Debian 12 ARM64

Option A: Azure Portal

• Open Azure Marketplace and search for "Debian 12 Arm64 SecureAnyCloud".
• Select the image and choose Create.
• Configure the basics:
  • Subscription: select your Azure subscription.
  • Resource Group: create a new one or select an existing one.
  • Virtual Machine Name: enter a name for your VM.
  • Region: select your Azure region.
  • Size: Standard_D2ps_v6 is recommended (an Arm64 size).
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Choose Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:debian-12-arm64:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-debian-arm64-vm \
  --image sac1647283583153:debian-12-arm64:default:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The --size value must be an Arm64 family, such as Standard_D2ps_v6 above. Azure rejects an x86 size for an Arm image at create time.

Run these commands on your own workstation, not on the VM. Find the public IP, then connect.

az vm show --resource-group myResourceGroup --name my-debian-arm64-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check that the machine runs the Debian 12 release you expect, and that it runs on Arm.

grep -E '^(NAME|VERSION|ID|VERSION_ID|PRETTY_NAME)=' /etc/os-release uname -srm dpkg --print-architecture

Expected output:

PRETTY_NAME="Debian GNU/Linux 12 (bookworm)" NAME="Debian GNU/Linux" VERSION_ID="12" VERSION="12 (bookworm)" ID=debian Linux 6.1.0-52-cloud-arm64 aarch64 arm64

The aarch64 output from uname and the arm64 output from dpkg both confirm this is the native 64-bit Arm build, not an emulated or x86 image.

The image is fully updated at build time. Confirm that no upgrades are pending and that the update path is intact.

apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' | sed 's/^/pending upgrades: /' apt-mark showhold dpkg -l | awk '/linux-image-[0-9]/{print $2, $3}'

The expected output shows pending upgrades: 0, no held packages and the installed Arm kernel.

pending upgrades: 0 linux-image-6.1.0-52-cloud-arm64 6.1.180-1

This image arms unattended-upgrades, so security updates download and apply on a timer without any action from you. You can also run updates on your own schedule.

sudo apt-get update && sudo apt-get -y dist-upgrade

If a new kernel was installed, reboot.

sudo systemctl reboot

Confirm that AppArmor is enforcing, root is locked and SSH accepts keys only.

sudo aa-status --enabled && echo "apparmor: enabled"
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) '

Expected output:

apparmor: enabled root L 2026-08-06 0 99999 7 -1 permitrootlogin without-password pubkeyauthentication yes passwordauthentication no

OpenSSH reports the prohibit-password setting as without-password. Both names mean the same thing: root may not authenticate with a password. The L from passwd -S means the root account is locked.

Confirm that the Azure Linux Agent, cloud-init and time synchronization are healthy, that unattended security updates are armed, and check your resources.

systemctl is-active walinuxagent cloud-init --version
systemctl is-enabled apt-daily-upgrade.timer apt-config dump | grep -E 'APT::Periodic::(Update-Package-Lists|Unattended-Upgrade) '
systemctl is-active chrony df -h / free -h

The Azure Linux Agent lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active. When apt-daily-upgrade.timer is enabled and the apt periodic config has Unattended-Upgrade "1", the machine keeps applying security updates on its own after launch.

free -h shows Swap: 0B. This is expected, because Azure manages swap on the ephemeral resource disk, not on the OS disk.

The Azure Network Security Group (NSG) controls inbound and outbound traffic. It is the first, and usually the only, place you need to open a port. The image advertises a single inbound port, SSH on 22.

Debian's minimal cloud image ships with no host firewall enabled. Neither ufw nor nftables rules are active by default, so your NSG rules take effect exactly as written, with no second layer to keep in sync. Before you open anything, confirm what is listening.

ss -tlnp

On a fresh machine the main external listener is sshd on port 22. You also see systemd-resolved bound to loopback addresses (127.0.0.53 and 127.0.0.54 on port 53, and port 5355 for LLMNR). These are the local DNS stub resolver and are not reachable from outside. Only port 22 is advertised for inbound access, and the Azure NSG governs what is actually reachable from outside.

If your policy also requires a host firewall, install one from the archive. ufw is the simplest to manage. Add the SSH rule first, before you enable ufw, so you do not lock yourself out.

sudo apt-get update && sudo apt-get install -y ufw
sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw enable

Once ufw is running, open each port in both the Azure NSG and ufw before traffic can reach your service. If you prefer to manage rules directly, the Debian archive also provides nftables.

The Debian archive carries the application packages. Search it, then install what you need.

apt-cache search nginx 2>/dev/null | sed -n '1,5p'

Install a package and enable it in the usual way. For example, run sudo apt-get install -y nginx, then sudo systemctl enable --now nginx.

Everything in the archive is built for Arm, so apt resolves arm64 packages automatically. You do not need to configure anything for the architecture.

The image ships with no human accounts, so azureuser is the only login until you add one. To add another administrator:

• Create the account with sudo adduser <name>.
• Add it to the sudo group with sudo usermod -aG sudo <name>.
• Copy your public key into /home/<name>/.ssh/authorized_keys.
• Set mode 600 on that file and mode 700 on the .ssh directory, both owned by that user.

getent group sudo