SecureAnyCloud
Deployment guide

Oel 7

Videos

Overview: Oracle Linux 7 on Azure: overview (watch on YouTube)

Launch and log in: Oracle Linux 7 on Azure: launch and log in (watch on YouTube)

Overview

This guide shows you how to deploy and configure Oracle Linux 7 on Microsoft Azure from SecureAnyCloud's preconfigured virtual machine image on the Azure Marketplace.

Oracle Linux is a free, enterprise-grade Linux distribution that Oracle builds to be binary compatible with Red Hat Enterprise Linux 7. Oracle provides the binaries at no cost and permits redistribution, so you need no subscription and no license key to use, patch or resell it. Version 7.9 is the final minor release in the Oracle Linux 7 family. There is no 7.10.

Oracle Linux ships two kernel lines, and this image keeps both. The Unbreakable Enterprise Kernel (UEK) is maintained by Oracle and boots by default. The Red Hat Compatible Kernel (RHCK) is the same 3.10 kernel line that RHEL 7 uses. You can boot either.

End of life status: read before deploying

Oracle Linux 7 reached the end of its free Premier support lifecycle on 31 December 2024. 7.9 is the terminal release, and Oracle no longer publishes new security errata to the free public update channel. This image is patched to the final available Oracle Linux 7.9 state at build time. It is a fixed, capture-date baseline and does not keep receiving new upstream security fixes from the free channel. It is intended for legacy applications and compatibility testing that still require an Oracle Linux 7 or RHEL 7 compatible base.

You own ongoing patching. For continued security updates, attach an Oracle Linux Extended Support (ELS) subscription through ULN, or plan a migration to a supported release such as Oracle Linux 8, 9 or 10. Do not treat this image as a system that patches itself from the free channel.

What you get:

  • Oracle Linux 7.9, binary compatible with RHEL 7
  • Every update available on the accessible Oracle Linux 7 channels, applied at build time (the terminal 7.9 patch state)
  • Both kernel lines: the Unbreakable Enterprise Kernel (booted by default) and the Red Hat Compatible Kernel
  • yum-cron armed, so the machine applies whatever the accessible channels still carry (the free channel is frozen, as described in the end of life note above)
  • Azure Linux Agent (waagent) enabled for extensions, and cloud-init for Azure integration
  • Chronyd for NTP time synchronization
  • SELinux in enforcing mode
  • ol7_latest, ol7_UEKR6 and ol7_addons repositories enabled, so your update path is intact
  • firewalld active with SSH permitted, and the rpcbind (port 111) and standalone dnsmasq (port 53) services disabled, so a fresh machine advertises only SSH
  • Gen2 Hyper-V virtual machine support
  • 24/7 SecureAnyCloud support

Platform: Microsoft Azure (Gen2 Hyper-V) Default user: azureuser

Security posture

This image ships with no known credential. There is no default password and no baked-in SSH key:

  • The root account password is locked, so no one can log in as root with a password.
  • PasswordAuthentication is disabled in the SSH daemon, so every login is by key. The one exception is your own choice. If you select Password as the authentication type in the portal (or pass --admin-password to az vm create), Azure switches SSH password logins on at first boot so that the password you chose works. The portal's Reset password also switches them on (see Troubleshooting).
  • PermitRootLogin is set to prohibit-password, so root cannot be reached with a password even if one is set later.
  • The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
  • The machine identity and the SSH host keys are regenerated uniquely on every instance, so no two machines share a host key either.
  • SELinux is left in enforcing mode, the Oracle Linux default.
  • rpcbind, the RPC port mapper on port 111, is disabled, and the standalone dnsmasq resolver on port 53 is disabled, so a fresh machine advertises only SSH. You can re-enable both on demand, as shown in the networking section.

Because this is an end of life release, the security posture above is what the image ships with. The free channel does not fix new upstream vulnerabilities discovered after the capture date. Treat security hardening and patch sourcing (for example, Oracle Linux ELS) as your responsibility.

Prerequisites

Before you deploy this image, you need:

  • An active Microsoft Azure subscription
  • Access to the Azure portal or the Azure CLI
  • An SSH key pair for Linux VM access
  • Familiarity with Azure VM management

Recommended VM size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

1

Deploy the virtual machine

Option A: Azure portal

  1. Go to the Azure Marketplace and search for "Oracle Linux 7 SecureAnyCloud".
  2. Select the image and choose Create.
  3. Configure the basics:
    • Subscription: Select your Azure subscription.
    • Resource group: Create a new group or select an existing one.
    • Virtual machine name: Enter a name for your VM.
    • Region: Select your preferred Azure region.
    • Size: Standard_B2s is recommended.
  4. Under Administrator account, select SSH public key and enter your key.
  5. Under Inbound port rules, allow SSH (port 22).
  6. Choose Review + create, then choose Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:oel-7:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-linux-7-vm \
  --image sac1647283583153:oel-7:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
2

Connect over SSH

Run these commands on your own workstation, not on the VM. Find the public IP address, then connect:

az vm show --resource-group myResourceGroup --name my-oracle-linux-7-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

If you deployed with an SSH key, there is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time. If you chose a password in the portal instead, log in with that password: ssh <your-username>@<vm-ip>.

3

Confirm the release

Check that the machine runs the Oracle Linux 7.9 release you expect:

cat /etc/oracle-release grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release uname -rm

Expected output:

Oracle Linux Server release 7.9 NAME="Oracle Linux Server" VERSION="7.9" ID="ol" VERSION_ID="7.9" 5.4.17-2136.338.4.2.el7uek.x86_64 x86_64

The el7uek tag on the kernel version shows that the machine is running the Unbreakable Enterprise Kernel. Oracle Linux 7 also ships the Red Hat Compatible Kernel (a 3.10 el7 kernel) alongside it. The next step shows both.

4

Check the patch level and the two kernel lines

The image is patched to the terminal Oracle Linux 7.9 state at build time. Because 7.9 is end of life, the free public update channel is frozen. yum check-update returns exit code 100 when updates are pending, and 0 when the machine already has everything the accessible channels carry:

sudo yum -q check-update; echo "exit code: $?"

An exit code of 0 means there is nothing further to apply from the free channel. It does not mean the machine is free of vulnerabilities discovered after the capture date. See the end of life note at the top of this guide. For continued security updates, attach an Oracle Linux Extended Support subscription.

List the enabled repositories to confirm that your update path is intact:

yum -q repolist enabled

Expected output:

repo id repo name status ksplice-uptrack/7Server/x86_64 Ksplice Uptrack for Oracle Linux 26 ol7_UEKR6/x86_64 Latest Unbreakable Enterprise Kernel 1,128+273 ol7_addons/x86_64 Oracle Linux 7Server Add ons (x86_64 568+413 ol7_latest/x86_64 Oracle Linux 7Server Latest (x86_64) 22,056+5,373

Both kernel lines are installed and managed by yum. List them, and check which one is booted:

rpm -q kernel kernel-uek uname -r

Expected output:

kernel-3.10.0-1160.119.1.0.5.el7.x86_64 kernel-uek-5.4.17-2136.338.4.2.el7uek.x86_64 5.4.17-2136.338.4.2.el7uek.x86_64

The UEK line (kernel-uek) is the default and is what uname -r reports. The RHCK line (kernel, the 3.10 el7 kernel) is available if you prefer strict RHEL kernel compatibility. Select it from the GRUB menu at boot.

This image arms yum-cron, Oracle Linux 7's unattended updater, so the machine applies whatever the accessible channels still carry. On the frozen free channel, that is effectively nothing new. The armed updater pays off when you attach an Oracle Linux Extended Support subscription, because the mechanism is already in place. You can still run updates on your own schedule:

sudo yum -y update

If an update installed a new kernel, reboot:

sudo systemctl reboot
5

Verify the security posture

Confirm that SELinux is enforcing, root is locked and SSH is key-only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|challengeresponseauthentication) '

Expected output:

Enforcing root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.) permitrootlogin without-password passwordauthentication no challengeresponseauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root cannot authenticate with a password. On Oracle Linux 7's OpenSSH 7.4, ChallengeResponseAuthentication is the keyword that controls the interactive password path, and it is disabled here.

6

Verify Azure integration

Confirm that the Azure Linux Agent, cloud-init and time synchronization are healthy and that the unattended updater is armed. Then check your resources:

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version sudo cloud-init status
systemctl is-enabled yum-cron.service
systemctl is-active chronyd df -h / free -h

Expected output:

active enabled /usr/bin/cloud-init 19.4 status: done enabled active Filesystem Size Used Avail Use% Mounted on /dev/sda2 30G 6.5G 21G 24% / total used free shared buff/cache available Mem: 3.5G 202M 2.7G 16M 614M 3.1G Swap: 0B 0B 0B

waagent is what lets Azure run extensions, resize the OS disk and report VM health, so it is enabled and active. On this image, cloud-init handles provisioning. It injects your SSH key, regenerates the per-VM host keys and runs any custom data or cloud-init user data you supply. waagent runs the extension handler.

Run cloud-init status with sudo, as above. Without sudo, the cloud-init 19.4 build on Oracle Linux 7 (Python 2.7) crashes with NameError: global name 'PermissionError' is not defined when it cannot read its root-only status file. This is a bug in the command's error handling only. Provisioning itself completes, and sudo cloud-init status reports status: done.

7

Networking and the firewall

The Azure Network Security Group (NSG) is the outer control plane for inbound and outbound traffic, and it is the first place you open a port. The image advertises a single inbound port, SSH on 22.

Confirm what is actually listening before you open anything:

ss -tlnp

On a fresh machine the only external listener is sshd on port 22. rpcbind (port 111) and the standalone dnsmasq resolver (port 53) are disabled on this image, so those ports are closed by default.

This image also runs a host firewall. firewalld is active and enabled, uses the public zone and already permits SSH. Inspect it with:

sudo firewall-cmd --state sudo firewall-cmd --list-all

The public zone lists ssh among its allowed services, which is why your key-based login works out of the box. To expose another service, open it in both the Azure NSG and firewalld. For example, to allow HTTPS, run:

sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Always keep the ssh service allowed, so that a firewall change does not lock you out.

If you need NFSv3, which relies on the RPC port mapper, re-enable rpcbind:

sudo systemctl enable --now rpcbind.socket

NFSv4 does not need rpcbind and works without this step. If you want a local caching DNS resolver, re-enable dnsmasq with sudo systemctl enable --now dnsmasq.

8

Install software and add a user

Install packages from the enabled repositories in the usual way. For example:

sudo yum -y install git

To add another administrator, create the account with sudo adduser <name>. Add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys, with mode 600 on the file and mode 700 on the .ssh directory, both owned by that user.

The image ships with no human accounts at all, so azureuser is the only login until you add one:

getent group wheel

Common use cases

  • Hosting legacy applications that require an Oracle Linux 7 or RHEL 7 base
  • Compatibility and regression testing against the Oracle Linux 7 platform
  • Lift-and-shift of existing Oracle Linux 7 workloads to Azure

Troubleshooting

You cannot connect over SSH

  • Verify that the VM is in the Running state in the Azure portal
  • Check that port 22 is allowed in the Network Security Group
  • Ensure that you are using the correct username: azureuser
  • Verify that your SSH key matches the one you supplied at create time. On a key-only deployment, password login is off, so a wrong key cannot fall back to a password prompt. If you have lost the key, use the portal's Reset password (below)

To see which key your client is actually offering, run ssh -v azureuser@<vm-ip> from your workstation and look for the Offering public key lines.

Reset the password from the portal

The portal's Reset password (and az vm user update --username azureuser --password ...) sets the new password and switches SSH password logins on, and the portal reports Succeeded. On this image, the new password is refused until the SSH service restarts. The reset tries to restart a service called ssh, but on Oracle Linux 7 the SSH service is sshd, so the running daemon keeps its old key-only settings. Restart it in any one of these ways, then log in with the new password:

  • In the portal, open the VM, go to Operations > Run command > RunShellScript, and run systemctl restart sshd. This needs no login and takes about 30 seconds.
  • Restart the VM from the portal.
  • If you can still log in with your key, run sudo systemctl restart sshd.

To use the Run Command route from the Azure CLI, run this on your own workstation:

az vm run-command invoke --resource-group myResourceGroup --name my-oracle-linux-7-vm \
  --command-id RunShellScript --scripts "systemctl restart sshd"

Two things change when you use Reset password:

  • SSH password logins are switched on for the machine (PasswordAuthentication yes in /etc/ssh/sshd_config), so any account with a password can now log in with it.
  • sudo asks for that user's password, because the reset adds /etc/sudoers.d/waagent.

Once your key works again, you can return to key-only logins:

sudo sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl restart sshd

The Azure agent is not running

sudo systemctl status waagent

If the agent is not running, start it. Run this command yourself on the VM:

sudo systemctl enable --now waagent

Package manager issues

Refresh the metadata cache first:

sudo yum clean all
sudo yum makecache

If repositories are unreachable, check DNS resolution. getent is always present and resolves through the same system resolver:

getent hosts yum.oracle.com

If Oracle has moved a repository to its archive, point its baseurl at https://yum.oracle.com/repo/OracleLinux/OL7/.... Install bind-utils if you want dig and nslookup.

A service is blocked and the logs mention SELinux

SELinux is enforcing on this image. Rather than disabling it, look at what it denied. On a healthy machine there are no recent denials, so the command reports none:

sudo ausearch -m AVC -ts recent 2>/dev/null || echo "no recent AVC denials"

Important notes

End of life. Oracle Linux 7 reached the end of its free Premier support lifecycle on 31 December 2024, and 7.9 is the terminal release. This image is patched to the final available Oracle Linux 7.9 state at build time. The free public channel publishes no further security errata. For continued security updates, attach an Oracle Linux Extended Support subscription through ULN, or migrate to a supported release such as Oracle Linux 8, 9 or 10. You own ongoing patching for this image.

Oracle Linux is free and open source, and Oracle explicitly permits its redistribution. No single license covers it. It is a distribution assembled from thousands of independently packaged components, each with its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. You can read every package's terms with rpm -qi <package> and under /usr/share/licenses/. No subscription, license key or Red Hat entitlement is required. A paid Oracle Linux Support subscription is optional and is not needed to use, patch or resell the operating system.

Oracle and Oracle Linux are trademarks of Oracle Corporation. This guide uses the names only to identify the distribution that this image contains. SecureAnyCloud is not affiliated with, endorsed by or sponsored by Oracle Corporation.

Support

For help with this image, contact SecureAnyCloud support:

  • Website: secureanycloud.com
  • Product catalog: secureanycloud.com/products
  • User guides: secureanycloud.com/guides
  • SLA: 24-hour response guaranteed

Deploy on Azure

Launch Oracle Linux 7 on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure