Installing AlmaLinux 9: Complete Step-by-Step Guide

Introduction

AlmaLinux 9 represents the latest evolution in enterprise-grade Linux distributions, offering a robust, stable, and community-driven alternative to traditional enterprise Linux solutions. As a 1:1 binary compatible fork of Red Hat Enterprise Linux (RHEL), AlmaLinux provides the reliability and security features required for production environments while maintaining complete compatibility with existing RHEL-based applications and workflows.

System Requirements

Before beginning the installation process, ensure your hardware meets these minimum requirements:

Minimum Requirements

CPU: 2 GHz 64-bit processor (x86_64)
RAM: 2 GB (4 GB recommended for graphical installation)
Storage: 20 GB available disk space
Network: Ethernet or wireless adapter

Recommended Requirements for Production

CPU: Multi-core 64-bit processor with virtualization support
RAM: 8 GB or more
Storage: 50 GB or more (SSD recommended)
Network: Gigabit Ethernet

Pre-Installation Checklist

Backup existing data from any drives that will be used
Download AlmaLinux 9 ISO from the official website
Verify ISO checksum for integrity
Create installation media (USB or DVD)
Document network settings (IP address, gateway, DNS)
Plan disk partitioning scheme
Gather hardware information for compatibility check

Downloading AlmaLinux 9

Official Download Sources

Visit the official AlmaLinux website and select the appropriate ISO:

# Download minimal ISO (recommended for servers)
wget https://repo.almalinux.org/almalinux/9/isos/x86_64/AlmaLinux-9-latest-x86_64-minimal.iso

# Download DVD ISO (includes more packages)
wget https://repo.almalinux.org/almalinux/9/isos/x86_64/AlmaLinux-9-latest-x86_64-dvd.iso

# Download boot ISO (network installation)
wget https://repo.almalinux.org/almalinux/9/isos/x86_64/AlmaLinux-9-latest-x86_64-boot.iso

Verifying ISO Integrity

# Download checksum file
wget https://repo.almalinux.org/almalinux/9/isos/x86_64/CHECKSUM

# Verify SHA256 checksum
sha256sum -c CHECKSUM 2>&1 | grep OK

Creating Installation Media

USB Installation Media (Linux)

# Identify USB device
lsblk

# Write ISO to USB (replace /dev/sdX with your device)
sudo dd if=AlmaLinux-9-latest-x86_64-dvd.iso of=/dev/sdX bs=4M status=progress oflag=direct

# Sync to ensure write completion
sync

USB Installation Media (Windows)

Use tools like Rufus or Etcher:

Download and install Rufus
Select the AlmaLinux ISO
Choose your USB drive
Select “DD Image” mode
Click “Start” to create bootable media

Boot Configuration

BIOS/UEFI Settings

Access BIOS/UEFI (usually F2, F10, F12, or DEL during boot)
Disable Secure Boot (if necessary)
Set boot priority to USB/DVD
Enable virtualization extensions (Intel VT-x/AMD-V)
Save and exit

Installation Process

Starting the Installer

Boot from installation media
Select “Install AlmaLinux 9” from the boot menu
Choose installation language
Wait for the installer to load

Installation Summary Screen

The main installation hub presents several configuration options:

1. Localization Settings

Keyboard Layout:

# Add multiple keyboard layouts if needed
# Primary: English (US)
# Secondary: Your local layout

Language Support:

Select primary language
Add additional languages as needed

Time & Date:

Choose timezone
Enable NTP synchronization
Configure NTP servers

2. Software Selection

Base Environment Options:

Server: Minimal installation for servers
Server with GUI: Includes GNOME desktop
Workstation: Development workstation
Custom Operating System: Minimal base
Virtualization Host: KVM virtualization platform

Add-On Software:

Development Tools
System Administration Tools
Security Tools
Container Management
Network File System Client

3. Installation Destination

Disk Selection:

Select target disk(s)
Choose partitioning method:
- Automatic partitioning
- Custom partitioning (recommended for production)

Custom Partitioning Guide

Standard Partition Scheme

# Boot partition
/boot          - 1 GB    - ext4  - Primary
/boot/efi      - 512 MB  - EFI   - (UEFI systems only)

# System partitions
/              - 20 GB   - xfs   - Primary
/home          - Variable - xfs  - Primary
/var           - 10 GB   - xfs   - Primary
/var/log       - 5 GB    - xfs   - Primary
/tmp           - 5 GB    - xfs   - Primary
swap           - RAM size - swap - Primary

LVM Partition Scheme (Recommended)

# Physical partitions
/boot          - 1 GB    - ext4  - Standard Partition
/boot/efi      - 512 MB  - EFI   - Standard Partition (UEFI)

# LVM Configuration
Physical Volume - Remaining space

# Volume Group: vg_almalinux
Logical Volumes:
lv_root        - 20 GB   - xfs   - /
lv_home        - Variable - xfs  - /home
lv_var         - 10 GB   - xfs   - /var
lv_varlog      - 5 GB    - xfs   - /var/log
lv_tmp         - 5 GB    - xfs   - /tmp
lv_swap        - RAM size - swap - swap

Network Configuration

Hostname Setting

# Set FQDN
server01.example.com

Network Interface Configuration

Enable network interface
Configure IPv4:
- DHCP (automatic)
- Manual (static IP)

Static IP Configuration:

IP Address: 192.168.1.100
Netmask: 255.255.255.0
Gateway: 192.168.1.1
DNS Servers: 8.8.8.8, 8.8.4.4

Security Configuration

Root Password

Set a strong root password following these guidelines:

Minimum 12 characters
Mix of uppercase, lowercase, numbers, and symbols
Avoid dictionary words

User Creation

Create an administrative user:

Username: admin
Full name: System Administrator
Password: [strong password]
[x] Make this user administrator

Begin Installation

Review all settings
Click “Begin Installation”
Monitor installation progress
Wait for completion (15-30 minutes typically)

Post-Installation Configuration

First Boot Tasks

1. System Update

# Update system packages
sudo dnf update -y

# Reboot if kernel was updated
sudo systemctl reboot

2. Enable SELinux

# Check SELinux status
getenforce

# Set to enforcing mode
sudo setenforce 1

# Make permanent
sudo sed -i 's/SELINUX=permissive/SELINUX=enforcing/' /etc/selinux/config

3. Configure Firewall

# Enable firewall
sudo systemctl enable --now firewalld

# Check status
sudo firewall-cmd --state

# Add necessary services
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https

# Reload firewall
sudo firewall-cmd --reload

4. Configure Time Synchronization

# Enable chronyd
sudo systemctl enable --now chronyd

# Check synchronization
chronyc sources -v

# Configure timezone
sudo timedatectl set-timezone America/New_York

Essential Package Installation

# Install essential tools
sudo dnf install -y \
    vim \
    wget \
    curl \
    git \
    htop \
    net-tools \
    bind-utils \
    tcpdump \
    telnet \
    tree \
    bash-completion

# Install development tools
sudo dnf groupinstall -y "Development Tools"

# Install system monitoring tools
sudo dnf install -y \
    sysstat \
    iotop \
    iftop \
    ncdu

SSH Configuration

# Backup original configuration
sudo cp /etc/ssh/sshd_config /etc/ssh/sshd_config.bak

# Edit SSH configuration
sudo vim /etc/ssh/sshd_config

Recommended SSH settings:

# Disable root login
PermitRootLogin no

# Use SSH protocol 2 only
Protocol 2

# Disable password authentication (after setting up keys)
PasswordAuthentication no

# Set idle timeout
ClientAliveInterval 300
ClientAliveCountMax 2

# Restrict SSH access to specific users
AllowUsers admin

Apply changes:

# Restart SSH service
sudo systemctl restart sshd

Repository Configuration

Enable EPEL Repository

# Install EPEL release
sudo dnf install -y epel-release

# Update repository cache
sudo dnf makecache

Enable PowerTools/CRB Repository

# Enable CRB (CodeReady Builder)
sudo dnf config-manager --set-enabled crb

# Verify enabled repositories
sudo dnf repolist

System Hardening

1. Kernel Security Parameters

# Edit sysctl configuration
sudo vim /etc/sysctl.d/99-security.conf

Add security parameters:

# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

# Ignore send redirects
net.ipv4.conf.all.send_redirects = 0

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0

# Log Martians
net.ipv4.conf.all.log_martians = 1

# Ignore ICMP ping requests
net.ipv4.icmp_echo_ignore_broadcasts = 1

# Apply settings
sudo sysctl -p /etc/sysctl.d/99-security.conf

2. Audit System Configuration

# Install audit daemon
sudo dnf install -y audit

# Enable and start auditd
sudo systemctl enable --now auditd

# Check audit status
sudo auditctl -s

Performance Tuning

1. Tuned Profile Selection

# Install tuned
sudo dnf install -y tuned

# Enable and start tuned
sudo systemctl enable --now tuned

# List available profiles
tuned-adm list

# Set appropriate profile
sudo tuned-adm profile throughput-performance  # For servers
# OR
sudo tuned-adm profile virtual-guest  # For VMs

2. Storage Optimization

# Enable fstrim for SSDs
sudo systemctl enable --now fstrim.timer

# Configure mount options in /etc/fstab
# Add noatime for better performance
UUID=xxx / xfs defaults,noatime 0 0

Troubleshooting Installation Issues

Common Problems and Solutions

1. Installation Media Not Detected

Verify ISO integrity
Recreate installation media
Try different USB port
Check BIOS boot settings

2. Disk Not Visible

# Check disk detection
lsblk
fdisk -l

# Load storage drivers if needed
modprobe <driver_name>

3. Network Configuration Issues

# Check network interfaces
ip addr show

# Test connectivity
ping -c 4 8.8.8.8

# Check DNS resolution
nslookup google.com

4. Package Installation Failures

# Clean DNF cache
sudo dnf clean all

# Rebuild cache
sudo dnf makecache

# Check for broken dependencies
sudo dnf check

Best Practices

Documentation: Keep detailed records of:
- System configuration
- Installed packages
- Custom modifications
- Network settings
Backup Strategy:
- Configure regular system backups
- Test restore procedures
- Document backup locations
Security Measures:
- Regular security updates
- Monitor system logs
- Implement intrusion detection
- Use strong passwords
Monitoring Setup:
- Configure system monitoring
- Set up log rotation
- Implement alerting

Conclusion

Installing AlmaLinux 9 provides a solid foundation for enterprise workloads. This guide covered the complete installation process from initial planning through post-installation hardening. Following these steps ensures a secure, optimized, and production-ready AlmaLinux system.

Remember to:

Keep the system updated
Monitor security advisories
Maintain proper documentation
Test changes in non-production environments first

With AlmaLinux 9 properly installed and configured, you have a robust platform ready for deploying applications, services, and workloads in enterprise environments.