Designing a Minimal, Secure CentOS Production Deployment

Problem and Takeaway

The goal is to deploy a production‑ready CentOS system that remains secure, updatable, and observable without unnecessary complexity. The minimal design must enforce SELinux, use signed repositories, lock down network traffic with firewalld, and configure systemd for reliable restarts.

Requirements

Identify the essential constraints before any design decision:

• SELinux must run in enforcing mode on every node.
• All repository metadata must be verified with GPG signatures.
• Network access should be limited to required services via firewalld zones.
• Systemd units must guarantee restart on failure and bounded start‑up time.

Minimal Design

Trust and Data Boundaries

SELinux enforcing mode isolates processes from each other and from the kernel. On CentOS 7 the policy set is frozen, while CentOS 8+ supports modular policy updates, which can affect compatibility with custom modules. Therefore the smallest reliable deployment pins the policy version to the distribution release.

Yum or dnf pulls package metadata from remote servers; the integrity of that metadata is guaranteed only when the local GPG keyring contains the correct signing key. A missing or corrupted keyring causes all repository operations to fail, blocking updates.

firewalld defines trust boundaries through zones. The default public zone blocks all inbound traffic, so any service that must be reachable requires an explicit rule. Legacy iptables rules can override firewalld, creating inconsistent firewall state that is difficult to audit.

Operational Checks

1. Confirm SELinux status:

sestatus

Look for Current mode: enforcing and verify that the loaded policy matches the distribution version.

2. Validate repository signing:

yum repolist

Ensure no GPG error messages appear and that package metadata downloads successfully.

3. Inspect firewalld configuration:

firewall-cmd --list-all

Check that the intended services are permitted in the active zone and that no unexpected ports are open.

4. Review systemd unit directives:

systemctl cat .service

Confirm Restart=on-failure and a reasonable TimeoutStartSec= value; on CentOS 7 the default systemd lacks TimeoutStartSec, which can cause missed restarts after kernel upgrades.

Failure Modes and Design Changes

Several conditions can invalidate the minimal design:

• Running on CentOS 7 with a kernel older than 3.10 may lack recent SELinux policy fixes, increasing the risk of denial‑of‑service via unconfined processes.
• Removal of /etc/pki/rpm-gpg or changes to its permissions will cause yum/dnf to reject all repository metadata, leading to update outages.
• If legacy iptables rules are loaded after firewalld, inbound ports may become reachable despite SELinux policies, creating a security gap that is hard to detect.

When any of these situations arise, the design must be adjusted—e.g., upgrade the kernel, restore the GPG keyring, or migrate to a pure firewalld configuration.

Example Configuration

SELinux

# Ensure SELinux is enforcing
sudo setenforce 1
sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config

Yum Repository Setup (example)

# Import the upstream GPG key
sudo rpm --import https://example.com/repo/RPM-GPG-KEY.example

After import, run yum repolist to verify that the repository appears without GPG errors.

firewalld Zone Configuration

# Create a custom zone for a web service
sudo firewall-cmd --permanent --new-zone=web
sudo firewall-cmd --permanent --zone=web add-service=http
sudo firewall-cmd --permanent --zone=web setRichRule='rule family="ipv4" source address="10.0.0.0/8" port port="80" protocol="tcp" accept'
sudo firewall-cmd --reload

Verify with firewall-cmd --list-all --zone=web.

systemd Unit Example

[Unit]
Description=My Application Service
After=network.target

[Service]
ExecStart=/usr/local/bin/myapp
Restart=on-failure
TimeoutStartSec=30

[Install]
WantedBy=multi-user.target

Enable and start the unit:

sudo systemctl enable myapp.service
sudo systemctl start myapp.service

Verification Checklist

1. Run sestatus and confirm enforcing mode.
2. Execute yum repolist after any repository change; ensure no GPG errors.
3. Check firewalld rules with firewall-cmd --list-all for the intended zone.
4. Inspect the systemd unit with systemctl cat and verify Restart and Timeout settings.

Limitations

The minimal design assumes a recent kernel that includes the latest SELinux policy for the distribution version. Older CentOS 7 kernels may miss critical policy updates, so regular kernel and policy updates are recommended. Additionally, the approach relies on firewalld being the sole firewall; if iptables rules persist, audit logs may show conflicting allow/deny entries.

Conclusion

By enforcing SELinux, using signed repositories, locking down network traffic with firewalld zones, and configuring systemd for reliable restarts, you achieve a secure, maintainable CentOS production environment. Regular verification commands keep the trust boundaries intact, and the design can be adapted when kernel, policy, or firewall conditions change.