Amazon Linux 2023 Server Administration Guide

This is an original planning guide. It is not a vendor manual, an official standard, or legal advice. Example addresses use documentation ranges. Review every command before you paste it.

Where Amazon Linux 2023 sits

Amazon Linux 2023 is the current Amazon Linux, with dnf and a release cadence tied to AWS documentation, not to a RHEL minor and not to Amazon Linux 2. yum habits and Amazon Linux 2 repository URLs do not belong here. Read os-release and write 2023.

It is common on AWS and unusual elsewhere. The cloud companion desk covers the account and the network around the instance. This page covers the operating system: packages, users, and the firewall the image actually has. Do not assume firewalld is installed the way it is on RHEL. Check. If it is absent, the ticket says what is enforcing packet policy, including the cloud security group, and you still do not open management to the world.

SELinux is part of the family story. Check the mode. Leave enforcing in place if that is how the image booted. A lab address of 192.0.2.10/24 applies only if this host even has that network. On a cloud instance, use the address the VPC gave you and the management path you designed. Do not hard-code the documentation address into a cloud instance.

The provisioning guide and cloud-init are how these images usually wake up. Secrets stay out of user-data. The hardening guide's key-then-password order still applies.

The first hour on a lab host

Step 1 on Amazon Linux 2023 covers identity. os-release says Amazon Linux 2023. Write the support date. AL2 commands are the wrong muscle memory. The check is: The ticket says 2023. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Amazon Linux 2023 draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 2 on Amazon Linux 2023 covers admin. Named user and key, via cloud-init or by hand. No password in user-data. The provisioning guide is the file. The check is: Key login works. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Amazon Linux 2023 draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 3 on Amazon Linux 2023 covers policy. Record the security group and whatever host firewall exists. Management is not open to the world. Cloud and host both count. The check is: An address outside the management path cannot SSH. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Amazon Linux 2023 draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 4 on Amazon Linux 2023 covers SELinux. Record the mode and leave enforcing if that is the boot mode. Do not disable it to match an AL2 blog. The check is: The mode at the end matches the decision. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Amazon Linux 2023 draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

Step 5 on Amazon Linux 2023 covers updates. dnf update from the 2023 repositories. No AL2 repository line. The check is: repolist matches 2023. If that check fails, stop and fix the ticket before the next step. The way back is the previous file or the previous image, which the provisioning guide told you to keep. Do not install a second package to hide a failed step. The browser generators for Amazon Linux 2023 draft a starter. They do not log in. Read the draft, delete what this lab does not need, and replace prompt-for-this. A line that worked on a different distribution is not a reason to paste it here.

# Amazon Linux 2023 lab. Review before you paste.
# dnf. Not Amazon Linux 2. Not yum from old notes.
# Check whether firewalld is installed. Check SELinux.
# Do not hard-code 192.0.2.10 on a cloud instance.
# prompt-for-this is not a password to keep. No secrets in user-data.

The commands you will actually repeat

dnf update from Amazon Linux 2023 repositories. Read the list. Reboot when the kernel needs it. The patch ring applies even when the instance is easy to replace. An instance that holds state is not easy to replace.

Confirm the support window for this release in AWS's own documentation and file the date beside the patch guide's end-of-life note.

Security groups are not a substitute for knowing what the host itself allows, and the host firewall is not a substitute for the security group. Write both.

Do not install Amazon Linux 2 packages or enable those repositories.

What Amazon Linux 2023 is not

Amazon Linux 2023 is not Amazon Linux 2.

It is not RHEL and not Fedora, even if a package was built from a related source.

It is not a place for the documentation address 192.0.2.10 on a real VPC instance.

The hour you stop

Write the hostname, the role, and the clock time before you change Amazon Linux 2023. If this host is also serving users, it is not the lab and this first hour belongs on a spare. The provisioning guide is how the spare gets built. A change without a spare is a change you can still postpone.

Keep the console or the out-of-band path open for the whole hour. Reloading a network service, a firewall, or a secure-shell daemon from the only session is how a lab becomes a drive across town. The hardware guide names that path for a physical machine. A virtual machine uses the hypervisor console. A cloud instance uses the serial console the platform gives you. Test it before the reload, not after.

The address 192.0.2.10/24 and the gateway 192.0.2.1 are documentation. They belong in the lab note and nowhere else. On a real network, use the prefix the network desk already assigned. On a cloud instance, use the address the platform assigned and do not hard-code the documentation range into user-data. If a generator filled the documentation address into a production draft, delete it.

prompt-for-this is a reminder that a secret is missing. It is not a password you set, not a token you commit, and not a string you leave in a configuration file because the service started. The real secret lives in the password store. The ticket says who can read it. A file that still contains the reminder is a file you have not finished.

One service is enough for the first hour on Amazon Linux 2023. The purpose from the fundamentals page says which service. Every other package stays uninstalled until its own guide has a ticket. A host that enables a web server, a database, and a queue in the first hour has three changes and no proof. Finish the login, the address, and the update. Then stop.

Read the package transaction before you accept it. A count of packages is not a review. If the list contains a repository you did not add, stop. If it contains a kernel, the patch guide's reboot decision applies and the console stays open. If it contains software this role does not need, remove that line from the plan rather than installing it and disabling it later.

The previous image, the previous configuration file, or the previous package version is the rollback. Write the path down while the host still works. A rollback you invent after a failed reload is a guess. The migration guide assumes the old copy is still there. Do not delete it in the same hour to free a disk.

When the checks pass, copy the notes into the ticket and leave the host alone. The next host waits until a second person can repeat the login and the address from the notes. A fleet built from memory drifts. A fleet built from the file the provisioning guide stored stays boring, which is the point of Amazon Linux 2023 in production.

If a step on Amazon Linux 2023 fails twice, stop for the day. The failure is the result. Adding a forum command beside a half-applied config produces a host nobody can rebuild. Rebuild from the image instead. The time you lose is smaller than the time you will spend explaining the hybrid.

Hand the finished lab to the guide that matches the role: web, mail, storage, backup, or hardening. Amazon Linux 2023 being installed is not the same as the role being ready. The role guide has its own proof. Do not skip it because the package manager exited without an error.

A second person reads the hostname, the address, and the rollback path aloud before you build the next host. If they cannot find those three in the ticket, the notes are not done. Silence is not agreement. The check is the sentence they repeat back.

Store the working notes next to the image version. A month from now Amazon Linux 2023 will still boot from that pair, and the chat where you remembered a flag will be gone. The file is the memory. The host is replaceable. That is the whole point of writing this hour down.

Amazon Linux 2023 checks before a second host

Confirm this before you call the change done: Amazon Linux 2023 is the OS the hostname reports, not a neighbour you copied from. The lab address 192.0.2.10/24 is gone before this host is placed on a real network. prompt-for-this is not the password that was set, and no password is in the ticket. The named admin can log in with a key. The package manager used is the one this page names. A network file from a different distribution was not pasted in. The config test or the apply command for this network tool succeeded. The previous image or install file is kept. No new third-party repository was added in the first hour. A service you do not need was not enabled to see what it does. Console or out-of-band access works before you reload SSH. A second person read the hostname and the address. os-release says 2023, not Amazon Linux 2. user-data contains no secret. The security group and the host firewall are both described. And the support end date is filed. If one of those fails, stop.

Tools for this guide

These tools run in the browser on this site. They do not log into your machines.

Guides in this cluster

These supporting pages belong to this pillar.