> For the complete documentation index, see [llms.txt](https://help.sentinelsoftware.com/sentinel-help-center/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.sentinelsoftware.com/sentinel-help-center/installation-and-updates/host-server-setup-rhel-centos-9.md).

# Host Server Setup RHEL/CentOS 9

### Installation Prerequisites  

* VM with Linux x64 installed - RedHat, CentOS, Oracle Linux 9
* Root access to the server
* The Domain name (For accessing the Sentinel Application)
* SSL Certificate for Domain 
* SMTP Server Credentials

<details>

<summary>NGINX Server Installation (Step One)</summary>

#### **To install NGINX, run the following command:** &#x20;

```bash
sudo dnf install nginx
```

#### **Add NGINX to the firewall:**&#x20;

```bash
firewall-cmd --zone=public --add-service=http --permanent
firewall-cmd --zone=public --add-service=https --permanent
```

#### **Reload the firewall and verify that HTTP and HTTPS protocols are allowed:** &#x20;

```shell
firewall-cmd --reload
firewall-cmd --list-services –zone=public
```

#### **Update the  SELINUX Policy to allow interconnection from NGINX to Sentinel:**&#x20;

```shell
setsebool -P httpd_can_network_connect 1
```

#### **Create \`sentinel.conf\` in nginx config folder:**

```
touch /etc/nginx/conf.d/sentinel.conf
```

#### **Add the following:**

```nginx
upstream sentinel {
	server 127.0.0.1:8787;
}

proxy_cache_path /var/cache/nginx/sentinel levels=1:2 keys_zone=sentinel_cache:50m max_size=1g inactive=60m use_temp_path=off;

server {
	listen 80;
	listen [::]:80;
	server_name sentinel.yourdomain.com;

	return 301 https://$host$request_uri;
}

server {
	listen 443 ssl http2;
	listen [::]:443 ssl http2;
	server_name sentinel.yourdomain.com;

	ssl_certificate /path/to/sentinel.certificate;
	ssl_certificate_key /path/to/sentinel.certificate.private_key;

	ssl_session_timeout 1d;
	ssl_session_cache shared:MozSSL:30m;
	ssl_session_tickets off;

# curl https://ssl-config.mozilla.org/ffdhe2048.txt > /path/to/dhparam.pem
# ssl_dhparam /path/to/dhparam.pem;

	# intermediate configuration
	ssl_protocols TLSv1.2 TLSv1.3;
	ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
	ssl_prefer_server_ciphers off;

	# HSTS (ngx_http_headers_module is required) (63072000 seconds)
	add_header Strict-Transport-Security “max-age=63072000” always;

	# OCSP stapling
	#ssl_stapling on;
	#ssl_stapling_verify on;

	# verify chain of trust of OCSP response using Root CA and Intermediate certs
	#ssl_trusted_certificate /path/to/root_CA_cert_plus_intermediates;

	# replace with the IP address of your resolver
	resolver 8.8.8.8;

	gzip on;
	gzip_vary on;
	gzip_proxied any;
	gzip_comp_level 7;
	gzip_buffers 32 128k;
	gzip_http_version 1.1;
	gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

	location /_ping {
		proxy_set_header Host $http_host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header Accept-Encoding $http_accept_encoding;

		proxy_pass http://sentinel;
	}

	location /static/ {
		proxy_set_header Host $http_host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header Accept-Encoding $http_accept_encoding;

		proxy_cache sentinel_cache;
		proxy_ignore_headers Cache-Control;
		proxy_cache_lock on;
		proxy_cache_valid any 24h;
		add_header X-Cache-Status $upstream_cache_status;

		proxy_pass http://sentinel;
	}

	location / {
		proxy_set_header Host $http_host;
		proxy_set_header X-Real-IP $remote_addr;
		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-Proto $scheme;
		proxy_set_header Accept-Encoding $http_accept_encoding;

		if ($request_method = ‘OPTIONS’) {
			add_header ‘Access-Control-Allow-Origin’ ‘https://sentinel.yourdomain.com’;
			add_header ‘Access-Control-Allow-Methods’ ‘GET, POST, OPTIONS’;

			add_header ‘Access-Control-Allow-Headers’ ‘DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization’;
			add_header ‘Access-Control-Max-Age’ 1728000;
			add_header ‘Content-Type’ ‘text/plain charset=UTF-8’;
			add_header ‘Content-Length’ 0;
			return 204;
		}

		if ($request_method = ‘POST’) {
			add_header ‘Access-Control-Allow-Origin’ ‘https://sentinel.yourdomain.com’;
			add_header ‘Access-Control-Allow-Methods’ ‘GET, POST, OPTIONS’;
			add_header ‘Access-Control-Allow-Headers’ ‘DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Authorization’;
		}

		proxy_pass http://sentinel;
	}
}

```

#### **Replace the following:**

* **Sentinel Domain –**  `sentinel.yourdomain.com`
* **Certificate / Chained Certificates –** `/path/to/sentinel.certificate`
* **Certificate Private Key –** `/path/to/sentinel.certificate.private_key`

#### **Verify that the folder exists and is owned by the NGINX User -** \`**/var/cache/nginx/sentinel\`**

```shell
mkdir -p /var/cache/nginx/sentinel
chown -R nginx:root /var/cache/nginx/sentinel
chmod 0700 /var/cache/nginx/sentinel
```

#### **Enable NGINX SYSTEMD Service: Start service / check status:**

```shell
systemctl enable nginx
systemctl restart nginx
systemctl status nginx
```

</details>

<details>

<summary><strong>Java Runtime Environment (Step Two)</strong></summary>

Sentinel requires Java Runtime Environment (JRE). Long Term Supported OpenJDK 21 or later is preferred.&#x20;

#### eInstall via Package Manager:

```shell
dnf install jdk-21-headless
```

#### **Check Java Version:**&#x20;

```shell
java -version
```

</details>

<details>

<summary><strong>PostgreSQL Database (Step Four)</strong>  </summary>

Sentinel requires the PostgreSQL 17+ database to be installed. Follow this article for [**PostgreSQL installation instructions**](https://www.postgresql.org/download/linux/redhat/).&#x20;

#### Run the following to add a PostgreSQL Repository to the package manager and install PostgreSQL:

```shell
# Add postgresql repo
sudo dnf install -y https://download.postgresql.org/pub/repos/yum/reporpms/EL-9-x86_64/pgdg-redhat-repo-latest.noarch.rpm

# Disable the built-in PostgreSQL module
sudo dnf -qy module disable postgresql

# Install PostgreSQL:
sudo dnf install -y postgresql17-server postgresql17-contrib postgresql17

sudo /usr/pgsql-17/bin/postgresql-17-setup initdb
sudo systemctl enable postgresql-17
sudo systemctl start postgresql-17

```

#### **Check that the default SYSTEMD service is stopped:**

```
systemctl stop postgresql-17.service
systemctl status postgresql-17.service
```

#### **Copy the default service file into etc directory:** &#x20;

```shell
sudo systemctl edit postgresql-17.service

# Add following lines to configure data directory for postgresql
# For example /opt/pgdata/
[Service]
Environment=PGDATA=/opt/pgdata/
```

#### **Create PostgreSQL data directory and set owner to PostgreSQL User:**

```shell
mkdir -p /opt/pgdata
chown postgres:postgres /opt/pgdata
```

#### **Reload the SYSTEMD Daemon and start Postgre-SNT service:** &#x20;

```shell
systemctl daemon-reload
systemctl status postgresql-17
```

#### **Init PostgreSQL data directory:** &#x20;

```shell
sudo /usr/pgsql-17/bin/postgresql-17-setup initdb postgresql-17
```

#### **Navigate to the data directory and add the following directives to the `postgresql.conf` file:** &#x20;

```ini
# bind to localhost IP address or change to local network address in case
# Sentinel server and DB server uses separate VM
listen_addresses = ‘127.0.0.1’

# set strong password encryption
password_encryption = scram-sha-256
```

#### **Edit pg\_hba.conf file in PostgreSQL data directory to allow connections from the Sentinel server:** &#x20;

```ini
# Use localhost IP or local network address if separate VM’s are used
host sentinel dean 127.0.0.1/32 scram-sha-256
```

#### **Start PostgreSQL instance using SYSTEMD and check status:**&#x20;

```shell
systemctl start postgresql-17
systemctl status postgresql-17
systemctl enable postgresql-17
```

#### **Create a database and list databases to ensure that it was created:** &#x20;

```shell
sudo -u postgres createdb sentinel
sudo -u postgres psql -l
sudo -u postgres psql sentinel -c "CREATE EXTENSION IF NOT EXISTS btree_gin;"
```

#### **Create a user dean, set a password, and grant access to the Sentinel database:** &#x20;

```bash
sudo -u postgres createuser dean
sudo -u postgres psql -c "ALTER USER dean WITH ENCRYPTED PASSWORD 'SetPassword';"
sudo -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE sentinel to dean;"
```

#### PostgreSQL version 15+:

In case of PostgreSQL version 15 and above additional permissions should be granted:

<pre class="language-bash"><code class="lang-bash"><strong>sudo -u postgres psql -c "GRANT ALL ON SCHEMA public TO dean;"
</strong></code></pre>

#### **Replace '**&#x53;etPasswor&#x64;**' with a preferable password. Verify that users can connect:** &#x20;

```shell
psql -U dean --host 127.0.0.1 sentinel -c "Select 1;"
```

#### **Optional - Create a `.pgpass` file in `/root` folder to be able to automatically pass connection settings to backup scripts:**&#x20;

```shell
echo "127.0.0.1:5432:sentinel:dean:SetPassword" > /root/.pgpass
chmod 0600 /root/.pgpass
```

</details>

<details>

<summary><strong>Setup Sentinel Server (Step Five)</strong> </summary>

#### Create a folder for Sentinel Software, usually /opt/sentinel  :

```shell
mkdir -p /opt/sentinel
```

#### **Copy the Sentinel server file to /opt/sentinel/ and create SYMLINK:** &#x20;

```shell
cd /opt/sentinel
ln -sf sentinel-23.3.1.jar sentinel.jar
```

#### **Create a service file for the Sentinel server:** &#x20;

```
touch /etc/systemd/system/sentinel.service
```

#### **Add the following content to the file and set credentials for PostgreSQL:**  &#x20;

```systemd
[Unit]
Description=Seninel Server daemon

[Service]
#User=userowner
Type=simple
Restart=always
# Use following line for local PostgreSQL
After=postgres-snt.service

Environment=DB_NAME=sentinel
Environment=DB_USER=dean
Environment=DB_PASSWORD=SetPassword
Environment=DB_HOST=127.0.0.1
Environment=DB_PORT=5432

ExecStart=/usr/bin/java -Xms4g -Xmx16g -jar /opt/sentinel/sentinel.jar start --port 8787 --hostname 127.0.0.1

[Install]
WantedBy=multi-user.target
```

#### **Update SYSTEMD configuration and enable the Sentinel server:** &#x20;

```shell
systemctl daemon-reload
systemctl enable sentinel.service
```

#### **Using your License Key and PostgreSQL database credentials, run Sentinel's INIT job:**&#x20;

```
DB_NAME=sentinel DB_PASSWORD=SetPassword DB_HOST=127.0.0.1 DB_PORT=5432 \ 
java -jar sentinel.jar register --license-key "Your-licence-key"
```

#### **Using an email, create the first account with admin level access:**&#x20;

```shell
DB_NAME=sentinel DB_PASSWORD=SetPassword DB_HOST=127.0.0.1 DB_PORT=5432 \
java -jar sentinel.jar create_user --email "admin@your.domain"
```

#### **Start the Sentinel server and check status:** &#x20;

```shell
systemctl start sentinel.service
systemctl status sentinel.service
```

#### **Using a Chrome browser (required), enter the Sentinel domain to load the application.** &#x20;

</details>