AlmaLinux 10 ARM64

Option A: Azure Portal

• Open the Azure Marketplace and search for "AlmaLinux 10 Arm64 SecureAnyCloud".
• Select the image and click Create.
• On the Basics tab, fill in these fields:
  • Subscription: select your Azure subscription
  • Resource group: create a new one or select an existing one
  • Virtual machine name: enter a name for your VM
  • Region: select a region that offers Arm sizes
  • Size: Standard_D2ps_v6 is recommended (an Arm64 size)
• Under Administrator account, select SSH public key and enter your key.
• Under Inbound port rules, allow SSH (port 22).
• Click Review + create, then Create.

Option B: Azure CLI

Run these commands on your own workstation, substituting your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the VM:

az vm image terms accept --urn sac1647283583153:almalinux-10-arm64:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-almalinux-10-arm64-vm \
  --image sac1647283583153:almalinux-10-arm64:default:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The --size must be an Arm64 size (Standard_D2ps_v6 above). Azure rejects an x86 size for an Arm image at create time.

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-almalinux-10-arm64-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check that the machine is AlmaLinux 10:

cat /etc/almalinux-release

AlmaLinux release 10.2 (Lavender Lion)

The os-release fields carry the same information in a machine-readable form, which is what configuration management tools read:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release

NAME="AlmaLinux" VERSION="10.2 (Lavender Lion)" ID="almalinux" VERSION_ID="10.2" PLATFORM_ID="platform:el10"

The distribution itself declares its RHEL compatibility lineage:

cat /etc/redhat-release

AlmaLinux release 10.2 (Lavender Lion)

Check the kernel and the page size. aarch64 confirms this is the native 64-bit Arm build, and 4096 confirms the standard 4k page size kernel:

uname -srm getconf PAGESIZE

Linux 6.12.0-211.53.1.el10_2.aarch64 aarch64 4096

Check the processor. On Azure's Arm sizes it is the Azure Cobalt 100, built on Arm Neoverse N2 cores:

lscpu | grep -E '^(Architecture|Vendor ID|Model name|BIOS Model name):'

Architecture: aarch64 Vendor ID: ARM Model name: Neoverse-N2 BIOS Model name: Cobalt 100 None CPU @ 3.4GHz

The version reported is the AlmaLinux 10 point release the image was patched to. This listing tracks the 10 major release, so dnf update rolls the machine forward across future point releases.

Every available update was applied when this image was built. dnf check-update exits 100 when updates are pending and 0 when none are. Check it:

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"

exit=0

No update is waiting on a reboot either:

dnf needs-restarting -r

No core libraries or services have been updated since boot-up. Reboot should not be necessary.

Exactly one kernel is installed, and it is the one the machine is running. Superseded kernels are removed before capture:

rpm -q kernel-core

kernel-core-6.12.0-211.53.1.el10_2.aarch64

Your update path is intact. BaseOS, AppStream, CRB (CodeReady Builder) and Extras are all enabled, which is the AlmaLinux 10 cloud image default. List the repositories:

dnf repolist --enabled

repo id repo name appstream AlmaLinux 10 - AppStream baseos AlmaLinux 10 - BaseOS crb AlmaLinux 10 - CRB extras AlmaLinux 10 - Extras

Automatic updates

The stock AlmaLinux 10 Arm64 cloud image does not include dnf-automatic. This image installs it and enables its timer, so the machine applies updates on its own schedule. Verify the timer:

systemctl is-enabled dnf-automatic.timer

enabled

systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec'

OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m

The policy applies all available updates, not only those tagged as security errata. It never reboots automatically, so a kernel update waits for a window you choose instead of restarting a production machine without warning:

grep -E '^(apply_updates|upgrade_type|download_updates|reboot) ' /etc/dnf/automatic.conf

upgrade_type = default download_updates = yes apply_updates = yes reboot = never

upgrade_type is deliberately default rather than security. A security-only policy depends on errata metadata being present for every update. Where it is missing, that policy silently applies nothing, so default is the setting that actually keeps the machine current.

Because reboot = never, check periodically whether a restart is owed after a kernel update, using the needs-restarting -r command above. To opt out of automatic updates entirely, run sudo systemctl disable --now dnf-automatic.timer.

Confirm SELinux is enforcing:

getenforce

Enforcing

Confirm the root account is locked. The L in the second field means locked:

passwd -S root

root L 2009-12-22 -1 -1 -1 -1

Confirm no account on the machine has a usable password. This prints nothing on a clean image:

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy rather than the configuration file, because the running daemon is what a client meets:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication) '

permitrootlogin no pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no

A drop-in file pins that policy. It sorts ahead of every other SSH configuration file, so a later package update to the main configuration cannot quietly loosen it:

grep -vE '^#' /etc/ssh/sshd_config.d/00-sac-hardening.conf

PermitRootLogin no PasswordAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no

There is no swap on the operating system disk, because a swap file baked into a Marketplace image is not permitted. This command prints nothing:

swapon --show

Confirm what is listening. SSH on port 22 is the only service reachable from the network. The only other socket is chronyd, bound to the loopback address for time synchronization:

ss -tln
ss -uln

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.1:323 0.0.0.0:* UNCONN 0 0 [::1]:323 [::]:*

The base operating system ships nfs-utils for NFS version 4 client mounts, which need no extra listener. The rpcbind service that NFS version 3 relies on is installed but disabled, so port 111 stays closed. Verify:

systemctl is-enabled rpcbind.socket rpcbind.service || true

disabled disabled

If you need NFS version 3, enable it with sudo systemctl enable --now rpcbind.socket and open only the ports you need in your network security group.

The Azure Linux Agent handles extensions and the portal's recovery features, and cloud-init provisions the machine. Check both:

systemctl is-active waagent rpm -q WALinuxAgent cloud-init chrony

active WALinuxAgent-2.14.0.1-3.el10.noarch cloud-init-24.4-7.el10_2.1.noarch chrony-4.8-2.el10.aarch64

Cloud-init should report done, which means provisioning finished cleanly:

cloud-init status

status: done

The kernel puts a console on ttyAMA0, the Arm PL011 serial port. This makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH. On x86 images the console is ttyS0; on Arm it is ttyAMA0:

grep -o 'console=ttyAMA0' /proc/cmdline

console=ttyAMA0

Time synchronization runs through chronyd against the Azure host clock. Your offsets will differ:

chronyc -n sources | head -4

MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* PHC0 2 3 377 9 -4633ns[-5103ns] +/- 10us

The operating system disk uses a flat layout with XFS for the root and boot filesystems:

df -h / findmnt -no SOURCE,FSTYPE,TARGET /boot

Filesystem Size Used Avail Use% Mounted on /dev/sda3 29G 1.5G 28G 6% / /dev/sda2 xfs /boot

Standard_D2ps_v6 has no local temporary disk, so there is no scratch disk at /mnt on that size. Arm sizes with a d in the name, such as Standard_D2pds_v6, add a local temporary disk. Treat anything on a temporary disk as disposable, because it is erased whenever the machine is deallocated or moved.

The Azure network security group (NSG) controls inbound and outbound traffic. It is the first, and usually the only, place you need to open a port.

firewalld is not installed on this image. Confirm:

rpm -q firewalld || echo "(firewalld absent - the Azure NSG is your only firewall)"

package firewalld is not installed (firewalld absent - the Azure NSG is your only firewall)

This matches the AlmaLinux cloud image default. With no host firewall in the way, your NSG rules take effect exactly as written, with no second layer to keep in sync. If your policy also requires a host firewall, install and enable it yourself:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Once firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service.

AppStream carries the application packages. Everything in the repositories is built for Arm, so dnf resolves aarch64 packages automatically, with nothing extra to configure:

dnf -q list --available nginx 2>/dev/null | tail -2

Available Packages nginx.aarch64 2:1.26.3-6.el10_2.6 appstream

Install a package and enable it in the usual way. For example, run sudo dnf install -y nginx, then sudo systemctl enable --now nginx, then open the port in your network security group.

To add another administrator, create the account with sudo adduser <name> and add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys. The file needs mode 600, the .ssh directory needs mode 700, and both must be owned by that user.

The image ships with no human accounts, so the administrator you named at create time is the only login until you add one. List the members of the wheel group:

getent group wheel