
        CPU: 261ms
     CGroup: /system.slice/firewalld.service
             +-- 858 /usr/bin/python3 -sP /usr/sbin/firewalld --nofork --nopid

# [Active: active (running) ***] means firewalld is running now

[2]	If you use FireWall service, it needs to modify FireWall settings manually because incoming requests for services are mostly not allowed by default. Refer to here for basic Firewall operation and settins. Configuration examples of Rocky Linux 10 on this site are based on the environment Firewalld service is always enabled.
[3]	If you don't need FireWall service because of some reasons like that some FireWall Machines are running in your Local Netowrk or others, it's possible to stop and disable FireWall service on Rocky Linux server like follows.

# stop service

[root@localhost ~]#

systemctl stop firewalld

# disable service

[root@localhost ~]#

systemctl disable firewalld

Removed '/etc/systemd/system/multi-user.target.wants/firewalld.service'.
Removed '/etc/systemd/system/dbus-org.fedoraproject.FirewallD1.service'.

Initial Settings : SELinux

[4]	It's possible to display current SELinux (Security-Enhanced Linux) Status like follows. (enabled by default)

[root@localhost ~]#

getenforce

Enforcing     # SELinux is enabled

[5]	If you enable SELinux, there are cases to modify SELinux policies manually because sometimes SELinux stops applications. Refer to here for basic SELinux operation and settins. Configuration examples of Rocky Linux 10 on this site are based on the environment SELinux is always Enforcing.
[6]	If you don't need SELinux feature because of some reasons like that your server is running only in Local safety Network or others, it's possible to disable SELinux like follows.

# disable SELinux

[root@localhost ~]#

grubby --update-kernel ALL --args selinux=0

# apply changes to restart computer

[root@localhost ~]#

reboot

# if falling back to enable, run like follows

[root@localhost ~]#

grubby --update-kernel ALL --remove-args selinux