SecureAnyCloud
Deployment guide

CentOS 7

Videos

Overview: CentOS 7 on Azure: overview (watch on YouTube)

Launch and log in: CentOS 7 on Azure: launch and log in (watch on YouTube)

Overview

This guide covers the deployment and configuration of CentOS 7 (CentOS Linux 7.9.2009, the final CentOS 7 release) on Microsoft Azure using SecureAnyCloud's pre-configured virtual machine image from the Azure Marketplace.

CentOS Linux is a community rebuild of Red Hat Enterprise Linux, binary compatible with RHEL 7. This image is provided for legacy-migration workloads. It suits teams that are moving software certified only on the CentOS 7 and RHEL 7 platform, and that need a clean, hardened CentOS 7.9 base while they re-platform.

End-of-life notice: read this first

CentOS Linux 7 reached end-of-life on 30 June 2024. The upstream CentOS Project no longer produces any updates for it, including security updates. Consequently:

  • This image is patched only to its capture date, from the frozen CentOS 7.9.2009 vault (vault.centos.org). No newer CentOS 7 packages exist upstream, so "fully patched" means patched to the last packages that the vault published.
  • After the end-of-life date, no further upstream security updates are published. Over time, the image carries unpatched vulnerabilities that you cannot remediate by updating CentOS 7, because upstream ships nothing further.
  • This image is provided for legacy-migration use: running or testing software that is certified only on the CentOS 7 and RHEL 7 platform while you migrate. For any workload that must remain secure, plan a migration to a supported distribution such as AlmaLinux, Rocky Linux, CentOS Stream or a current RHEL.

The stock CentOS 7 repositories point at mirror.centos.org, which was retired at end-of-life. This image has already repointed every enabled repository (base, updates, extras) to the CentOS 7.9.2009 vault, so yum works out of the box against the frozen, final package set. The stock CentOS-CR.repo (the "continuous release" repository) still names mirror.centos.org, but it is disabled (enabled=0), so yum never contacts it.

What's included

  • CentOS Linux 7.9.2009 (Core), binary compatible with RHEL 7
  • A standard (non-LVM) single-partition xfs root
  • Every available 7.9.2009 vault package, applied at build time (patched to the capture date)
  • Repositories repointed to vault.centos.org/7.9.2009, so yum keeps working after end-of-life
  • The Azure Linux Agent (WALinuxAgent), injected and enabled, plus cloud-init, for Azure provisioning
  • Chronyd for NTP time synchronization
  • SELinux in enforcing mode
  • Gen1 Hyper-V virtual machine support (BIOS boot)
  • 24/7 SecureAnyCloud support

Platform: Microsoft Azure (Gen1 Hyper-V). Default user: azureuser.

Security posture

This image ships with no known credential. There is no default password and no baked-in SSH key.

  • The root account password is locked, so no one can log in as root with a password.
  • PasswordAuthentication is disabled in the SSH daemon, so every login is by key. The one exception is your own choice. If you pick Password as the authentication type in the portal (or pass --admin-password to az vm create), Azure switches SSH password logins on at first boot so that the password you chose works. The portal's Reset password does the same (see Troubleshooting).
  • PermitRootLogin is set to no in the main /etc/ssh/sshd_config. CentOS 7's sshd has no sshd_config.d include directory, so the setting is applied in the main file, not in a drop-in.
  • The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch share a secret.
  • The machine identity and the SSH host keys are regenerated uniquely on every instance.
  • SELinux is left in enforcing mode, which is the CentOS default.
  • The unused rpcbind listener on port 111 is disabled.

Prerequisites

Before you deploy this image, ensure that you have:

  • An active Microsoft Azure subscription
  • Access to the Azure portal or the Azure CLI
  • An SSH key pair for Linux VM access
  • Familiarity with Azure VM management

Recommended VM size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

1

Deploy the virtual machine

Option A: Azure portal

  • Open the Azure Marketplace and search for "CentOS 7 SecureAnyCloud".
  • Select the image and choose Create.
  • On the Basics tab, select your Subscription, and create or select a Resource group.
  • Enter a Virtual machine name, and select your preferred Region.
  • For Size, select Standard_B2s (recommended).
  • Under Administrator account, select SSH public key and enter your key.
  • Under Inbound port rules, allow SSH (port 22).
  • Choose Review + create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:centos-7:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-centos-7-vm \
  --image sac1647283583153:centos-7:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
2

Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-centos-7-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

If you deployed with an SSH key, there is no password to enter. If SSH asks for one, your client is not offering the key that you supplied at create time. If you chose a password in the portal instead, log in with that password: ssh <your-username>@<vm-ip>.

3

Confirm the release

Check that the machine runs the CentOS Linux 7.9.2009 release that you expect:

cat /etc/centos-release grep -E '^(NAME|VERSION|ID|VERSION_ID)=' /etc/os-release uname -rm

Expected output:

CentOS Linux release 7.9.2009 (Core) NAME="CentOS Linux" VERSION="7 (Core)" ID="centos" VERSION_ID="7" 3.10.0-1160.119.1.el7.x86_64 x86_64

CentOS 7's /etc/os-release has no PLATFORM_ID field. That field was introduced in the el8 line.

4

Review the vault update path (end-of-life)

Because CentOS 7 is end-of-life, its original mirrors are gone. This image repoints every repository to the CentOS 7.9.2009 vault, so yum keeps working against the frozen, final package set. Run:

yum repolist enabled grep '^baseurl' /etc/yum.repos.d/CentOS-Base.repo
sudo yum -q check-update; echo "check-update exit: $?"

In the expected output, the repositories point at vault.centos.org, and check-update exits 0 because the image is already patched to the last vault packages. The first yum run on a new machine also prints Determining fastest mirrors. The grep shows a fourth baseurl, for the centosplus repository. That repository is also on the vault but disabled (enabled=0), so yum repolist enabled does not list it:

repo id repo name status base/x86_64 CentOS-7.9.2009 - Base (vault) 10,072 extras/x86_64 CentOS-7.9.2009 - Extras (vault) 526 updates/x86_64 CentOS-7.9.2009 - Updates (vault) 6,173 repolist: 16,771 baseurl=https://vault.centos.org/7.9.2009/os/$basearch/ baseurl=https://vault.centos.org/7.9.2009/updates/$basearch/ baseurl=https://vault.centos.org/7.9.2009/extras/$basearch/ baseurl=https://vault.centos.org/7.9.2009/centosplus/$basearch/ check-update exit: 0

A check-update result of 0 means that no newer packages exist in the vault, so the image is patched to the end of the CentOS 7 lifecycle. No further security updates will be published upstream. For anything beyond legacy migration, move to a supported distribution.

5

Verify the security posture

Confirm that SELinux is enforcing, that root is locked, and that SSH accepts keys only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) ' systemctl is-active rpcbind.socket || true

Expected output:

Enforcing root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.) permitrootlogin no pubkeyauthentication yes passwordauthentication no inactive

LK means that the root password is locked. Root has no password hash at all, which passwd reports as an "alternate authentication scheme". If you deployed with a password, or used the portal's Reset password, passwordauthentication shows yes. That result means Azure honored the password you chose, and it is not a fault in the image.

rpcbind.socket reports inactive by design, because the unadvertised RPC listener on port 111 is disabled.

6

Verify Azure integration

Confirm that the Azure Linux Agent, cloud-init and time synchronization are healthy, and check your resources:

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version
systemctl is-active chronyd df -h / free -h

waagent lets Azure run VM extensions, Run Command and the portal's Reset password, and report VM health (the portal's Agent status shows Ready). It should always be active and enabled. cloud-init creates your user and installs your SSH key at first boot.

Run cloud-init status with sudo on this image: sudo cloud-init status reports status: done. Without sudo, CentOS 7's cloud-init 19.4 (Python 2.7) crashes with NameError: global name 'PermissionError' is not defined when it cannot read its root-only status file. That bug is in the command's error handling only and is harmless. Provisioning itself ran: cloud-init created your user, installed your SSH key, and runs any custom data you supply. To confirm that cloud-init finished, run:

sudo cloud-init status test -f /var/lib/cloud/instance/boot-finished && echo "cloud-init finished"
7

Review networking and the firewall

The Azure Network Security Group controls inbound and outbound traffic, and it is usually the only place where you need to open a port. The image exposes a single inbound port, SSH on 22.

Confirm what is listening before you open anything:

ss -tlnp

The only externally reachable listener is sshd on port 22. You also see postfix bound to 127.0.0.1:25 and ::1:25. That is the local mail transport, which is reachable only from the machine itself and not from the network.

This image binds no unnecessary external listeners. rpcbind (the local RPC helper on port 111 that the stock cloud image leaves running) is disabled, because NFSv4 does not use it. If you need NFSv3, restore it with sudo systemctl enable --now rpcbind.socket.

If your policy also requires a host firewall, install and enable firewalld with sudo yum install -y firewalld && sudo systemctl enable --now firewalld. Then add the SSH service first, with sudo firewall-cmd --permanent --add-service=ssh and sudo firewall-cmd --reload, so that you do not lock yourself out.

Common use cases

  • Running legacy software that is certified only on the CentOS 7 and RHEL 7 platform, while you re-platform
  • Lifting and shifting an existing on-premises CentOS 7 estate into Azure as a migration staging step
  • Reproducing and testing against a CentOS 7 environment for compatibility work
  • Using a short-lived base for building and validating packages against the RHEL 7 ABI

For any workload that must stay secure long term, migrate to AlmaLinux, Rocky Linux, CentOS Stream or a current RHEL. CentOS 7 receives no further upstream security updates.

Troubleshooting

Cannot connect via SSH

  • Verify that the VM is in the Running state in the Azure portal.
  • Check that port 22 is allowed in the Network Security Group.
  • Confirm that you are using the correct username: azureuser.
  • Verify that your SSH key matches the one you supplied at create time. On a key-only deployment, password login is off, so a wrong key cannot fall back to a password prompt. If you have lost the key, use the portal's Reset password (described below).

Reset the password from the portal

The portal's Reset password (and az vm user update --username azureuser --password ...) works on this image and takes effect at once, with no restart. The Azure Linux Agent sets the new password and restarts sshd for you. Two things change when you use it:

  • SSH password logins are switched on for the machine (PasswordAuthentication yes in /etc/ssh/sshd_config), so any account with a password can now log in with it.
  • sudo asks for that user's password, because the reset adds /etc/sudoers.d/waagent.

After your key works again, you can return to key-only logins:

sudo sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl restart sshd

Package manager cannot reach a mirror

CentOS 7's original mirrors were retired at end-of-life. This image already points every enabled repository at the vault. If you add a third-party .repo that still references mirror.centos.org, you see 404 errors. Repoint it to https://vault.centos.org/7.9.2009/... or remove it. List the address of every enabled repository, and confirm that each one is on vault.centos.org:

yum -v repolist enabled 2>/dev/null | grep -i '^Repo-baseurl'

A plain grep -R mirror.centos.org /etc/yum.repos.d/ also matches comments and the disabled CentOS-CR.repo (enabled=0). Those lines are harmless, because yum never reads a disabled repository. Enable that repository only after you repoint it to the vault.

Azure agent not running

Check the agent's status with:

systemctl status waagent --no-pager

If it is not running, start and enable it with sudo systemctl enable --now waagent.

Important notes

CentOS Linux is free and open source. It is not covered by a single license. It is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. You can read every package's terms with rpm -qi <package> and under /usr/share/licenses/. No subscription, license key or Red Hat entitlement is required.

CentOS Linux 7 reached end-of-life on 30 June 2024 and receives no further upstream security updates. This image is patched only to its capture date, from the frozen CentOS 7.9.2009 vault, and is provided for legacy-migration use. For any workload that must remain secure, plan a migration to a supported distribution (AlmaLinux, Rocky Linux, CentOS Stream or a current RHEL).

CentOS is a trademark of Red Hat, Inc. The name is used here nominatively, only to identify the distribution this image contains. SecureAnyCloud is not affiliated with, endorsed by or sponsored by Red Hat.

Support

For help with this image, contact SecureAnyCloud support:

  • Website: secureanycloud.com
  • Product catalog: secureanycloud.com/products
  • User guides: secureanycloud.com/guides
  • SLA: 24 hour response guaranteed

Deploy on Azure

Launch CentOS 7 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure