CentOS 7 Minimal Install |

CentOS 7 – Minimal server install. I will document my build process in sections.

The minimal instalation. This is a very basic install with just the minimal selected. At this point I’m assuming you have some knowledge of installing Linux systems. I have plans to create a detailed install guide for CentOS in the near future.
Firewall configuration. I use custom firewall scripts using iptables, so all my firewall files I scp over to the new build. I realize that firewalld is the “new” firewall however until I’m comfortable with that I use the old iptables.
Server config. This section deals with installing services (if necessary) and configuration of those services. Remember this is a basic install so only the basic services are set up.
Post install. The finishing touches, This is stuff I like to do at the end of a base install.

The process:

Note: This guide assumes you have some knowledge of Linux systems. Whilst I do intend to document a detailed install guide for CentOS, at this point in time I am assuming you know how to do the install.

Actual commands are shown like so blue

Install Section:

Ok, this is pretty straight forward. As I mentioned earlier I am assuming you have knowledge of installing linux systems. Just configure the options for the install( eg: network, partitioning etc) to suit your needs but for software just select ‘minimal install’ Once the install is done and we have rebooted we can so some prelim config as shown below. You will need to su – as root to perform the following

The basic install will only install vi. If you are happy just with vi then skip this bit. I prefer vim so we need to get that like so: yum install vim
We need to get some tools to help us manage SELINUX as we will be modifying ports later on. So we need to do: yum install setroubleshoot setools

Ok, that’s the install section done, on with the firewall section

Firewall Section:

CentOS 7 is a major update and has some “new” systems such as systemd and firewalld just to name two.

At the moment I am not that familiar with firewalld, so I will use my old “iptables” scripts for my firewall. Once I am comfortable with firewalld I will switch to that. The first thing I do is SCP all my firewall scripts across to this new build. Once they have been correctly adjusted with the details of the new build we can do the following:

yum install net-tools
systemctl stop firewalld
systemctl disable firewalld
service <firewallscript> start
chkconfig <firewallscript> on

At this point I run tail -f /var/log/messages and watch the entries for a few m inutes, adjust the firewall script as necessary based on this. You should now have a running custom firewall.

System Config:

Time to configure the services. This section is very open to your personal preferences. I have listed what I like to do, simply adjust to suit your requirements if necessary.

Edit SSH. I dont run ssh on the standard port and I disable root login so I make those adjustments in /etc/ssh/sshd_config , Now remember we are running SELINUX and it will prevent SSH from running on the non-standard port. So we need to adjust SELINUX to suit like so: semanage port -a -t ssh_port_t -p tcp <port> Then we can start SSH again.

As this is a base build for a 24/7 server I like to use ntp instead of chrony for time keeping. So we do the following:

yum install ntp
edit /etc/ntp.conf and adjust to suit
systemctl stop chrony
systemctl disable chrony
systemctl enable ntpd
systemctl start ntpd

Setting the time zone in CentOS 7 is very easy, much better than previous versions. Simply do the following:
Find the time zone you want by doing timedatectl list-timezones
Then set the zone by doing: timedatectl set-timezone <required zone> For example timedatectl set-timezone Australia/Sydney. That’s all there is to it!

As I have my own IP4 class C, I don’t need IPV6, so I disable it. Be aware that the upstream Redhat maintainer reccomends NOT removing the IPV6 module as this will upset SELINUX and maybe other services. I do it this way, create the file disableipv6.conf in /etc/sysctl.d/ and insert the following in it:

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

IPV6 will still be running so we need to disable it by the following:

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6
echo 1 > /proc/sys/net/ipv6/conf/default/disable_ipv6

If you are tailing the messages log as you do this you will see IPV6 being disabled. You can also do an ifconfig to verify ther eis no IPV6 address attached to the network interface.

I also like to remove all references to IPV6 in services such as SSH, postfix, ntpd etc. If you tail the messages log and restart the services in another terminal it will tell you if a particular service is complaing about nonexitant IPV6.

Post Install:

Ok now we have some tasks I like to do at the end, just to “tidy” things up.

Edit /etc/aliases so you get root’s mail. Don’t forget to run newaliases after you’re done.
yum install logwatch
yum install yum-priorities I like to use yum-priorities. Whilst you have only the base repo’s it makes no difference, but eventually you will install other repos and it can help then.
Finally do a complete yum update – yum update

That’s it! We now have a complete minimal install with custom firewall, IPV6 disabled and SSH configured securely. If you are using virtualization you can clone this build and use it as a base to build other systems such as a mail or web server.

CentOS 7 – Minimal server install. I will document my build process in sections.

The minimal instalation. This is a very basic install with just the minimal selected. At this point I’m assuming you have some knowledge of installing Linux systems. I have plans to create a detailed install guide for CentOS in the near future.

Firewall configuration. I use custom firewall scripts using iptables, so all my firewall files I scp over to the new build. I realize that firewalld is the “new” firewall however until I’m comfortable with that I use the old iptables.

Server config. This section deals with installing services (if necessary) and configuration of those services. Remember this is a basic install so only the basic services are set up.

Post install. The finishing touches, This is stuff I like to do at the end of a base install.

The process:

Note: This guide assumes you have some knowledge of Linux systems. Whilst I do intend to document a detailed install guide for CentOS, at this point in time I am assuming you know how to do the install.

Actual commands are shown like so blue

Install Section:

The basic install will only install vi. If you are happy just with vi then skip this bit. I prefer vim so we need to get that like so: yum install vim

We need to get some tools to help us manage SELINUX as we will be modifying ports later on. So we need to do: yum install setroubleshoot setools

Ok, that’s the install section done, on with the firewall section

Firewall Section:

CentOS 7 is a major update and has some “new” systems such as systemd and firewalld just to name two.

yum install net-tools

systemctl stop firewalld

systemctl disable firewalld

service <firewallscript> start

chkconfig <firewallscript> on

At this point I run tail -f /var/log/messages and watch the entries for a few m inutes, adjust the firewall script as necessary based on this. You should now have a running custom firewall.

System Config:

Time to configure the services. This section is very open to your personal preferences. I have listed what I like to do, simply adjust to suit your requirements if necessary.

As this is a base build for a 24/7 server I like to use ntp instead of chrony for time keeping. So we do the following:

yum install ntp

edit /etc/ntp.conf and adjust to suit

systemctl stop chrony

systemctl disable chrony

systemctl enable ntpd

systemctl start ntpd

net.ipv6.conf.all.disable_ipv6 = 1

net.ipv6.conf.default.disable_ipv6 = 1

IPV6 will still be running so we need to disable it by the following:

echo 1 > /proc/sys/net/ipv6/conf/all/disable_ipv6

echo 1 > /proc/sys/net/ipv6/conf/default/disable_ipv6

If you are tailing the messages log as you do this you will see IPV6 being disabled. You can also do an ifconfig to verify ther eis no IPV6 address attached to the network interface.

I also like to remove all references to IPV6 in services such as SSH, postfix, ntpd etc. If you tail the messages log and restart the services in another terminal it will tell you if a particular service is complaing about nonexitant IPV6.

Post Install:

Ok now we have some tasks I like to do at the end, just to “tidy” things up.

Edit /etc/aliases so you get root’s mail. Don’t forget to run newaliases after you’re done.

yum install logwatch

yum install yum-priorities I like to use yum-priorities. Whilst you have only the base repo’s it makes no difference, but eventually you will install other repos and it can help then.

Finally do a complete yum update – yum update

That’s it! We now have a complete minimal install with custom firewall, IPV6 disabled and SSH configured securely. If you are using virtualization you can clone this build and use it as a base to build other systems such as a mail or web server.