Deployment guide

CentOS 7 Minimal

Overview

CentOS Linux is a community rebuild of Red Hat Enterprise Linux, binary compatible with RHEL 7. This guide covers deploying and configuring CentOS 7 Minimal (CentOS Linux 7.9.2009, the final CentOS 7 release, with a reduced package set) on Microsoft Azure, using SecureAnyCloud's pre-configured virtual machine image from the Azure Marketplace.

This image is provided deliberately for legacy-migration workloads. It suits teams that are moving software still certified only on the CentOS 7 / RHEL 7 platform and need a clean, hardened CentOS 7.9 base while they re-platform.

It is the Minimal variant. It is the same CentOS Linux 7.9.2009 as SecureAnyCloud's standard CentOS 7 image, with the packages that an Azure guest cannot use removed. If you want the standard package set, use that image instead. The two are separate listings, and you can run both.

End-of-life notice: read this first

CentOS Linux 7 reached end-of-life on 30 June 2024. The upstream CentOS Project no longer produces any updates for it, including security updates. Consequently:

This image is patched only to its capture date, from the frozen CentOS 7.9.2009 vault (vault.centos.org). The vault's updates repository was last published on 21 June 2024, nine days before end-of-life, and nothing has been added to it since. "Fully patched" therefore means patched to the last packages that will ever exist for this release.
After the end-of-life date, no further upstream security updates are published. Over time the image will carry unpatched vulnerabilities that you cannot remediate by updating CentOS 7, because upstream ships nothing further.
This image is provided for legacy-migration use: running or testing software that is only certified on the CentOS 7 / RHEL 7 platform while you migrate. Plan a migration to a supported distribution, such as AlmaLinux, Rocky Linux, CentOS Stream or a current RHEL, for any workload that must remain secure.

The stock CentOS 7 repositories point at mirror.centos.org, which was retired at end-of-life. This image has already repointed every repository to the CentOS 7.9.2009 vault, so yum works out of the box against the frozen, final package set.

Removing packages does not change any of this. A smaller package set means fewer components that can carry a vulnerability, which is a genuine benefit on an end-of-life platform. It is not a substitute for migrating.

What makes this the Minimal image

Every number below was measured during the build of this image, on the same kernel and on the same day, against SecureAnyCloud's standard CentOS 7 image that this one is cut from. The image ships the comparison itself at /usr/share/sac/centos-7-minimal.manifest, so you can verify it on your own running machine rather than taking this page's word for it.

Standard CentOS 7 CentOS 7 Minimal Difference

Installed packages 309 296 13 fewer

Package payload on disk 1,118 MB 672 MB 446 MB smaller (40%)

Root filesystem used 1,517 MB 841 MB 676 MB smaller (45%)

Externally reachable TCP listeners 22 22 unchanged

Loopback listeners mail transport on 25, time on 323 time on 323 mail transport removed

Removals were chosen on one test: can an Azure virtual machine ever use this? Nothing was removed to hit a size target. Nothing that the platform needs to boot, network, authenticate, patch or be managed by Azure was touched.

Removed Why an Azure guest cannot use it

linux-firmware 394 MB of firmware for physical network cards, GPUs, wireless radios and storage controllers. An Azure virtual machine has none of that hardware: its disks and network are the in kernel Hyper V synthetic drivers, which load no firmware at all.

microcode_ctl CPU microcode updates. A guest cannot apply microcode; the Azure host does it.

postfix, mariadb-libs A local mail transport listening on 127.0.0.1:25. A minimal base ships no mail server, and removing it closes two listeners.

lshw, hwdata A hardware inventory tool and its 14 MB PCI and USB identifier database, for enumerating physical hardware.

btrfs-progs btrfs is deprecated and unsupported on CentOS 7, and Azure images use xfs.

sg3_utils SCSI generic passthrough tools. Azure storage uses the synthetic driver, and the Azure disk naming rules on this image do not call these tools.

tuned Tuning profile daemon. Azure guests use the platform defaults.

qemu-guest-agent The KVM and QEMU guest agent, inherited from the upstream cloud image's origin. Azure uses the Azure Linux Agent instead, so this was a live daemon doing nothing.

kexec-tools Crash dump tooling. kdump reserves memory on a small virtual machine for a dump path a marketplace image never uses.

dracut-config-rescue, teamd Rescue boot image generation, and network interface teaming, which Azure networking does not use.

What was deliberately kept. binutils looks like an obvious 24 MB saving, but it is not removable on CentOS 7. /usr/bin/nm is required by kmod, and the dependency cascade from there reaches openssh and systemd.

The same applies to wpa_supplicant (required by NetworkManager), cracklib-dicts, grub2-tools-extra, bind-export-libs, nss-tools, shared-mime-info, kbd-misc, python-babel and gettext.

Every candidate in the build was checked with rpm -e --test and against the full yum removal transaction before anything was erased. This image therefore contains no package removed by force and no broken dependency.

NFS client support is retained in full. Only the rpcbind portmapper is switched off, and NFSv4 does not use it.

What you get

CentOS Linux 7.9.2009 (Core), binary compatible with RHEL 7, with a reduced package set
A standard (non-LVM) single-partition xfs root
Every available 7.9.2009 vault package applied at build time (patched to the capture date)
Repositories repointed to vault.centos.org/7.9.2009, so yum keeps working after end-of-life
The Azure Linux Agent (WALinuxAgent) and cloud-init, for Azure provisioning
Chronyd for NTP time synchronisation
SELinux in enforcing mode
A package set manifest at /usr/share/sac/centos-7-minimal.manifest
Gen1 Hyper-V virtual machine support (BIOS boot)
24/7 SecureAnyCloud support

Platform: Microsoft Azure (Gen1 Hyper-V). Default user: azureuser.

Security posture

No baked-in credentials. The root password is locked, and there is no shipped SSH key.
SSH host keys are regenerated on first boot, so no two virtual machines share an identity.
SSH is key-only. Password authentication and root login are both disabled.
SELinux is enforcing, with the targeted policy.
Exactly one externally reachable TCP listener exists: sshd on port 22.
The rpcbind RPC listener on port 111 is disabled and masked.
There is no local mail transport, and therefore no listener on port 25.
No swap is baked into the image. Azure manages swap on the ephemeral resource disk.

Prerequisites

Before you deploy this image, make sure you have:

An active Microsoft Azure subscription
Access to the Azure Portal or the Azure CLI
An SSH key pair for Linux VM access
Familiarity with Azure VM management

Recommended VM size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Deploy the virtual machine

Option A: Azure Portal

Go to the Azure Marketplace and search for "CentOS 7 Minimal SecureAnyCloud".
Select the image and choose Create.
Configure the basics:
- Subscription: select your Azure subscription.
- Resource group: create a new one or select an existing one.
- Virtual machine name: enter a name for your VM.
- Region: select your preferred Azure region.
- Size: Standard_B2s is recommended.
Under Administrator account, select SSH public key and enter your key.
Under Inbound port rules, allow SSH (port 22).
Choose Review + create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:centos-7-minimal:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-centos-7-minimal-vm \
  --image sac1647283583153:centos-7-minimal:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Connect via SSH

Run these commands on your own workstation, not on the VM. Find the public IP address, then connect:

az vm show --resource-group myResourceGroup --name my-centos-7-minimal-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, the key that you supplied at create time is not the key your client is offering.

Confirm the release

Check that the machine runs the CentOS Linux 7.9.2009 release you expect:

cat /etc/centos-release grep -E '^(NAME|VERSION|ID|VERSION_ID)=' /etc/os-release uname -rm rpm -qa | wc -l

Expected output:

CentOS Linux release 7.9.2009 (Core) NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" VERSION_ID="7" 3.10.0-1160.119.1.el7.x86_64 x86_64 296

CentOS 7's /etc/os-release has no PLATFORM_ID field. That field was introduced in the el8 line.

Confirm the minimal package set

The minimal package set is the property you choose when you pick this image over the standard CentOS 7 one, so verify it directly. The manifest is generated during the build and shipped in the image:

cat /usr/share/sac/centos-7-minimal.manifest rpm -q linux-firmware microcode_ctl postfix tuned qemu-guest-agent || echo "(absent by design in the Minimal image)" df -h /

Expected output:

sac CentOS 7 Minimal — package-set manifest Standard CentOS 7 : 309 packages, 1118 MB of package payload CentOS 7 Minimal : 296 packages, 672 MB of package payload Delta : -13 packages, -446 MB ... package linux-firmware is not installed package microcode_ctl is not installed package postfix is not installed package tuned is not installed package qemu-guest-agent is not installed (absent by design in the Minimal image) Filesystem Size Used Avail Use% Mounted on /dev/sda1 8.0G 1.1G 7.0G 13% /

The is not installed lines are the point of the image, not an error. The manifest lists every removal and why it was safe on Azure. It also lists which packages were deliberately kept because removing them would break CentOS 7.

Verify the security posture

Confirm that SELinux is enforcing, root is locked, SSH is key-only, and exactly one port is reachable from the network:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) ' ss -tlnH | awk '{print $1, $4}' ss -ulnH | awk '{print $1, $4}'

Expected output:

Enforcing root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.) permitrootlogin no pubkeyauthentication yes passwordauthentication no LISTEN *:22 LISTEN [::]:22 UNCONN *:68 UNCONN 127.0.0.1:323 UNCONN [::1]:323

Read the third column of the ss output. It is the local address the socket is bound to. The only externally reachable TCP listener is sshd on port 22.

On UDP, *:68 is the DHCP client, which every Azure virtual machine needs to hold its network lease. 127.0.0.1:323 is chrony's time synchronisation control socket, reachable only from the machine itself.

Note what is not in that list. The standard CentOS 7 image also binds a local mail transport on 127.0.0.1:25 and ::1:25. This image removed it along with the package.

Verify the vault update path and Azure integration

CentOS 7 is end-of-life, so its original mirrors are gone. This image repoints every repository to the CentOS 7.9.2009 vault, so yum keeps working against the frozen final package set. Confirm that, and confirm that the Azure Linux Agent survived the package trim:

yum repolist enabled grep '^baseurl' /etc/yum.repos.d/CentOS-Base.repo
sudo yum -q check-update; echo "check-update exit: $?" systemctl is-active waagent systemctl is-enabled waagent cloud-init --version systemctl is-active chronyd

Expected output:

repo id repo name status base/x86_64 CentOS-7.9.2009 - Base (vault) 10,072 extras/x86_64 CentOS-7.9.2009 - Extras (vault) 526 updates/x86_64 CentOS-7.9.2009 - Updates (vault) 6,173 repolist: 16,771 baseurl=https://vault.centos.org/7.9.2009/os/$basearch/ baseurl=https://vault.centos.org/7.9.2009/updates/$basearch/ baseurl=https://vault.centos.org/7.9.2009/extras/$basearch/ check-update exit: 0 active enabled /bin/cloud-init 19.4 active

check-update returning 0 means no newer packages exist in the vault, so the image is patched to the end of the CentOS 7 lifecycle. No further security updates will ever be published upstream. For anything beyond legacy migration, move to a supported distribution.

waagent lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled. The package trim deliberately protects it. An image that saved space by dropping the Azure Linux Agent would not provision at all.

Put back anything you need

Nothing in this image is removed by force, so anything trimmed reinstalls normally from the vault. If you need a package that is not here, install it the usual way with sudo yum install -y <package>.

Two cases are worth calling out:

Mail delivery. postfix is not installed, so there is no /usr/sbin/sendmail and cron cannot mail job output to MAILTO. If you need local mail, run sudo yum install -y postfix && sudo systemctl enable --now postfix. This restores exactly the standard image's behaviour, including the loopback listener on port 25.
NFSv3. The NFS client is fully installed, but the rpcbind portmapper is disabled and masked, because NFSv4 does not need it. NFSv3 does. Restore it with sudo systemctl unmask rpcbind.socket, followed by sudo systemctl enable --now rpcbind.socket.

Reinstalling a trimmed package is supported and safe. It returns that part of the image to the standard CentOS 7 behaviour.

Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic. It is the first, and usually the only, place you need to open a port. The image advertises a single inbound port, SSH on 22.

Confirm what is listening before you open anything:

sudo ss -tlnp

If your policy also requires a host firewall, install and enable firewalld with sudo yum install -y firewalld && sudo systemctl enable --now firewalld.

Add the SSH service first, so that you do not lock yourself out. Run sudo firewall-cmd --permanent --add-service=ssh and then sudo firewall-cmd --reload.

Common use cases

Running legacy software that is only certified on the CentOS 7 / RHEL 7 platform, while you re-platform
A lean base for building and validating packages against the RHEL 7 ABI, where a smaller image means faster provisioning and fewer components to review
Lift-and-shift of an existing on-premises CentOS 7 estate into Azure as a migration staging step, on a reduced attack surface

For any workload that must stay secure long term, migrate to AlmaLinux, Rocky Linux, CentOS Stream or a current RHEL. CentOS 7 receives no further upstream security updates.

Troubleshooting

Cannot connect via SSH

Verify that the VM is in the Running state in the Azure Portal.
Check that port 22 is allowed in the Network Security Group.
Make sure you are using the correct username: azureuser.
Verify that your SSH key matches the one you supplied at create time. Password login is disabled by design, so a wrong key cannot fall back to a password prompt.

A command or tool is missing

This is the Minimal image, so some tooling that is present on the standard CentOS 7 image is not installed. Check the manifest to see whether a package was removed deliberately, then reinstall it from the vault if you need it:

grep -A 20 '^Removed' /usr/share/sac/centos-7-minimal.manifest

Package manager cannot reach a mirror

CentOS 7's original mirrors were retired at end-of-life. This image already points at the vault. If you add a third-party .repo file that still references mirror.centos.org, you will see 404 errors. Repoint it to https://vault.centos.org/7.9.2009/... or remove it.

Confirm that nothing still references the retired mirrors:

grep -R mirror.centos.org /etc/yum.repos.d/ || echo "all repos already on the vault"

Azure agent not running

Check the agent's status:

systemctl status waagent --no-pager

If it is not running, start and enable it with sudo systemctl enable --now waagent.

Important Notes

CentOS Linux is free and open source. It is not covered by a single licence. It is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL.

Every package's terms are readable with rpm -qi <package> and under /usr/share/licenses/. No subscription, licence key or Red Hat entitlement is required. Removing packages changes no licence term.

CentOS Linux 7 reached end-of-life on 30 June 2024 and receives no further upstream security updates. This image is patched only to its capture date, from the frozen CentOS 7.9.2009 vault, and is provided for legacy-migration use. Plan a migration to a supported distribution (AlmaLinux, Rocky Linux, CentOS Stream or a current RHEL) for any workload that must remain secure.

CentOS is a trademark of Red Hat, Inc. The name is used here nominatively, only to identify the distribution this image contains. SecureAnyCloud is not affiliated with, endorsed by or sponsored by Red Hat.

Support

For assistance with this image, contact SecureAnyCloud support:

Website: secureanycloud.com
Product catalogue: secureanycloud.com/products
User guides: secureanycloud.com/guides
SLA: 24 hour response guaranteed

Deploy on Azure

Launch CentOS 7 Minimal on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure