Oel 10 LVM

Option A: Azure Portal

• Open the Azure Marketplace and search for "Oracle Linux 10 LVM SecureAnyCloud".
• Select the image and select Create.
• Configure the basics:
• Subscription: select your Azure subscription.
• Resource Group: create a new group or select an existing one.
• Virtual Machine Name: enter a name for your VM.
• Region: select your preferred region.
• Size: Standard_B2s is recommended.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Select Review + Create, then select Create.

Option B: Azure CLI

Run this on your own workstation. Substitute your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:oel-10-lvm:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oel10-lvm-vm \
  --image sac1647283583153:oel-10-lvm:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

To start with a larger operating system disk, add --os-disk-size-gb 128 and follow Growing the root filesystem in Step 6 once the machine is up. The root filesystem is on a logical volume, so the extra capacity Azure provides is not claimed automatically.

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oel10-lvm-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check that the machine is Oracle Linux 10:

cat /etc/oracle-release

Oracle Linux Server release 10.2

The os-release fields carry the same information in a machine-readable form, which configuration management tools read:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release

NAME="Oracle Linux Server" VERSION="10.2" ID="ol" VERSION_ID="10.2" PLATFORM_ID="platform:el10"

The el10uek suffix on the kernel identifies the Unbreakable Enterprise Kernel, and x86_64 confirms the architecture:

uname -srm getconf PAGESIZE

Linux 6.12.0-206.104.3.3.el10uek.x86_64 x86_64 4096

The processor depends on the Azure size and region you chose, so yours can differ from the example below:

lscpu | grep -E '^(Architecture|Vendor ID|Model name|CPU\(s\)):'

Architecture: x86_64 CPU(s): 2 Vendor ID: GenuineIntel Model name: Intel(R) Xeon(R) Platinum 8171M CPU @ 2.60GHz

The version reported is the current Oracle Linux 10 point release the image was patched to. Your kernel and point release will be the same or newer.

Oracle Linux 10 on x86-64 ships two kernel lines, and this image keeps both. The Unbreakable Enterprise Kernel (kernel-uek-core, the el10uek packages) is Oracle's own line, and the machine boots it. The Red Hat Compatible Kernel (kernel-core, the el10_2 packages) is the stock RHEL kernel, kept for applications certified against it. One version of each is installed. Superseded versions of both lines are removed before capture:

rpm -q kernel-uek-core kernel-core
sudo grubby --default-kernel

kernel-uek-core-6.12.0-206.104.3.3.el10uek.x86_64 kernel-core-6.12.0-211.54.1.el10_2.x86_64 /boot/vmlinuz-6.12.0-206.104.3.3.el10uek.x86_64

New UEK releases arrive through the enabled ol10_UEKR8 repository and new RHCK releases through ol10_baseos_latest, so a normal dnf update keeps both current. To boot the Red Hat Compatible Kernel instead, run sudo grubby --set-default /boot/vmlinuz-<rhck-version> and reboot. The command sudo grubby --info=ALL | grep ^kernel lists the available entries.

Every available update was applied when this image was built. dnf check-update exits 100 when updates are pending and 0 when none are:

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"

exit=0

Nothing is waiting on a reboot either:

sudo dnf needs-restarting -r

No core libraries or services have been updated since boot-up. Reboot should not be necessary.

Your update path is Oracle's rolling Oracle Linux 10 channels: BaseOS Latest, AppStream, UEK Release 8 and Addons. None of the frozen per-point-release repositories is enabled, so the machine always resolves the current Oracle Linux 10 packages:

dnf repolist --enabled

repo id repo name ol10_UEKR8 Oracle Linux 10 UEK Release 8 (x86_64) ol10_addons Oracle Linux 10 Addons (x86_64) ol10_appstream Oracle Linux 10 Application Stream Packages (x86_64) ol10_baseos_latest Oracle Linux 10 BaseOS Latest (x86_64)

Automatic updates

dnf-automatic is installed and its timer is enabled, so the machine applies updates on its own schedule:

systemctl is-enabled dnf-automatic.timer
systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec'

enabled OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m

The policy applies all available updates, not only those tagged as security errata, and never reboots automatically. A kernel update waits for a window you choose instead of restarting the machine without warning:

grep -E '^(upgrade_type|download_updates|apply_updates|reboot) ' /etc/dnf/automatic.conf

upgrade_type = default download_updates = yes apply_updates = yes reboot = never

dnf-automatic is not installed on the stock Oracle Linux 10 image, so an unmodified machine never patches itself. This image installs it and sets upgrade_type = default rather than security. A security-only policy depends on errata metadata being attached to every update, and an update without it is silently skipped. Because reboot = never, check periodically whether a restart is owed after a kernel update, using the needs-restarting -r command above. To review Oracle's security advisories yourself, run sudo dnf updateinfo list --security. To opt out of automatic updates entirely, run sudo systemctl disable --now dnf-automatic.timer.

Like every Oracle Linux image on Azure, this image uses an LVM root layout. The root filesystem sits on a logical volume inside a volume group. The /boot and EFI partitions stay as plain partitions, which the firmware and boot loader need. This step documents the layout as shipped and the commands that reshape it.

df -hT / /var/crash /boot /boot/efi

Filesystem Type Size Used Avail Use% Mounted on /dev/mapper/rootvg-rootlv xfs 27G 2.8G 25G 11% / /dev/mapper/rootvg-crashlv xfs 20G 424M 20G 3% /var/crash /dev/sda3 xfs 2.0G 353M 1.6G 18% /boot /dev/sda1 vfat 100M 9.0M 91M 10% /boot/efi

The whole disk looks like this. Partition 1 is the EFI system partition, partition 2 is the 1 MB BIOS boot partition, partition 3 is /boot, and partition 4 is the LVM physical volume that holds everything else. sdb is the Azure temporary disk, described in Step 8:

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT

NAME SIZE TYPE FSTYPE MOUNTPOINT sda 49G disk ├─sda1 100M part vfat /boot/efi ├─sda2 1M part ├─sda3 2G part xfs /boot └─sda4 46.9G part LVM2_member ├─rootvg-rootlv 26.9G lvm xfs / └─rootvg-crashlv 20G lvm xfs /var/crash sdb 8G disk └─sdb1 8G part ext4 /mnt

One physical volume, the fourth partition of the operating system disk, backs the volume group rootvg:

sudo pvs
sudo vgs

PV VG Fmt Attr PSize PFree /dev/sda4 rootvg lvm2 a-- <46.90g 0 VG #PV #LV #SN Attr VSize VFree rootvg 1 2 0 wz--n- <46.90g 0

The volume group holds two logical volumes: rootlv for the root filesystem and crashlv, mounted at /var/crash, where kdump writes a kernel crash dump if the machine ever panics:

sudo lvs -o lv_name,lv_size,lv_path,devices rootvg

LV LSize Path Devices crashlv 20.00g /dev/rootvg/crashlv /dev/sda4(0) rootlv <26.90g /dev/rootvg/rootlv /dev/sda4(5120)

The kernel command line tells the early boot environment which volume group and logical volume hold the root filesystem, and lvm2 is installed so every LVM tool is available:

grep -o 'rd.lvm[^ ]*' /proc/cmdline rpm -q lvm2 cloud-utils-growpart xfsprogs

rd.lvm.vg=rootvg rd.lvm.lv=rootvg/rootlv lvm2-2.03.36-2.el10.x86_64 cloud-utils-growpart-0.33-11.el10.noarch xfsprogs-6.18.0-1.0.4.el10.x86_64

Growing the root filesystem

The volume group ships with no free space, and enlarging the Azure disk does not grow the root volume on its own. The automatic partition growth in cloud-init skips a root filesystem on a logical volume, so the extra capacity stays unallocated until you claim it. Create the machine with a larger disk (--os-disk-size-gb), or resize the disk in Azure by stopping and deallocating the VM, raising the size and starting it again. Then run these three commands. All of them work online, with no reboot:

sudo growpart /dev/sda 4
sudo pvresize /dev/sda4
sudo lvextend -r -l +100%FREE rootvg/rootlv df -h /

growpart extends partition 4 to the end of the disk, pvresize makes LVM see the larger physical volume, and lvextend -r hands all the free space to rootlv and grows its XFS filesystem in the same step. On a machine created with a 64 GB operating system disk this takes / from 27 GB to 42 GB, online and without a reboot. If growpart prints NOCHANGE, the partition already fills the disk. Confirm the physical volume name with sudo pvs first. It is /dev/sda4 on this image.

Adding a data volume

Attach a new managed data disk in Azure. The portal and CLI show its LUN, and the matching device is /dev/disk/azure/scsi1/lun<N>. Then either give the disk its own volume group, which keeps application data separate from the operating system, or add it to rootvg:

sudo pvcreate /dev/disk/azure/scsi1/lun0
sudo vgcreate datavg /dev/disk/azure/scsi1/lun0
sudo lvcreate -n datalv -l 100%FREE datavg
sudo mkfs.xfs /dev/datavg/datalv
sudo mkdir -p /data echo '/dev/datavg/datalv /data xfs defaults,nofail 0 0' | sudo tee -a /etc/fstab
sudo mount /data

The nofail option lets the machine still boot if the data disk is ever detached. Do not use the temporary disk sdb for a volume group. It is wiped whenever the machine is deallocated or moved to another host.

Confirm that SELinux is enforcing:

getenforce

Enforcing

Confirm that the root account is locked. The L in the second field means locked:

sudo passwd -S root

root L 2009-12-22 -1 -1 -1 -1

Confirm that no account on the machine has a usable password. This prints nothing on a clean image:

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy rather than the config file, because the running daemon is what a client meets. without-password is OpenSSH's name for prohibit-password. Root can never log in with a password and has no key installed:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication) '

permitrootlogin without-password pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no

A drop-in file that sorts ahead of every other SSH configuration file pins that policy, so a later package update to the main configuration cannot quietly loosen it:

sudo grep -vE '^#' /etc/ssh/sshd_config.d/00-sac-hardening.conf

PermitRootLogin prohibit-password PasswordAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no

There is no swap on the operating system disk, because a swap file baked into a Marketplace image is not permitted. This prints nothing:

swapon --show

Confirm what is listening. SSH on port 22 is the only service reachable from the network. The only other socket is chronyd, bound to the loopback address for time synchronization:

ss -tln
ss -uln

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.1:323 0.0.0.0:* UNCONN 0 0 [::1]:323 [::]:*

The stock Oracle image enables rpcbind, which listens on port 111 for NFS version 3. NFS version 4 client mounts do not need it, so this image ships it disabled with nfs-utils still installed:

systemctl is-enabled rpcbind.socket rpcbind.service || true

disabled disabled

If you need NFS version 3, enable it with sudo systemctl enable --now rpcbind.socket.

The Azure Linux Agent handles extensions and the portal's recovery features, and cloud-init provisions the machine:

systemctl is-active waagent rpm -q WALinuxAgent cloud-init chrony cloud-init status

active WALinuxAgent-2.14.0.1-3.0.1.el10.noarch cloud-init-24.4-7.0.1.el10_2.1.noarch chrony-4.8-2.0.1.el10.x86_64 status: done

The kernel puts a console on ttyS0, which is what makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH:

grep -o 'console=ttyS0[^ ]*' /proc/cmdline | head -1

console=ttyS0,115200n8

Time synchronization runs through chronyd against the Azure host clock, exposed as the PHC0 reference clock. Your offsets will differ. The clock and timezone are UTC:

chronyc -n sources | head -4 timedatectl | grep -E 'Time zone|synchronized|RTC in local TZ'

MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* PHC0 0 3 377 7 -18us[ -19us] +/- 2998ns ^- 69.9.131.124 2 9 367 468 +2514us[+2435us] +/- 109ms Time zone: UTC (UTC, +0000) System clock synchronized: yes RTC in local TZ: no

The stock Oracle image uses the America/New_York timezone with the hardware clock read as local time. Azure's host clock is UTC, so that setting shifts the clock by several hours early in every boot until chronyd corrects it. This image sets both to UTC. To display local time instead, run sudo timedatectl set-timezone Europe/London (or your zone). Leave the hardware clock in UTC.

NetworkManager configures eth0 from a keyfile that cloud-init writes at first boot, and there are no legacy ifcfg network scripts on Oracle Linux 10. If you configure networking by hand, use nmcli or NetworkManager keyfiles rather than creating ifcfg files:

nmcli -f DEVICE,TYPE,STATE device systemctl is-system-running

DEVICE TYPE STATE eth0 ethernet connected lo loopback connected (externally) running

On a size with Accelerated Networking enabled, you also see a second, unmanaged interface (a name such as enP47143s1) bonded to eth0 and carrying the same address. Leave it unmanaged. Keep any profile you create bound to eth0 by name rather than by MAC address, because the accelerated interface shares that MAC.

The temporary disk

Sizes that include a local temporary disk, such as Standard_B2s, present it as sdb, mounted at /mnt. Oracle's temp-disk-dataloss-warning service writes a README there at every boot:

systemctl is-system-running ls /mnt

running DATALOSS_WARNING_README.txt lost+found

Treat everything on /mnt as disposable. It is wiped when the machine is deallocated or moved to another host. On sizes without a temporary disk, such as Standard_D2s_v5 or Standard_B2ts_v2, Oracle's service would exit with an error and leave systemctl is-system-running reporting degraded. This image adds a condition to that unit so that it is skipped cleanly, and the system state stays running on every size.

The Azure Network Security Group is the control plane for inbound and outbound traffic. Oracle Linux also runs firewalld as a host firewall, and this image leaves it active, as Oracle ships it:

systemctl is-active firewalld
sudo firewall-cmd --get-default-zone sudo firewall-cmd --list-services

active public dhcpv6-client ssh

The stock Oracle zone also allows the cockpit service, even though Cockpit is not installed. This image removes that allowance so the firewall surface matches what is installed. Because firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service. For example, to serve HTTPS:

sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

AppStream carries the application packages:

dnf -q repoquery --arch x86_64 --latest-limit 1 nginx

nginx-2:1.26.3-6.0.1.el10_2.7.x86_64

Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx, then open the port in your Network Security Group and in firewalld.

To add another administrator, create the account with sudo adduser <name>, add it to the wheel group with sudo usermod -aG wheel <name>, then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600 and the .ssh directory mode 700, owned by that user. The image ships with no human accounts, so the administrator you named at create time is the only login until you add one.