Red Hat, Rocky Linux, and AlmaLinux: Administration Guide

While Debian and Ubuntu dominate the web and the public cloud, the Red Hat ecosystem rules enterprise infrastructure: banking, insurance, the public sector, and telecom. Knowing how to administer a RHEL (Red Hat Enterprise Linux) system or one of its derivatives is a highly sought-after skill, and it is also the foundation of the RHCSA and RHCE certifications. In this guide, we cover package management with DNF and RPM, security with SELinux and firewalld, and Red Hat subscription management.

1. The RHEL Ecosystem and the End of CentOS

A Bit of History

For fifteen years, CentOS was the free, binary-compatible copy of RHEL: the same system, without the commercial support. In 2020, Red Hat ended CentOS Linux in favor of CentOS Stream, which is no longer a copy of RHEL but its development version: Stream sits upstream of RHEL, not downstream.

This decision immediately gave rise to two community successors, founded respectively by the original creator of CentOS and by the vendor CloudLinux:

• Rocky Linux: a community project run by the Rocky Enterprise Software Foundation;
• AlmaLinux: a project run by the AlmaLinux foundation, aiming for ABI compatibility (and no longer a bit-for-bit copy since 2023).

Which Distribution Should You Choose?

Distribution	Positioning	Cost	Recommended use
RHEL	Reference commercial version	Paid subscription (free for up to 16 machines for development)	Production with vendor support
Rocky Linux	1:1 rebuild of RHEL	Free	Production without a need for support
AlmaLinux	ABI-compatible with RHEL	Free	Production, fixes sometimes faster
CentOS Stream	Upstream of RHEL, rolling	Free	Development, testing, contribution
Fedora	Red Hat’s innovation lab	Free	Workstation, technology watch

For a production server without a support contract, Rocky Linux and AlmaLinux are equivalent choices in practice: same packages, same versions, and the RHEL documentation applies equally.

# Identify the distribution and version
cat /etc/redhat-release
cat /etc/os-release

2. DNF: the Package Manager

DNF (Dandified YUM) has replaced YUM since RHEL 8. The yum command still exists, but it is only a symbolic link to dnf.

Basic Operations

# Search for a package
dnf search nginx

# Display package information
dnf info nginx

# Install a package
sudo dnf install nginx

# Remove a package
sudo dnf remove nginx

# Update the entire system
sudo dnf update

# Check for available updates without applying them
dnf check-update

# Update only security fixes
sudo dnf update --security

# Clean up orphaned dependencies
sudo dnf autoremove

Unlike APT, there is no equivalent of apt update to run manually: DNF refreshes its metadata automatically when it has expired.

Transaction History: DNF’s Big Advantage

DNF logs every transaction and lets you undo it, something APT cannot do natively:

# List transactions
dnf history

# Details of a transaction
dnf history info 42

# Undo a transaction (uninstalls what was installed, etc.)
sudo dnf history undo 42

# Replay an undone transaction
sudo dnf history redo 42

Modules (Application Streams)

Since RHEL 8, some software is distributed as “modules” that offer several major versions in parallel:

# List available modules
dnf module list

# See the available versions (streams) for a module
dnf module list nodejs

# Enable and install a specific version
sudo dnf module enable nodejs:20
sudo dnf module install nodejs:20

# Switch versions: reset, then enable the other stream
sudo dnf module reset nodejs
sudo dnf module enable nodejs:22

Repository Management

# List active repositories
dnf repolist

# List all repositories, including disabled ones
dnf repolist --all

# Permanently enable / disable a repository
sudo dnf config-manager --set-enabled crb
sudo dnf config-manager --set-disabled crb

# Install a package from a disabled repository, one time only
sudo dnf --enablerepo=crb install nom-du-paquet

3. .repo Files and EPEL

Anatomy of a .repo File

Repositories are defined in /etc/yum.repos.d/*.repo files:

# /etc/yum.repos.d/exemple.repo
[exemple]
name=Mon depot exemple
baseurl=https://depot.exemple.com/el9/$basearch/
enabled=1
gpgcheck=1
gpgkey=https://depot.exemple.com/RPM-GPG-KEY-exemple

The $releasever (major version) and $basearch (architecture) variables are substituted automatically, which lets you write portable .repo files.

EPEL: the Essential Repository

EPEL (Extra Packages for Enterprise Linux) is a repository maintained by the Fedora community that provides thousands of packages missing from RHEL: htop, ncdu, fail2ban, certbot, and more.

# Installation on Rocky/Alma 9
sudo dnf install epel-release

# On RHEL, the package comes directly from the Fedora repository
sudo dnf install https://dl.fedoraproject.org/pub/epel/epel-release-latest-9.noarch.rpm

# Many EPEL packages also require the CRB (CodeReady Builder) repository
sudo dnf config-manager --set-enabled crb

4. RPM: the Low Level

Like dpkg on Debian, RPM is the low-level tool underlying DNF.

# List all installed packages
rpm -qa

# Check whether a package is installed and its version
rpm -q nginx

# List the files of a package
rpm -ql nginx

# Find the package that owns a file
rpm -qf /etc/nginx/nginx.conf

# Display package information
rpm -qi nginx

# Verify the integrity of a package's files
# (modified files, changed permissions...)
rpm -V nginx

# Install a local .rpm: prefer dnf, which resolves dependencies
sudo dnf install ./paquet.rpm

5. SELinux: Hardened Security

SELinux (Security-Enhanced Linux) is enabled by default across the entire RHEL family. It is a mandatory access control (MAC) system: even the root account is constrained by the policy. The first golden rule: never disable SELinux to “fix” a problem; learn to diagnose it instead.

Modes

# Display the current mode
getenforce

# Detailed status
sestatus

# Temporarily switch to permissive mode (logs without blocking)
sudo setenforce 0

# Return to enforcing mode
sudo setenforce 1

The persistent mode is set in /etc/selinux/config with three possible values: enforcing (the policy is enforced), permissive (violations are logged but allowed, useful for diagnosis), and disabled (to be avoided).

Contexts

Every file, process, and port carries a context label. Most blocks come from an incorrect file context:

# View the context of files (-Z option, available on many tools)
ls -Z /var/www/html

# View the context of processes
ps auxZ | grep nginx

# Fix the context of a moved or copied directory
sudo restorecon -Rv /var/www/html

# Make a context permanent for a non-standard path
sudo semanage fcontext -a -t httpd_sys_content_t "/srv/monsite(/.*)?"
sudo restorecon -Rv /srv/monsite

# Allow a non-standard port for a service
sudo semanage port -a -t http_port_t -p tcp 8081

Typical case: you move files with mv from your home directory to /var/www/html, and Nginx returns a 403 error. The move preserves the original context (user_home_t) instead of httpd_sys_content_t. Running restorecon -Rv fixes the problem.

Diagnosing with sealert

# Install the analysis tools
sudo dnf install setroubleshoot-server

# Analyze recent denials with explanations and suggestions
sudo sealert -a /var/log/audit/audit.log

# Raw search in the audit log
sudo ausearch -m AVC -ts recent

Booleans

Booleans are switches that enable predefined permissions without modifying the policy:

# List booleans related to httpd
getsebool -a | grep httpd

# Allow a web server to open outbound network connections
# (essential for a reverse proxy); -P makes the setting persistent
sudo setsebool -P httpd_can_network_connect on

# Allow httpd to connect to a database
sudo setsebool -P httpd_can_network_connect_db on

6. firewalld: the Firewall

firewalld is the default firewall of the RHEL family. It is built around the concept of zones: each network interface is assigned to a zone that defines the trust level and the allowed services.

# Firewall status
sudo firewall-cmd --state

# Default zone and active zones
sudo firewall-cmd --get-default-zone
sudo firewall-cmd --get-active-zones

# View everything for the current zone
sudo firewall-cmd --list-all

Allowing Services and Ports

# List the available predefined services
sudo firewall-cmd --get-services

# Allow HTTP and HTTPS permanently
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Allow an arbitrary port
sudo firewall-cmd --permanent --add-port=8080/tcp

# Remove a service
sudo firewall-cmd --permanent --remove-service=http

# Apply the permanent changes
sudo firewall-cmd --reload

Classic pitfall: without the --permanent option, the rule is active immediately but disappears on reboot; with --permanent, it survives a reboot but only takes effect after a --reload. To get both at once, run the command twice (with and without --permanent) or use --permanent followed by --reload.

# Change an interface's zone
sudo firewall-cmd --permanent --zone=internal --change-interface=eth1
sudo firewall-cmd --reload

7. RHEL Subscriptions: subscription-manager

A RHEL-specific feature compared to Rocky and Alma: access to the repositories requires a registered subscription. Since 2023, Red Hat has offered a free developer subscription covering up to 16 systems.

# Register the machine with the Red Hat portal
sudo subscription-manager register --username votre_login

# Check the status
sudo subscription-manager status

# List the repositories available through the subscription
sudo subscription-manager repos --list-enabled

# Enable an additional repository
sudo subscription-manager repos --enable codeready-builder-for-rhel-9-x86_64-rpms

# Unregister the machine (before decommissioning it)
sudo subscription-manager unregister

On Rocky Linux and AlmaLinux, subscription-manager does not exist: the repositories are public, as on Debian.

8. Coming from Debian: Command Mapping Table

If you already know APT, this table will save you time:

Operation	Debian/Ubuntu (apt)	RHEL/Rocky/Alma (dnf)
Refresh indexes	apt update	Automatic (dnf makecache to force)
Update the system	apt upgrade / apt full-upgrade	dnf update
Install	apt install paquet	dnf install paquet
Remove	apt remove / apt purge	dnf remove
Search	apt search motif	dnf search motif
Package details	apt show paquet	dnf info paquet
Clean up orphans	apt autoremove	dnf autoremove
Files of a package	dpkg -L paquet	rpm -ql paquet
Owner of a file	dpkg -S /chemin	rpm -qf /chemin
Undo a transaction	No native equivalent	dnf history undo N
Repositories	/etc/apt/sources.list.d/	/etc/yum.repos.d/
Default firewall	ufw (Ubuntu)	firewalld
Default MAC	AppArmor	SELinux

Best Practices

• For production without commercial support, choose Rocky Linux or AlmaLinux; reserve CentOS Stream for test environments.
• Never disable SELinux: switch to permissive mode for the duration of the diagnosis, fix contexts with restorecon and semanage, then go back to enforcing.
• Install EPEL and enable CRB as soon as a server goes into service: you will need them.
• Use dnf history before panicking after a problematic update: undo is your safety net.
• With firewalld, always remember the --permanent + --reload pair.
• Apply security fixes regularly with dnf update --security, or automate them with the dnf-automatic package.
• On RHEL, unregister decommissioned machines to free up subscriptions.

Conclusion

The Red Hat ecosystem imposes a stricter framework than the Debian world: SELinux active by default, a zone-based firewall, and subscriptions on RHEL. This rigor is precisely what makes it the standard for enterprise infrastructure. By mastering DNF and its transaction history, .repo files, SELinux contexts, and firewalld, you cover the essentials of a RHEL administrator’s daily work, and a good part of the RHCSA certification syllabus. To go further, explore systemd in depth, automation with Ansible (another Red Hat product), and containerization with Podman, Red Hat’s alternative to Docker.