Iñigo GonzálezIT Operations · Infra

GuíasGuides · Nivel 2Level 2

Red Hat Enterprise Linux: registrar, parchear y controlar servicios, firewall y SELinuxRed Hat Enterprise Linux: registering, patching, and managing services, the firewall and SELinux

Lo que haces en un RHEL recién entregado y lo que repites cada mes: suscripción, dnf, systemd, journalctl, firewalld y los dos comandos de SELinux que evitan desactivarlo.What you do on a freshly delivered RHEL and what you repeat every month: subscription, dnf, systemd, journalctl, firewalld, and the two SELinux commands that save you from turning it off.

Nivel 2Level 2 · Red Hat Enterprise LinuxRed Hat Enterprise Linux · 4 min4 min read · ActualizadoUpdated 21 oct 202621 Oct 2026

Qué vas a conseguir

Saber manejar un servidor RHEL (o Rocky/Alma, que son compatibles) para lo que se pide en operaciones: que esté registrado y reciba parches, que los servicios arranquen y se vigilen, que el firewall deje pasar solo lo necesario, y que SELinux siga activado aunque una aplicación proteste.

Antes de empezar

  • Acceso por SSH con un usuario que tenga sudo. No trabajes como root directamente.
  • La cuenta o la clave de activación de Red Hat para registrar el sistema (la tiene quien gestione las suscripciones).
  • Saber qué servicios debe dar ese servidor (web, base de datos, aplicación) y en qué puertos: es lo que decide el firewall.

1. Registrar y parchear

bash · servidor RHEL
sudo subscription-manager register --org 1234567 --activationkey rhel9-serversThe system has been registered with ID: 8a1c...-...-...sudo subscription-manager statusOverall Status: Currentsudo dnf check-update | tail -n +2 | wc -l47sudo dnf update -y...Complete!sudo dnf needs-restarting -rCore libraries or services have been updated since boot-up:  * kernelReboot is required to fully utilize these updates.

needs-restarting -r es lo que te dice si el parche necesita reinicio (kernel, glibc, systemd). Un servidor parcheado y sin reiniciar sigue corriendo el kernel viejo. Planifica el reinicio en la ventana de cambios y apúntalo en el ticket.

Para parchear solo seguridad (lo habitual fuera de la ventana mensual): sudo dnf update --security -y.

2. Servicios con systemd

bash · servidor RHEL
systemctl status httpd --no-pager● httpd.service - The Apache HTTP Server     Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; preset: disabled)     Active: failed (Result: exit-code) since Wed 2026-10-21 08:02:11 CEST; 3min agosudo journalctl -u httpd -n 20 --no-pageroct 21 08:02:11 srv-web-01 httpd[1842]: (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:8081sudo systemctl enable --now httpd      # activar al arranque y arrancar ahorasystemctl is-enabled httpd; systemctl is-active httpdenabledactive

Las cuatro órdenes que usarás todos los días: status, restart, enable --now y journalctl -u <servicio>. journalctl -p err -b muestra todos los errores desde el último arranque, de cualquier servicio; journalctl -f los sigue en vivo.

3. Firewall: firewalld

En RHEL el firewall es firewalld, con zonas y servicios con nombre. Lo que no está abierto, está cerrado.

bash · servidor RHEL
sudo firewall-cmd --get-default-zonepublicsudo firewall-cmd --list-allpublic (active)  interfaces: ens192  services: cockpit dhcpv6-client ssh  ports:sudo firewall-cmd --add-service=http --add-service=https --permanentsudo firewall-cmd --add-port=8081/tcp --permanentsudo firewall-cmd --reloadsudo firewall-cmd --list-services --list-portscockpit dhcpv6-client http https ssh8081/tcp

--permanent escribe la regla a disco; sin --reload no se aplica. Prueba desde fuera con nc -zv srv-web-01 8081 o Test-NetConnection desde Windows. Y antes de tocar ssh en el firewall, ten otra sesión abierta.

4. SELinux: no lo desactives

El error del paso 2 (Permission denied al abrir el puerto 8081) no es el firewall ni los permisos del fichero: es SELinux, que solo permite a Apache escuchar en los puertos etiquetados como http_port_t. La solución correcta es decírselo, no apagarlo.

bash · servidor RHEL
getenforceEnforcingsudo sealert -a /var/log/audit/audit.log | grep -A3 "httpd"     # instala setroubleshoot-server si no estáSELinux is preventing /usr/sbin/httpd from name_bind access on the tcp_socket port 8081.*****  Plugin bind_ports (92.2 confidence) suggests   ************************If you want to allow /usr/sbin/httpd to bind to network port 8081Then you need to modify the port type.Do: # semanage port -a -t http_port_t -p tcp 8081sudo semanage port -a -t http_port_t -p tcp 8081sudo systemctl restart httpd && systemctl is-active httpdactive

Los dos comandos que resuelven el 90 %: semanage port para puertos y restorecon -Rv /ruta para ficheros con contexto incorrecto (los que se copiaron desde otro sitio y Apache no puede leer). Los booleanos (getsebool -a | grep httpd, setsebool -P httpd_can_network_connect on) cubren el resto. setenforce 0 solo sirve para confirmar en un minuto que es SELinux; después vuelve a 1 y arregla el contexto.

5. Lo que miras cada mes

  • subscription-manager status y dnf check-update: que sigue registrado y cuánto hay pendiente.
  • needs-restarting -r tras parchear, y el reinicio en la ventana.
  • journalctl -p err -S "1 month ago" --no-pager | tail: errores repetidos que nadie ha mirado.
  • df -h y el script de la guía de Bash en cron.
  • Con Red Hat Insights (incluido en la suscripción), los sistemas registrados aparecen en console.redhat.com con CVE pendientes y recomendaciones; es el informe que llevas a la reunión de parcheo.

Siguientes pasos

  • Con más de cinco servidores, el parcheo mensual se hace con Ansible (Nivel 3): un playbook con dnf update y reinicio controlado, servidor a servidor.
  • Mira Cockpit (https://srv-web-01:9090): la consola web que viene con RHEL para ver servicios, logs y actualizaciones sin SSH.
  • La guía de Ubuntu cubre lo mismo con apt, ufw y AppArmor: las diferencias son menos de lo que parece.

¿Falta algo o en tu entorno es distinto? Escríbeme y lo corrijo.

What you'll get

Handle a RHEL server (or Rocky/Alma, which are compatible) for what operations asks of you: it is registered and receives patches, services start and are watched, the firewall lets through only what is needed, and SELinux stays on even when an application complains.

Before you start

  • SSH access with a user that has sudo. Don't work directly as root.
  • The Red Hat account or activation key to register the system (whoever manages subscriptions has it).
  • Know which services that server must provide (web, database, application) and on which ports: that is what decides the firewall.

1. Register and patch

bash · RHEL server
sudo subscription-manager register --org 1234567 --activationkey rhel9-serversThe system has been registered with ID: 8a1c...-...-...sudo subscription-manager statusOverall Status: Currentsudo dnf check-update | tail -n +2 | wc -l47sudo dnf update -y...Complete!sudo dnf needs-restarting -rCore libraries or services have been updated since boot-up:  * kernelReboot is required to fully utilize these updates.

needs-restarting -r is what tells you whether the patch needs a reboot (kernel, glibc, systemd). A patched server that has not rebooted is still running the old kernel. Schedule the reboot in the change window and note it in the ticket.

To patch security only (the usual outside the monthly window): sudo dnf update --security -y.

2. Services with systemd

bash · RHEL server
systemctl status httpd --no-pager● httpd.service - The Apache HTTP Server     Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; preset: disabled)     Active: failed (Result: exit-code) since Wed 2026-10-21 08:02:11 CEST; 3min agosudo journalctl -u httpd -n 20 --no-pagerOct 21 08:02:11 srv-web-01 httpd[1842]: (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:8081sudo systemctl enable --now httpd      # enable at boot and start nowsystemctl is-enabled httpd; systemctl is-active httpdenabledactive

The four commands you'll use every day: status, restart, enable --now and journalctl -u <service>. journalctl -p err -b shows every error since the last boot, from any service; journalctl -f follows them live.

3. Firewall: firewalld

On RHEL the firewall is firewalld, with zones and named services. What is not open is closed.

bash · RHEL server
sudo firewall-cmd --get-default-zonepublicsudo firewall-cmd --list-allpublic (active)  interfaces: ens192  services: cockpit dhcpv6-client ssh  ports:sudo firewall-cmd --add-service=http --add-service=https --permanentsudo firewall-cmd --add-port=8081/tcp --permanentsudo firewall-cmd --reloadsudo firewall-cmd --list-services --list-portscockpit dhcpv6-client http https ssh8081/tcp

--permanent writes the rule to disk; without --reload it is not applied. Test from outside with nc -zv srv-web-01 8081 or Test-NetConnection from Windows. And before touching ssh in the firewall, keep a second session open.

4. SELinux: don't turn it off

The error in step 2 (Permission denied opening port 8081) is neither the firewall nor file permissions: it is SELinux, which only lets Apache listen on ports labelled http_port_t. The right fix is to tell it, not to switch it off.

bash · RHEL server
getenforceEnforcingsudo sealert -a /var/log/audit/audit.log | grep -A3 "httpd"     # install setroubleshoot-server if missingSELinux is preventing /usr/sbin/httpd from name_bind access on the tcp_socket port 8081.*****  Plugin bind_ports (92.2 confidence) suggests   ************************If you want to allow /usr/sbin/httpd to bind to network port 8081Then you need to modify the port type.Do: # semanage port -a -t http_port_t -p tcp 8081sudo semanage port -a -t http_port_t -p tcp 8081sudo systemctl restart httpd && systemctl is-active httpdactive

The two commands that solve 90%: semanage port for ports and restorecon -Rv /path for files with the wrong context (the ones copied from elsewhere that Apache can't read). Booleans (getsebool -a | grep httpd, setsebool -P httpd_can_network_connect on) cover the rest. setenforce 0 is only for confirming in a minute that SELinux is the cause; then go back to 1 and fix the context.

5. What you look at every month

  • subscription-manager status and dnf check-update: still registered, and how much is pending.
  • needs-restarting -r after patching, and the reboot in the window.
  • journalctl -p err -S "1 month ago" --no-pager | tail: repeated errors nobody has looked at.
  • df -h and the script from the Bash guide in cron.
  • With Red Hat Insights (included in the subscription), registered systems show up at console.redhat.com with pending CVEs and recommendations; that is the report you take to the patching meeting.

Next steps

  • With more than five servers, monthly patching is done with Ansible (Level 3): a playbook with dnf update and a controlled reboot, server by server.
  • Look at Cockpit (https://srv-web-01:9090): the web console that ships with RHEL to see services, logs and updates without SSH.
  • The Ubuntu guide covers the same with apt, ufw and AppArmor: the differences are smaller than they look.

Is something missing, or different in your environment? Get in touch and I'll fix it.

Tech Career Lab · newsletter

¿Te ha servido? Cada dos semanas envío una idea práctica para perfiles IT: LinkedIn, proyectos, networking y procesos de selección.Found this useful? Every two weeks I send one practical idea for IT professionals: LinkedIn, projects, networking and hiring processes.

Apúntate y llévate las 33 ideasSign up and get the 33 ideas →