Oel 10 Minimal

Option A: Azure Portal

• Open the Azure Marketplace and search for "Oracle Linux 10 Minimal SecureAnyCloud".
• Select the image, then select Create.
• On the Basics tab, set Subscription to your Azure subscription.
• Set Resource Group to a new or existing group.
• Enter a name for your VM in Virtual Machine Name.
• Set Region to your preferred Azure region.
• Set Size to Standard_B2s (recommended).
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Select Review + Create, then select Create.

Option B: Azure CLI

Run the following commands on your own workstation. Substitute your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine.

az vm image terms accept --urn sac1647283583153:oel-10-minimal:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-linux-10-minimal-vm \
  --image sac1647283583153:oel-10-minimal:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect.

az vm show --resource-group myResourceGroup --name my-oracle-linux-10-minimal-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check that the machine is Oracle Linux 10.

cat /etc/oracle-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release uname -rm

The expected output follows. Your kernel version may be newer.

Oracle Linux Server release 10.2 NAME="Oracle Linux Server" VERSION="10.2" ID="ol" VERSION_ID="10.2" PLATFORM_ID="platform:el10" 6.12.0-206.104.3.3.el10uek.x86_64 x86_64

This listing tracks the Oracle Linux 10 major release, not a frozen minor release. The image was patched to the point release that was current when it was built. Your own updates roll it forward within Oracle Linux 10, so you keep receiving security fixes. The el10uek tag on the kernel shows that the machine runs the Unbreakable Enterprise Kernel.

Every available update was applied when this image was built. dnf check-update exits with 100 when updates are pending and with 0 when none are.

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"
dnf needs-restarting -r

exit=0 No core libraries or services have been updated since boot-up. Reboot should not be necessary.

Both Oracle kernel lines are installed, with one current version of each. Superseded kernels are removed before capture.

rpm -q kernel-uek-core kernel-core

kernel-uek-core-6.12.0-206.104.3.3.el10uek.x86_64 kernel-core-6.12.0-211.53.1.el10_2.x86_64

The UEK line is the default. The Red Hat Compatible Kernel (the el10_2 kernel) is available if you need strict RHEL kernel compatibility. Select it at boot with grubby. Both kernels receive updates.

Your update path is the rolling Oracle Linux 10 repositories, with no per-minor repository pinned.

dnf repolist --enabled

repo id repo name ol10_UEKR8 Oracle Linux 10 UEK Release 8 (x86_64) ol10_addons Oracle Linux 10 Addons (x86_64) ol10_appstream Oracle Linux 10 Application Stream Packages (x86_64) ol10_baseos_latest Oracle Linux 10 BaseOS Latest (x86_64)

Count the installed packages.

rpm -qa --qf '%{NAME}\n' | grep -vx gpg-pubkey | sort -u | wc -l

429

The image carries a package profile file. It records the contract, the standard image's package count and every package that was removed.

grep -E '^(standard|minimal)_image_packages=' /var/lib/sac/data/minimal-profile.txt

standard_image_packages=597 minimal_image_packages=429

To see the full lists of removed packages, read the file itself with cat /var/lib/sac/data/minimal-profile.txt. Then spot-check a few of the removed packages.

rpm -q perl-interpreter llvm-libs tuned sos nfs-utils rpcbind bluez udisks2 geolite2-city || true

package perl-interpreter is not installed package llvm-libs is not installed package tuned is not installed package sos is not installed package nfs-utils is not installed package rpcbind is not installed package bluez is not installed package udisks2 is not installed package geolite2-city is not installed

Confirm that the platform essentials are all still present.

rpm -q systemd NetworkManager openssh-server cloud-init WALinuxAgent firewalld lvm2 chrony dnf-automatic

systemd-257-23.0.1.el10_2.2.x86_64 NetworkManager-1.56.0-2.0.1.el10_2.x86_64 openssh-server-9.9p1-25.0.1.el10_2.x86_64 cloud-init-24.4-7.0.1.el10_2.1.noarch WALinuxAgent-2.14.0.1-3.0.1.el10.noarch firewalld-2.4.3-4.0.1.el10_2.noarch lvm2-2.03.36-2.el10.x86_64 chrony-4.8-2.0.1.el10.x86_64 dnf-automatic-4.20.0-22.0.1.el10_2.noarch

You can read Oracle's own definition of the group that the image is built around.

dnf -q group info core | head -5

Group: Core Description: Minimal host installation Mandatory Packages: audit basesystem

Adding back something you need

Anything that was removed installs straight from the enabled Oracle repositories. For example, to mount an NFS share, add the NFS client. Enable rpcbind afterwards only if you need NFS version 3.

sudo dnf install -y nfs-utils

Other common additions are bind-utils for dig and nslookup, policycoreutils-python-utils for semanage, tuned for tuning profiles, sos for Oracle support reports, iscsi-initiator-utils for iSCSI disks and mdadm for software RAID across data disks.

The standard Oracle Linux 10 base does not include dnf-automatic. This image installs it and enables its timer, so the machine applies updates on its own schedule. Check the timer and the policy with these commands.

systemctl is-enabled dnf-automatic.timer
systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec' grep -E '^(apply_updates|upgrade_type|download_updates|reboot) ' /etc/dnf/automatic.conf

enabled OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m upgrade_type = default download_updates = yes apply_updates = yes reboot = never

The policy applies all available updates, not only those tagged as security errata, and it never reboots automatically. A kernel update therefore waits for a maintenance window you choose.

upgrade_type is deliberately default rather than security. A security-only policy depends on errata metadata being present for every update, and where it is missing, the policy silently applies nothing.

Check periodically whether a restart is owed with dnf needs-restarting -r. To opt out of automatic updates, run sudo systemctl disable --now dnf-automatic.timer.

You can still update on your own schedule at any time.

sudo dnf upgrade -y

Confirm that SELinux is enforcing and that root is locked. The L in the second field means locked.

getenforce
sudo passwd -S root

Enforcing root L 2009-12-22 -1 -1 -1 -1

Confirm that no account on the machine has a usable password. The command prints nothing on a clean image.

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy rather than the config file.

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication) '

permitrootlogin without-password pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no

without-password is how OpenSSH reports the prohibit-password setting. A drop-in file that sorts ahead of every other SSH configuration file pins that policy.

grep -vE '^#' /etc/ssh/sshd_config.d/00-sac-hardening.conf

PermitRootLogin prohibit-password PasswordAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no

There is no swap on the operating system disk, so the following command prints nothing.

swapon --show

Confirm what is listening. SSH on port 22 is the only TCP listener, and the only UDP socket is chronyd on the loopback address.

ss -tln
ss -uln

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.1:323 0.0.0.0:* UNCONN 0 0 [::1]:323 [::]:*

The Azure Linux Agent handles extensions and the portal's recovery features, and cloud-init provisions the machine. Confirm that both are healthy.

systemctl is-active waagent rpm -q WALinuxAgent cloud-init chrony cloud-init status

active WALinuxAgent-2.14.0.1-3.0.1.el10.noarch cloud-init-24.4-7.0.1.el10_2.1.noarch chrony-4.8-2.0.1.el10.x86_64 status: done

The kernel puts a console on ttyS0. This console makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH.

grep -o 'console=ttyS0[^ ]*' /proc/cmdline

console=ttyS0,115200n8

Time synchronisation runs through chronyd, with the Hyper-V precision clock (PHC0) selected as the source. The clock and time zone are UTC, matching the Azure host clock. Your offsets will differ from the example.

chronyc -n sources | head -3 timedatectl show -p Timezone -p LocalRTC

MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* PHC0 0 3 377 7 +9980ns[ +12us] +/- 12us Timezone=UTC LocalRTC=no

The operating system disk uses Oracle's Azure layout. It has an EFI system partition, /boot on XFS, and an LVM volume group rootvg that holds the root filesystem and a dedicated volume for kernel crash dumps.

df -h / findmnt -no SOURCE,FSTYPE,TARGET /boot/efi findmnt -no SOURCE,FSTYPE,TARGET /boot findmnt -no SOURCE,FSTYPE,TARGET /var/crash
sudo pvs
sudo lvs

Filesystem Size Used Avail Use% Mounted on /dev/mapper/rootvg-rootlv 27G 2.9G 24G 11% / /dev/sda1 vfat /boot/efi /dev/sda3 xfs /boot /dev/mapper/rootvg-crashlv xfs /var/crash PV VG Fmt Attr PSize PFree /dev/sda4 rootvg lvm2 a-- <46.90g 0 LV VG Attr LSize Pool Origin Data% Meta% Move Log Cpy%Sync Convert crashlv rootvg -wi-ao---- 20.00g rootlv rootvg -wi-ao---- <26.90g

The volume group is fully allocated (PFree 0), so growing the root filesystem starts with a bigger OS disk.

Kdump is active and writes crash dumps to /var/crash, the same crash dump posture as Oracle's own image.

systemctl is-active kdump grep -o 'crashkernel=[^ ]*' /proc/cmdline

active crashkernel=1G-64G:448M,64G-:512M

To make the root filesystem bigger, first increase the OS disk size in the Azure portal, or with az disk update, while the VM is deallocated. Start the VM, then grow the partition, the physical volume and the logical volume. The -r flag grows the XFS filesystem in the same step.

sudo growpart /dev/sda 4
sudo pvresize /dev/sda4
sudo lvextend -r -l +100%FREE /dev/rootvg/rootlv

Standard_B2s also has a local temporary disk mounted at /mnt. Treat anything on it as disposable, because Azure erases it whenever the machine is deallocated or moved.

The Azure Network Security Group is the outer control for inbound traffic, and it is the first place you open a port. This image also runs Oracle Linux's host firewall, firewalld, with the public zone allowing only SSH and the DHCPv6 client.

sudo firewall-cmd --state sudo firewall-cmd --list-services

running dhcpv6-client ssh

To expose another service, open it in both the Azure NSG and firewalld. For example, these commands allow HTTPS.

sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Always keep the ssh service allowed, so that a firewall change does not lock you out.

The BaseOS repository carries the core operating system, and the Application Stream carries the application packages. Most software therefore installs directly with dnf.

dnf -q list --available nginx 2>/dev/null | tail -2

nginx.src 2:1.26.3-6.0.1.el10_2.6 ol10_appstream nginx.x86_64 2:1.26.3-6.0.1.el10_2.6 ol10_appstream

Install and enable a package in the usual way. For example, run sudo dnf install -y nginx, then sudo systemctl enable --now nginx. Open the port in your Network Security Group and in firewalld.

The image ships with no human accounts at all, so the administrator you named at create time is the only login until you add one. To add another administrator, create the account with sudo adduser <name>. Add it to the wheel group with sudo usermod -aG wheel <name>.

Then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600. Give the .ssh directory mode 700, owned by that user. Confirm the group membership with this command.

getent group wheel