Oel 10.2

Option A: Azure Portal

• Open the Azure Marketplace and search for "Oracle Linux 10.2 SecureAnyCloud".
• Select the image and click Create.
• Configure the basics:
  • Subscription: select your Azure subscription.
  • Resource Group: create a new one or select an existing one.
  • Virtual Machine Name: enter a name for your VM.
  • Region: select your preferred Azure region.
  • Size: Standard_B2s is recommended.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

Accept the image terms, then create the VM:

az vm image terms accept --urn sac1647283583153:oel-10-2:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-linux-10-2-vm \
  --image sac1647283583153:oel-10-2:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oracle-linux-10-2-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, your client is not offering the key you supplied at create time.

Check that the machine is the Oracle Linux 10.2 release you expect:

cat /etc/oracle-release grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release uname -rm

Expected output:

Oracle Linux Server release 10.2 NAME="Oracle Linux Server" VERSION="10.2" ID="ol" PLATFORM_ID="platform:el10" 6.12.0-204.92.4.4.3.el10uek.x86_64 x86_64

The el10uek tag on the kernel version shows that the machine is running the Unbreakable Enterprise Kernel. Oracle Linux also ships the Red Hat Compatible Kernel (a 6.12 el10_2 kernel) alongside it. The next step shows both.

The image is fully updated at build time. dnf check-update returns exit code 100 when updates are pending and 0 when none are pending:

sudo dnf check-update echo "exit code: $?"

List the enabled repositories to confirm your update path is intact:

dnf repolist --enabled

Expected output:

repo id repo name ol10_UEKR8 Oracle Linux 10 UEK Release 8 (x86_64) ol10_addons Oracle Linux 10 Addons (x86_64) ol10_appstream Oracle Linux 10 Application Stream Packages (x86_64) ol10_baseos_latest Oracle Linux 10 BaseOS Latest (x86_64)

Both kernel lines are installed and managed by dnf. List them and see which one is booted:

rpm -q kernel-uek-core kernel-core uname -r

Expected output:

kernel-uek-core-6.12.0-204.92.4.4.3.el10uek.x86_64 kernel-core-6.12.0-211.43.1.el10_2.x86_64 6.12.0-204.92.4.4.3.el10uek.x86_64

The UEK line (kernel-uek-*) is the default and is what uname -r reports. The RHCK line (kernel-*, the 6.12 el10_2 kernel) is available if you prefer strict RHEL kernel compatibility. Select it from the GRUB menu at boot. Both lines receive updates.

Because 10.2 is a current minor in the RHEL 10 family, applying updates keeps you current within the 10 series. This image also arms dnf-automatic, so updates are downloaded and applied on a timer without any action from you. You can still run updates on your own schedule:

sudo dnf upgrade -y

Reboot if a new kernel was installed:

sudo systemctl reboot

Confirm that SELinux is enforcing, root is locked and SSH is key-only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication)'

Expected output:

Enforcing root L 2009-12-22 -1 -1 -1 -1 (Password locked.) permitrootlogin without-password pubkeyauthentication yes passwordauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password.

Confirm that the Azure Linux Agent, cloud-init and time synchronization are healthy and that unattended updates are armed. Then check your resources:

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version
systemctl is-enabled dnf-automatic.timer
systemctl is-active chronyd df -h / free -h

Expected output:

active enabled /bin/cloud-init 24.4-7.0.1.el10_2.1 enabled active Filesystem Size Used Avail Use% Mounted on /dev/mapper/rootvg-rootlv 27G 3.3G 24G 12% / total used free shared buff/cache available Mem: 3.1Gi 572Mi 2.3Gi 16Mi 505Mi 2.6Gi Swap: 0B 0B 0B

waagent lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health. It should always be active and enabled.

When dnf-automatic.timer is enabled, the machine keeps applying updates on its own after launch. Swap: 0B is expected. Azure manages swap on the ephemeral resource disk, so none is baked into the OS disk.

The Azure Network Security Group is the outer control plane for inbound and outbound traffic. It is the first place you open a port. The image advertises a single inbound port, SSH on 22.

Confirm what is actually listening before you open anything:

ss -tlnp

On a fresh machine the only listener is sshd on port 22. rpcbind is disabled on this image, so port 111 is closed by default.

Unlike a stock cloud image, this build also runs a host firewall. firewalld is active and enabled, uses the public zone, and already permits SSH. Inspect it with:

sudo firewall-cmd --state sudo firewall-cmd --list-all

The public zone lists ssh among its allowed services, which is why your key-based login works out of the box. To expose another service, open it in both the Azure NSG and firewalld. For example, to allow HTTPS:

sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Always keep the ssh service allowed, so that a firewall change does not lock you out.

If you need NFSv3, which relies on the RPC port mapper, re-enable rpcbind:

sudo systemctl enable --now rpcbind.socket

NFSv4 does not need rpcbind and works without this step.

The BaseOS repository carries the core operating system, and the Application Stream carries the application packages. Most software therefore installs directly with dnf. Search the enabled repositories for a package:

dnf search nginx

Then install and enable it in the usual way:

sudo dnf install -y nginx
sudo systemctl enable --now nginx

Oracle Linux 10 follows the RHEL 10 model, in which the older AppStream module streams have been retired. You install the version that the Application Stream ships, rather than selecting a module stream.

If you need a version that is not in the stock repositories, the Oracle Linux ol10_addons repository (enabled on this image) and Oracle's yum server carry additional packages.

To add another administrator, create the account with sudo adduser <name>. Add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600, and give the .ssh directory mode 700, owned by that user.

The image ships with no human accounts at all, so azureuser is the only login until you add one:

getent group wheel