Oel 8.10

Option A: Azure Portal

• Navigate to the Azure Marketplace and search for "Oracle Linux 8.10 SecureAnyCloud".
• Select the image and click Create.
• Configure the basics:
  • Subscription: select your Azure subscription.
  • Resource Group: create a new group or select an existing one.
  • Virtual Machine Name: enter a name for your VM.
  • Region: select your preferred Azure region.
  • Size: Standard_B2s is recommended.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:oel-8-10:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-linux-8-10-vm \
  --image sac1647283583153:oel-8-10:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run the following on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-oracle-linux-8-10-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key that your client is offering.

Check that the machine is the Oracle Linux 8.10 release you expect:

cat /etc/oracle-release grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release uname -rm

Expected output:

Oracle Linux Server release 8.10 NAME="Oracle Linux Server" VERSION="8.10" ID="ol" PLATFORM_ID="platform:el8" 5.15.0-322.203.3.4.5.el8uek.x86_64 x86_64

The el8uek tag on the kernel version shows that the machine is running the Unbreakable Enterprise Kernel. Oracle Linux also ships the Red Hat Compatible Kernel (a 4.18 el8_10 kernel) alongside it. The next step shows both.

The image is fully updated at build time. dnf check-update returns exit code 100 when updates are pending and 0 when none are. Run it:

sudo dnf check-update echo "exit code: $?"

List the enabled repositories to confirm your update path is intact:

dnf repolist --enabled

Expected output:

repo id repo name ol8_UEKR7 Latest Unbreakable Enterprise Kernel Release 7 for Oracle Linux 8 (x86_64) ol8_addons Oracle Linux 8 Addons (x86_64) ol8_appstream Oracle Linux 8 Application Stream (x86_64) ol8_baseos_latest Oracle Linux 8 BaseOS Latest (x86_64)

dnf installs and manages both kernel lines. List them, and see which one is booted:

rpm -q kernel-uek-core kernel-core uname -r

The UEK line (kernel-uek-*) is the default and is what uname -r reports. The RHCK line (kernel-*, the 4.18 el8_10 kernel) is available if you prefer strict RHEL kernel compatibility. Select it from the GRUB menu at boot. Both receive security updates.

Because 8.10 is the last minor release in the RHEL 8 family, applying updates keeps you on 8.10 rather than moving you to a new point release.

This image also arms dnf-automatic, so security updates are downloaded and applied on a timer without any action from you. You can still run updates on your own schedule:

sudo dnf upgrade -y

Reboot if a new kernel was installed:

sudo systemctl reboot

Confirm that SELinux is enforcing, root is locked and SSH is key-only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication)'

Expected output:

Enforcing root LK 2009-12-21 -1 -1 -1 -1 (Alternate authentication scheme in use.) permitrootlogin without-password pubkeyauthentication yes passwordauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password.

Confirm that the Azure Linux Agent, cloud-init and time synchronisation are healthy and that unattended security updates are armed. Then check your resources:

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version
systemctl is-enabled dnf-automatic.timer
systemctl is-active chronyd df -h / free -h

Expected output:

active enabled /usr/bin/cloud-init 23.4-7.0.4.el8_10.12 enabled active Filesystem Size Used Avail Use% Mounted on /dev/mapper/rootvg-rootlv 37G 4.7G 33G 13% / total used free shared buff/cache available Mem: 3.5Gi 305Mi 2.5Gi 16Mi 795Mi 3.0Gi

waagent lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled.

When dnf-automatic.timer is enabled, the machine keeps applying security updates on its own after launch.

The Azure Network Security Group is the outer control plane for inbound and outbound traffic, and it is the first place you open a port. The image advertises a single inbound port, SSH on 22.

Before you open anything, confirm what is actually listening:

ss -tlnp

On a fresh machine the only listener is sshd on port 22. rpcbind is disabled on this image, so port 111 is closed by default.

Unlike a stock cloud image, this build also runs a host firewall. firewalld is active and enabled, uses the public zone, and already permits SSH. Inspect it with:

sudo firewall-cmd --state sudo firewall-cmd --list-all

The public zone lists ssh among its allowed services, which is why your key-based login works out of the box.

To expose another service, open it in both the Azure NSG and firewalld. For example, to allow HTTPS:

sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Always keep the ssh service allowed, so that a firewall change does not lock you out.

If you need NFSv3, which relies on the RPC port mapper, re-enable rpcbind:

sudo systemctl enable --now rpcbind.socket

NFSv4 does not need rpcbind and works without this step.

The Application Stream carries the application packages. It ships several versions of the same language or database as separate module streams, so you can pick a version rather than take the default. List the streams for a package:

dnf module list nginx

Expected output:

Oracle Linux 8 Application Stream (x86_64) Name Stream Profiles Summary nginx 1.14 [d] common [d] nginx webserver nginx 1.16 common [d] nginx webserver nginx 1.18 common [d] nginx webserver nginx 1.20 common [d] nginx webserver nginx 1.22 common [d] nginx webserver nginx 1.24 common [d] nginx webserver Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

Install a specific stream and enable it in the usual way, for example sudo dnf module install -y nginx:1.24 followed by sudo systemctl enable --now nginx.

To add another administrator, create the account with sudo adduser <name>. Add it to the wheel group with sudo usermod -aG wheel <name>.

Then copy your public key into /home/<name>/.ssh/authorized_keys, with mode 600, and set the .ssh directory to mode 700. Both must be owned by that user.

The image ships with no human accounts at all, so azureuser is the only login until you add one:

getent group wheel