AlmaLinux 8 ARM64

Option A: Azure Portal

• Navigate to the Azure Marketplace and search for "AlmaLinux 8 Arm64 SecureAnyCloud"
• Select the image and choose Create
• Configure the basics:
• Subscription: Select your Azure subscription
• Resource Group: Create new or select existing
• Virtual Machine Name: Enter a name for your VM
• Region: Select a region that offers Arm sizes
• Size: Standard_D2ps_v6 recommended (an Arm64 size)
• Under Administrator Account, select SSH public key and enter your key
• Under Inbound Port Rules, allow SSH (port 22)
• Choose Review + Create, then Create

Option B: Azure CLI

Run this on your own workstation, substituting your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:almalinux-8-arm64:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-almalinux-8-arm64-vm \
  --image sac1647283583153:almalinux-8-arm64:default:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The --size must be an Arm64 family (Standard_D2ps_v6 above). Azure rejects an x86 size for an Arm image at create time.

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-almalinux-8-arm64-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Check that the machine is AlmaLinux 8:

cat /etc/almalinux-release

AlmaLinux release 8.10 (Cerulean Leopard)

The os-release fields carry the same information in a machine-readable form, which is what configuration management tools read:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release

NAME="AlmaLinux" VERSION="8.10 (Cerulean Leopard)" ID="almalinux" VERSION_ID="8.10" PLATFORM_ID="platform:el8"

The distribution itself asserts its RHEL compatibility lineage:

cat /etc/redhat-release

AlmaLinux release 8.10 (Cerulean Leopard)

The kernel and the page size are where the architecture shows up. aarch64 confirms this is the native 64-bit Arm build, and 65536 confirms the RHEL 8 Arm kernel's 64k page size:

uname -srm getconf PAGESIZE

Linux 4.18.0-553.162.1.el8_10.aarch64 aarch64 65536

Check the processor itself, which on Azure's Arm sizes is the Azure Cobalt 100:

lscpu | grep -E '^(Architecture|Vendor ID|Model name|BIOS Model name):'

Architecture: aarch64 Vendor ID: ARM BIOS Model name: Cobalt 100

8.10 is the final AlmaLinux 8 point release, so this string does not advance. dnf update continues to deliver security errata within 8.10.

Every available update was applied when this image was built. dnf check-update exits 100 when updates are pending and 0 when none are:

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"

exit=0

Confirm that nothing is waiting on a reboot:

dnf needs-restarting -r

No core libraries or services have been updated since boot-up. Reboot should not be necessary.

Exactly one kernel is installed, the one the machine is running. Superseded kernels are removed before capture:

rpm -q kernel-core

kernel-core-4.18.0-553.162.1.el8_10.aarch64

Your update path is intact. BaseOS, AppStream and Extras are enabled, which is the AlmaLinux 8 cloud image default:

dnf repolist --enabled

repo id repo name appstream AlmaLinux 8 - AppStream baseos AlmaLinux 8 - BaseOS extras AlmaLinux 8 - Extras

AlmaLinux 8 also ships a developer repository, which this release names PowerTools (AlmaLinux 9 and 10 renamed it to CRB). It is present but disabled, as it is on the stock cloud image. Enable it when you need -devel packages that AppStream does not carry:

sudo dnf config-manager --set-enabled powertools

Automatic updates

The stock AlmaLinux 8 Arm64 cloud image does not include dnf-automatic. This image installs it and enables its timer, so the machine applies updates on its own schedule:

systemctl is-enabled dnf-automatic.timer

enabled

systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec'

OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m

The policy applies all available updates, not only those tagged as security errata. It never reboots automatically, so a kernel update waits for a window you choose instead of restarting a production machine without warning:

grep -E '^(apply_updates|upgrade_type|download_updates) ' /etc/dnf/automatic.conf

upgrade_type = default download_updates = yes apply_updates = yes

upgrade_type is deliberately default rather than security. A security-only policy depends on errata metadata being present for every update, and where it is not, it silently applies nothing. The default setting is the one that keeps the machine current. Because the tool never reboots on its own, check periodically whether a restart is owed after a kernel update, using the needs-restarting -r command above. To opt out entirely, run sudo systemctl disable --now dnf-automatic.timer.

Confirm SELinux is enforcing:

getenforce

Enforcing

Confirm the root account is locked. The LK in the second field means locked:

passwd -S root

root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.)

Confirm no account on the machine has a usable password. This prints nothing on a clean image:

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy rather than the config file, since the running daemon is what a client actually meets:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication) '

permitrootlogin no pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no

AlmaLinux 8 ships OpenSSH 8.0p1, which predates the Include /etc/ssh/sshd_config.d/*.conf directive that AlmaLinux 9 and 10 use. There is therefore no drop-in directory on this release, and the policy is pinned in the main configuration file itself:

grep -E '^(PermitRootLogin|PasswordAuthentication|KbdInteractiveAuthentication|PermitEmptyPasswords) ' /etc/ssh/sshd_config

PermitRootLogin no PasswordAuthentication no PermitEmptyPasswords no KbdInteractiveAuthentication no

If you edit /etc/ssh/sshd_config, keep those four lines, run sudo sshd -t to check your change parses, and only then sudo systemctl reload sshd.

There is no swap on the operating system disk. A swap file baked into a Marketplace image is not permitted, so this prints nothing:

swapon --show

Confirm what is listening. SSH on port 22 is the only service reachable from the network. The only other socket is chronyd, bound to the loopback address for time synchronisation:

ss -tln
ss -uln

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.1:323 0.0.0.0:* UNCONN 0 0 [::1]:323 [::]:*

The stock AlmaLinux 8 Arm64 cloud image enables rpcbind, which binds TCP and UDP port 111 on every interface for NFS version 3. This image disables it, because NFS version 4 does not need it and an unadvertised open port does not belong in a Marketplace image. nfs-utils is retained, so NFS version 4 client mounts work unchanged:

systemctl is-enabled rpcbind.socket rpcbind.service || true

disabled disabled

It is disabled, not masked, so if you need NFS version 3 you can turn it back on with sudo systemctl enable --now rpcbind.socket and open only what you need in your Network Security Group.

The Azure Linux Agent handles extensions and the portal's recovery features, and cloud-init provisions the machine:

systemctl is-active waagent rpm -q WALinuxAgent cloud-init chrony

active WALinuxAgent-2.7.0.6-8.el8_8.noarch cloud-init-23.4-7.el8_10.11.alma.2.noarch chrony-4.5-2.el8_10.aarch64

Cloud-init should report done, which means provisioning finished cleanly:

cloud-init status

status: done

The kernel puts a console on ttyAMA0, the Arm PL011 serial port, which is what makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH. On x86 images this is ttyS0; on Arm it is ttyAMA0:

grep -o 'console=ttyAMA0' /proc/cmdline

console=ttyAMA0

Time synchronisation runs through chronyd against the Azure host clock (your offsets will differ):

chronyc -n sources | head -4

MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* PHC0 2 3 377 7 +34us[ +37us] +/- 8398ns

The operating system disk uses a flat layout with XFS for the root and boot filesystems:

df -h / findmnt -no SOURCE,FSTYPE,TARGET /boot

Filesystem Size Used Avail Use% Mounted on /dev/sda3 29G 3.2G 26G 11% / /dev/sda2 xfs /boot

Standard_D2ps_v6 has no local temporary disk, so there is no scratch disk at /mnt on that size. Arm sizes with a d in the name, such as Standard_D2pds_v6, add a local temporary disk. Treat anything on a temporary disk as disposable, since it is erased whenever the machine is deallocated or moved.

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port.

Unlike the AlmaLinux 9 and 10 cloud images, the AlmaLinux 8 cloud image does install firewalld, but it ships disabled and inactive, so it is not filtering anything:

rpm -q firewalld systemctl is-enabled firewalld || true systemctl is-active firewalld || true

firewalld-0.9.11-12.el8_10.alma.1.noarch disabled inactive

With firewalld inactive, your NSG rules take effect exactly as written, with no second layer to keep in sync. If your policy requires a host firewall as well, it is already installed, so you only need to enable it:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Add the SSH rule before you reload, or you will lock yourself out of the machine. Once firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service.

AppStream carries the application packages. Everything in the repositories is built for Arm, so dnf resolves aarch64 packages automatically with nothing extra to configure:

dnf -q list --available nginx 2>/dev/null | tail -2

Available Packages nginx.aarch64 1:1.14.1-9.module_el8.10.0+4171+d7eec01b.alma.1 appstream

AlmaLinux 8 uses modules (AppStream module streams) for software that ships in several versions, which is why the package above carries a module_el8 tag. List the streams for a package and pick one before installing:

dnf module list nginx
sudo dnf module enable -y nginx:1.24
sudo dnf install -y nginx

Then enable the service with sudo systemctl enable --now nginx and open the port in your Network Security Group.

To add another administrator, create the account with sudo adduser <name>, add it to the wheel group with sudo usermod -aG wheel <name>, then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600 and the .ssh directory mode 700, owned by that user. The image ships with no human accounts at all, so the administrator you named at create time is the only login until you add one:

getent group wheel