Rocky Linux 9 서버 설치와 초기 구성

lsblk -e7 -o NAME,SIZE,MODEL,SERIAL,TYPE,FSTYPE,MOUNTPOINTS

findmnt -no SOURCE,TARGET,FSTYPE /
ip -brief address
ip route

ls -lh Rocky-9-*.iso CHECKSUM CHECKSUM.asc RPM-GPG-KEY-Rocky-9

gpg --quiet --show-keys --with-fingerprint ./RPM-GPG-KEY-Rocky-9

mkdir -p -m 700 ./rocky-gpg-verify
gpg --homedir ./rocky-gpg-verify --import ./RPM-GPG-KEY-Rocky-9
gpg --homedir ./rocky-gpg-verify --verify ./CHECKSUM.asc ./CHECKSUM

sha256sum -c CHECKSUM --ignore-missing

timedatectl list-timezones | grep <REGION>

ip -brief address
ip route

lsblk -e7 -o NAME,SIZE,MODEL,SERIAL,TYPE,FSTYPE,MOUNTPOINTS

sudo systemctl reboot

cat /etc/os-release
uname -srmo
who -b
rpm -q kernel --last | head -n 3

lsblk -f
findmnt --verify --verbose
df -hT

nmcli device status
ip route
getent hosts download.rockylinux.org
timedatectl status

sudo dnf repolist --enabled
systemctl --failed --no-pager
sudo journalctl -p err..alert -b --no-pager

getenforce
sestatus

sudo firewall-cmd --state
sudo firewall-cmd --get-active-zones
sudo firewall-cmd --zone=<ACTIVE_ZONE> --list-all
sudo firewall-cmd --zone=<ACTIVE_ZONE> --list-rich-rules

sudo firewall-cmd --zone=<ACTIVE_ZONE> --add-rich-rule='rule family="ipv4" source address="<ADMIN_IPV4_CIDR>" service name="ssh" accept' &&
{
  rocky_runtime_services="$(sudo firewall-cmd --zone=<ACTIVE_ZONE> --list-services)" &&
  if printf '%s\n' "$rocky_runtime_services" | grep -qw ssh; then
    sudo firewall-cmd --zone=<ACTIVE_ZONE> --remove-service=ssh
  else
    printf '%s\n' 'runtime zone-wide ssh service 없음'
  fi
} &&
sudo firewall-cmd --zone=<ACTIVE_ZONE> --list-all

ssh-copy-id <ADMIN_USER>@<SERVER_IP>
ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no -t <ADMIN_USER>@<SERVER_IP> 'id && sudo -v'

if sudo test -e /etc/ssh/sshd_config.d/10-haruspace-hardening.conf; then sudo cp --archive --no-clobber /etc/ssh/sshd_config.d/10-haruspace-hardening.conf /etc/ssh/sshd_config.d/10-haruspace-hardening.conf.<BACKUP_SUFFIX>; else printf '%s\n' '기존 스니펫 없음'; fi

sudoedit /etc/ssh/sshd_config.d/10-haruspace-hardening.conf

sudo sshd -t && sudo systemctl reload sshd.service && sudo sshd -T | grep -E '^(permitrootlogin|pubkeyauthentication|passwordauthentication|kbdinteractiveauthentication) '

ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no -t <ADMIN_USER>@<SERVER_IP> 'id && sudo -v'

sudo firewall-cmd --zone=<ACTIVE_ZONE> --permanent --add-rich-rule='rule family="ipv4" source address="<ADMIN_IPV4_CIDR>" service name="ssh" accept' &&
{
  rocky_permanent_services="$(sudo firewall-cmd --zone=<ACTIVE_ZONE> --permanent --list-services)" &&
  if printf '%s\n' "$rocky_permanent_services" | grep -qw ssh; then
    sudo firewall-cmd --zone=<ACTIVE_ZONE> --permanent --remove-service=ssh
  else
    printf '%s\n' 'permanent zone-wide ssh service 없음'
  fi
} &&
sudo firewall-cmd --reload &&
sudo firewall-cmd --zone=<ACTIVE_ZONE> --list-all

ssh -o PreferredAuthentications=publickey -o PasswordAuthentication=no -o KbdInteractiveAuthentication=no -t <ADMIN_USER>@<SERVER_IP> 'id && sudo -v'