SecureAnyCloud
Deployment guide

CentOS Stream 10 Minimal

Overview

This guide covers the deployment and configuration of CentOS Stream 10 Minimal on Microsoft Azure using SecureAnyCloud's preconfigured virtual machine image from the Azure Marketplace.

CentOS Stream is a free, open-source Linux distribution maintained by the CentOS Project and sponsored by Red Hat. Stream 10 is the continuously delivered development branch that sits just ahead of Red Hat Enterprise Linux 10. It tracks what the next RHEL 10 update will contain while remaining binary compatible with the RHEL 10 platform.

This is the Minimal edition: the same CentOS Stream 10 with the desktop-era and support tooling that a headless cloud server never uses removed. The machine you run has a smaller installed package set and a smaller attack surface to patch and audit. The upstream GenericCloud image is already leaner than a full AlmaLinux or Rocky Linux cloud image, so no single package dominates the trim. Minimal removes the Cockpit web console, the tuned tuning daemon, the sosreport support collector, the boot splash and the bundled GeoIP datasets. Each is one fewer service or dataset to keep patched and account for in a security review.

What you get:

  • CentOS Stream 10, the continuously delivered upstream development branch of RHEL 10, rolled forward to the current package set at build time
  • A reduced package set: no Cockpit web console, no tuned, no sosreport, no boot splash and no bundled GeoIP datasets
  • Every available update applied at build time, verified with a zero-pending check
  • Unattended updates already armed (dnf-automatic), so the machine keeps patching itself
  • Azure Linux Agent (waagent) and cloud-init for Azure integration
  • Chronyd for NTP time synchronization
  • SELinux in enforcing mode, both at runtime and persisted for the next boot, with selinux-policy-targeted installed
  • The latest installed kernel as the resolvable default GRUB boot entry (verified with grubby, not just grub2-mkconfig)
  • BaseOS, AppStream and Extras repositories enabled, with signature checking on
  • Exactly one externally reachable port: SSH on 22
  • Gen1 Hyper-V (BIOS boot) virtual machine support
  • 24/7 SecureAnyCloud support

Platform: Microsoft Azure (Gen1 Hyper-V). Default user: azureuser

What "Minimal" means here, precisely

The upstream CentOS Stream 10 GenericCloud image this offer is built from does not ship linux-firmware, tuned or plymouth in the first place. It is already a lean cloud image, unlike a full desktop-oriented AlmaLinux or Rocky Linux base, so the Minimal trim here is smaller in absolute terms than on those sibling images.

On this build the package count moved from 418 packages after the full security patch pass to 391 packages in the shipped image. Root filesystem usage measured 2.1G used after the trim, the patch pass and arming unattended updates. Removed from the base: the Cockpit web console (a network-facing management surface), the sosreport support collector, and empty configuration directories left behind by their removal. Each is one fewer service or dataset to keep patched and to account for in a security review, which is why a compliance-driven deployment chooses a Minimal image.

What is deliberately kept: systemd, NetworkManager, the SSH server, cloud-init, the Azure Linux Agent, dnf, sudo, chrony and dnf-automatic. The build fails if any of those is missing after the trim.

Confirm the footprint on your own machine:

df -h / | awk 'NR==2 {print "root filesystem used: " $3}' rpm -qa | wc -l

Expected output (yours will differ by whatever has been patched since this image was built):

root filesystem used: 2.1G 391

Security posture

This image ships with no known credential. There is no default password and no baked-in SSH key:

  • The root account password is locked, so no one can log in as root with a password.
  • PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
  • KbdInteractiveAuthentication is also disabled, closing the other password path.
  • PermitRootLogin is set to without-password (also written as prohibit-password), so root cannot be reached with a password even if one were later set.
  • The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
  • SSH host keys are not baked into the image. cloud-init regenerates them on every machine, so no two customers share a host identity.
  • SELinux runs in enforcing mode, both at runtime and persisted in /etc/selinux/config, with selinux-policy-targeted installed, so mandatory access control is active from first boot.

Verify the effective SSH configuration on your own machine, reading the parsed values rather than the file text:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|permitemptypasswords) '

Expected output:

permitrootlogin without-password passwordauthentication no kbdinteractiveauthentication no permitemptypasswords no

1. Deploy the virtual machine

Option A: Azure Portal

  • Navigate to the Azure Marketplace and search for "CentOS Stream 10 Minimal SecureAnyCloud"
  • Select the image and click Create
  • Configure the basics:
  • Subscription: Select your Azure subscription
  • Resource Group: Create new or select existing
  • Virtual Machine Name: Enter a name for your VM
  • Region: Select your preferred Azure region
  • Size: Standard_B2s recommended
  • Under Administrator Account, select SSH public key and enter your key
  • Under Inbound Port Rules, allow SSH (port 22)
  • Click Review + Create, then Create

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:centos-stream-10-minimal:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-centos-stream-10-minimal-vm \
  --image sac1647283583153:centos-stream-10-minimal:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

2. Connect via SSH

Once your VM is running, connect using SSH:

ssh azureuser@<YOUR-VM-IP>

To find your VM's public IP (run this on your own machine, with the Azure CLI, not on the VM itself):

az vm show --resource-group myResourceGroup --name my-centos-stream-10-minimal-vm --show-details --query publicIps -o tsv

3. Confirm the release and patch level

cat /etc/centos-release

Expected output:

CentOS Stream release 10 (Coughlan)

CentOS Stream 10 is continuously delivered (rolling) rather than minor-pinned, so this always reports the current Stream 10 identity. Confirm nothing is outstanding:

sudo dnf -q check-update >/dev/null 2>&1; echo "check-update rc=$? (100 would mean updates pending)"

4. Confirm the trim actually shipped

The packages a cloud guest cannot use should be absent, and the platform essentials present:

for p in linux-firmware tuned cockpit sos plymouth; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: absent"; done
for p in systemd NetworkManager openssh-server cloud-init WALinuxAgent dnf
sudo chrony; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: MISSING"; done

5. Confirm Azure integration, SELinux and the boot kernel

systemctl is-active waagent.service
getenforce

Expected: active and Enforcing.

The latest installed kernel should also be the resolvable default boot entry:

sudo grubby --default-kernel uname -r

The path grubby reports should end in the same version uname -r shows.

6. Unattended updates

The image arms dnf-automatic so the machine keeps patching itself after you deploy it:

systemctl is-enabled dnf-automatic.timer

Expected output: enabled.

7. Configure firewall (optional)

The Azure Network Security Group (NSG) is the primary inbound and outbound traffic control and is recommended for most deployments. This image does not ship a host firewall daemon (firewalld is not preinstalled); the base iptables command is present. If you want a host firewall in addition to the NSG, install and enable firewalld first:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld

With firewalld running you can inspect the active ruleset:

sudo firewall-cmd --list-all

8. Adding software back

Nothing about the trim prevents you from installing anything you need. The full CentOS Stream repositories are enabled and signature-checked. Cockpit, for example, can be reinstalled if you want the web console:

sudo dnf install -y cockpit
sudo systemctl enable --now cockpit.socket

Common use cases

  • A stripped-down, RHEL 10-compatible base for production servers where a smaller package set matters
  • Tracking and testing against the next RHEL 10 update ahead of general availability, with a minimal footprint
  • A lean foundation for your own applications, container hosts and CI runners

Troubleshooting

Cannot connect via SSH

  • Verify the VM is in Running state in the Azure Portal
  • Check that port 22 is allowed in the Network Security Group
  • Ensure you are using the correct username: azureuser
  • Verify your SSH key matches the one configured during deployment

Azure agent not running

sudo systemctl start waagent
sudo systemctl enable waagent

Package manager issues

sudo dnf upgrade -y

Important notes

CentOS Stream is free and open source (GPLv2 and a collection of upstream open-source licenses). It is the upstream development branch of Red Hat Enterprise Linux 10, sponsored by Red Hat and maintained by the CentOS Project. No license or paid subscription is required.

Support

SecureAnyCloud provides 24/7 support for this image at sales@secureanycloud.com.

  • Website: secureanycloud.com
  • Product Catalog: secureanycloud.com/products
  • User Guides: secureanycloud.com/guides
  • SLA: 24 hour response guaranteed

Deploy on Azure

Launch CentOS Stream 10 Minimal on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure