First hour after install: 7 checks on Rocky 9 (with real output)

When to use it

Right after the install, before any workload, is the cheapest time to change configuration. Getting these 7 checks right saves pain later when you add services, open ports and debug. Container-tested output is shown as-is; anything needing systemd or a live SELinux is explicitly marked “run on a real system”.

1. Release and repositories

cat /etc/rocky-release
dnf repolist --enabled

Rocky Linux release 9.3 (Blue Onyx)
repo id        repo name
appstream      Rocky Linux 9 - AppStream
baseos         Rocky Linux 9 - BaseOS
extras         Rocky Linux 9 - Extras

Only these three are enabled by default; CRB is not. When you need packages such as glibc-static or *-devel, enable it for that command with --enablerepo=crb instead of enabling it permanently.

2. Timezone and time sync

ls -l /etc/localtime
timedatectl status

lrwxrwxrwx. 1 root root 25 ... /etc/localtime -> ../usr/share/zoneinfo/UTC

In the container /etc/localtime points at UTC and timedatectl is unavailable (no systemd). On a real system run timedatectl set-timezone Asia/Shanghai and confirm systemctl status chronyd is active.

3. Hostname

cat /etc/hostname
hostnamectl

In the container /etc/hostname is the random container ID; on a real system use hostnamectl set-hostname app01.example.com and verify hostname -f returns the FQDN.

4. SELinux mode

getenforce
sestatus | head -5

Run on a real system: the container has no live SELinux, so getenforce returns Disabled or the command is missing. A fresh Rocky 9 install is enforcing; do not hide problems with setenforce 0 — locate them with ausearch/sealert.

5. Firewall

firewall-offline-cmd --get-default-zone
firewall-offline-cmd --zone=public --list-services

public
cockpit dhcpv6-client ssh

The default zone is public and only cockpit, dhcpv6-client and ssh are allowed. Remember to open the port when you add a service: /en/firewalld-zones/.

6. Updates and reboot needs

sudo dnf install -y yum-utils
sudo dnf -y update
sudo needs-restarting -r

No core libraries or services have been updated since boot-up.
Reboot should not be necessary.

needs-restarting -r exits 0 when no reboot is needed and 1 when one is. It comes from yum-utils, not dnf-plugins-core.

7. Minimal versus DVD

dnf list installed | wc -l
rpm -q firewalld chrony

Run on a real system: the container is a stripped rootfs, so its package count is not comparable to a minimal install. A real minimal install is usually around 400–600 packages and does not always include firewalld/chrony; confirm with rpm -q and install with dnf install -y firewalld chrony plus systemctl enable --now when missing.

Practice: a 10-minute checklist

Run each item on a fresh Rocky 9 host and record the result:

1. dnf repolist --enabled → exactly baseos/appstream/extras (CRB off)
2. timedatectl status | grep "Time zone" → the zone you expect
3. hostname -f → an FQDN (not localhost)
4. getenforce → Enforcing
5. firewall-cmd --zone=public --list-services → cockpit/dhcpv6-client/ssh only
6. needs-restarting -r; echo $? → 0
7. rpm -q firewalld chrony → both print a version

Next steps

• Opening ports: firewall-cmd port rules
• Offline installs: Offline package installs
• Security baseline: Security baseline