Oel 9.8

Option A: Azure Portal

• Go to the Azure Marketplace and search for "Oracle Linux 9.8 SecureAnyCloud".
• Select the image and click Create.
• On Basics, select your Subscription.
• Set Resource Group by creating a new one or selecting an existing one.
• Enter a Virtual Machine Name.
• Select your preferred Region.
• Set Size. Standard_B2s is recommended.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

Accept the Marketplace terms, then create the VM.

az vm image terms accept --urn sac1647283583153:oel-9-8:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-oracle-linux-9-8-vm \
  --image sac1647283583153:oel-9-8:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Run these commands on your own workstation, not on the VM. Find the public IP, then connect.

az vm show --resource-group myResourceGroup --name my-oracle-linux-9-8-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied at create time.

Check that the machine runs the Oracle Linux 9.8 release you expect.

cat /etc/oracle-release grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release uname -rm

You should see output like this.

Oracle Linux Server release 9.8 NAME="Oracle Linux Server" VERSION="9.8" ID="ol" PLATFORM_ID="platform:el9" 6.12.0-204.92.4.4.3.el9uek.x86_64 x86_64

The el9uek tag on the kernel version shows that the machine runs the Unbreakable Enterprise Kernel. Oracle Linux also ships the Red Hat Compatible Kernel (a 5.14 el9_8 kernel) alongside it. The next step shows both.

The image is fully updated at build time. dnf check-update returns exit code 100 when updates are pending and 0 when none are.

sudo dnf check-update echo "exit code: $?"

List the enabled repositories to confirm that your update path is intact.

dnf repolist --enabled

You should see output like this.

repo id repo name ol9_UEKR8 Oracle Linux 9 UEK Release 8 (x86_64) ol9_addons Oracle Linux 9 Addons (x86_64) ol9_appstream Oracle Linux 9 Application Stream Packages (x86_64) ol9_baseos_latest Oracle Linux 9 BaseOS Latest (x86_64)

Both kernel lines are installed and managed by dnf. List them, and see which one is booted.

rpm -q kernel-uek-core kernel-core uname -r

You should see output like this.

kernel-uek-core-6.12.0-204.92.4.4.3.el9uek.x86_64 kernel-core-5.14.0-687.36.1.el9_8.x86_64 6.12.0-204.92.4.4.3.el9uek.x86_64

The UEK line (kernel-uek-*) is the default and is what uname -r reports. The RHCK line (kernel-*, the 5.14 el9_8 kernel) is available if you prefer strict RHEL kernel compatibility. Select it from the GRUB menu at boot. Both lines receive security updates.

Because 9.8 is a current minor release in the RHEL 9 family, applying updates keeps you current within the 9 series. This image also arms dnf-automatic, so security updates are downloaded and applied on a timer without any action from you. You can still run updates on your own schedule.

sudo dnf upgrade -y

If a new kernel was installed, reboot.

sudo systemctl reboot

Confirm that SELinux is enforcing, root is locked, and SSH allows keys only.

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication)'

You should see output like this.

Enforcing root LK 2009-12-21 -1 -1 -1 -1 (Alternate authentication scheme in use.) permitrootlogin without-password pubkeyauthentication yes passwordauthentication no

without-password is how OpenSSH reports the prohibit-password setting. Both names mean the same thing: root may not authenticate with a password.

Confirm that the Azure Linux Agent, cloud-init and time synchronisation are healthy and that unattended security updates are armed. Then check your resources.

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version
systemctl is-enabled dnf-automatic.timer
systemctl is-active chronyd df -h / free -h

You should see output like this.

active enabled /usr/bin/cloud-init 24.4-8.0.1.el9_8.1 enabled active Filesystem Size Used Avail Use% Mounted on /dev/mapper/rootvg-rootlv 32G 3.4G 29G 11% / total used free shared buff/cache available Mem: 3.4Gi 577Mi 2.4Gi 16Mi 638Mi 2.8Gi Swap: 0B 0B 0B

waagent is what lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled. dnf-automatic.timer being enabled is what keeps the machine applying security updates on its own after launch. Swap: 0B is expected. Azure manages swap on the ephemeral resource disk, so none is baked into the OS disk.

The Azure Network Security Group is the outer control plane for inbound and outbound traffic, and it is the first place you open a port. The image advertises a single inbound port, SSH on 22.

Before you open anything, confirm what is actually listening.

ss -tlnp

On a fresh machine the only listener is sshd on port 22. rpcbind is disabled on this image, so port 111 is closed by default.

Unlike a stock cloud image, this build also runs a host firewall. firewalld is active and enabled, using the public zone, and it already permits SSH. Inspect it.

sudo firewall-cmd --state sudo firewall-cmd --list-all

The public zone lists ssh among its allowed services, which is why your key-based login works out of the box. To expose another service, open it in both the Azure NSG and firewalld. For example, to allow HTTPS, run these commands.

sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Always keep the ssh service allowed so a firewall change does not lock you out.

If you need NFSv3, which relies on the RPC port mapper, re-enable rpcbind.

sudo systemctl enable --now rpcbind.socket

NFSv4 does not need rpcbind and works without this step.

The Application Stream carries the application packages. It ships several versions of the same language or database as separate module streams, so you can pick a version rather than take the default.

List the streams for a package.

dnf module list nginx

You should see output like this.

Oracle Linux 9 Application Stream Packages (x86_64) Name Stream Profiles Summary nginx 1.22 common [d] nginx webserver nginx 1.24 common [d] nginx webserver nginx 1.26 common [d] nginx webserver Hint: [d]efault, [e]nabled, [x]disabled, [i]nstalled

Install a specific stream and enable it in the usual way, for example sudo dnf module install -y nginx:1.26 followed by sudo systemctl enable --now nginx.

To add another administrator:

1. Create the account with sudo adduser <name>.
2. Add it to the wheel group with sudo usermod -aG wheel <name>.
3. Copy your public key into /home/<name>/.ssh/authorized_keys with mode 600, and give the .ssh directory mode 700. Both must be owned by that user.

The image ships with no human accounts at all, so azureuser is the only login until you add one. Check the group membership.

getent group wheel