Debian 13 ARM64

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Debian 13 Arm64 SecureAnyCloud".
• Select the image and click Create.
• Configure the basics:
• Subscription: Select your Azure subscription.
• Resource Group: Create a new group or select an existing one.
• Virtual Machine Name: Enter a name for your VM.
• Region: Select your preferred Azure region.
• Size: Select Standard_D2ps_v6 (recommended, an Arm64 size).
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:debian-13-arm64:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-debian-arm64-vm \
  --image sac1647283583153:debian-13-arm64:default:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The --size must be an Arm64 family (Standard_D2ps_v6 above). Azure rejects an x86 size for an Arm image at create time.

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-debian-arm64-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Check that the machine is the Debian 13 release you expect, and confirm that it is running on Arm:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PRETTY_NAME)=' /etc/os-release uname -srm dpkg --print-architecture

Expected output:

PRETTY_NAME="Debian GNU/Linux 13 (trixie)" NAME="Debian GNU/Linux" VERSION_ID="13" VERSION="13 (trixie)" ID=debian Linux 6.12.107+deb13-cloud-arm64 aarch64 arm64

aarch64 from uname and arm64 from dpkg both confirm that this is the native 64-bit Arm build, not an emulated or x86 image. The exact kernel version moves forward as Debian releases updates. You can also check the point release with cat /etc/debian_version. A released value looks like 13.6.

The image is fully updated at build time. Confirm that no upgrades are pending and that the update path is intact:

apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c '^Inst ' | sed 's/^/pending upgrades: /' apt-mark showhold dpkg -l | awk '/linux-image-[0-9]/{print $2, $3}'

The expected output shows pending upgrades: 0, no held packages, and exactly one installed Arm kernel:

pending upgrades: 0 linux-image-6.12.107+deb13-cloud-arm64 6.12.107-1

This image arms unattended-upgrades, so security updates are downloaded and applied on a timer without any action from you. You can still run updates on your own schedule:

sudo apt-get update && sudo apt-get -y dist-upgrade

Reboot if a new kernel was installed:

sudo systemctl reboot

Confirm that AppArmor is enforcing, root is locked, and SSH is key-only:

sudo aa-status --enabled && echo "apparmor: enabled"
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) '

Expected output:

apparmor: enabled root L 2026-08-31 0 99999 7 -1 permitrootlogin without-password pubkeyauthentication yes passwordauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password. The L from passwd -S means that the root account is locked, and the date after it is the day the password field was last changed.

Confirm that the Azure Linux Agent, cloud-init and time synchronisation are healthy and that unattended security updates are armed. Then check your resources:

systemctl is-active walinuxagent cloud-init --version
systemctl is-enabled apt-daily-upgrade.timer apt-config dump | grep -E 'APT::Periodic::(Update-Package-Lists|Unattended-Upgrade) '
systemctl is-active chrony df -h / free -h

Expected output:

active /usr/bin/cloud-init 25.1.4 enabled APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "1"; active Filesystem Size Used Avail Use% Mounted on /dev/sda1 30G 946M 27G 4% / total used free shared buff/cache available Mem: 7.7Gi 379Mi 7.2Gi 480Ki 332Mi 7.4Gi Swap: 0B 0B 0B

The Azure Linux Agent lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active.

The apt-daily-upgrade.timer unit being enabled, together with Unattended-Upgrade "1" in the apt periodic config, keeps the machine applying security updates on its own after launch.

free -h shows Swap: 0B, which is expected. Azure manages swap on the ephemeral resource disk, not on the OS disk.

The Azure Network Security Group (NSG) is the control plane for inbound and outbound traffic. It is the first and usually the only place where you need to open a port. The image advertises a single inbound port, SSH on 22.

Debian's minimal cloud image ships with no host firewall enabled. Neither ufw nor nftables rules are active by default, so your NSG rules take effect exactly as written, with no second layer to keep in sync. Confirm what is listening before you open anything:

sudo ss -tln | awk '$1=="LISTEN"{print $1, $4}'

Expected output:

LISTEN 127.0.0.54:53 LISTEN 127.0.0.53%lo:53 LISTEN 0.0.0.0:22 LISTEN [::]:22

The only external listener is sshd on port 22. The two 127.0.0.5x:53 rows are systemd-resolved's local DNS stub, bound to loopback and not reachable from outside. Unlike a stock Debian 13 install, there is no listener on port 5355. This image disables LLMNR, so the resolver does not accept multicast name-resolution traffic from the network at all.

If your policy also requires a host firewall, install one from the archive. ufw is the simplest to manage. Add the SSH rule first, before you enable ufw, so you do not lock yourself out:

sudo apt-get update && sudo apt-get install -y ufw
sudo ufw allow OpenSSH
sudo ufw allow 443/tcp
sudo ufw enable

Once ufw is running, a port must be open in both the Azure NSG and ufw before traffic reaches your service. If you prefer to manage rules directly, the Debian archive also ships nftables.

The Debian archive carries the application packages. Search it, then install what you need:

apt-cache search --names-only '^nginx' 2>/dev/null | sed -n '1,5p'

Install a package and enable it in the usual way, for example sudo apt-get install -y nginx followed by sudo systemctl enable --now nginx.

Everything in the archive is built for Arm, so apt resolves arm64 packages automatically. There is nothing extra to configure for the architecture.

To add another administrator, create the account with sudo adduser <name>, then add it to the sudo group with sudo usermod -aG sudo <name>. Next, copy your public key into /home/<name>/.ssh/authorized_keys with mode 600, and set the .ssh directory to mode 700, owned by that user. The image ships with no human accounts at all, so azureuser is the only login until you add one:

getent group sudo