openEuler 24.03 LTS

What you get

• openEuler 24.03 LTS (24.03-LTS-SP4 maintenance level), x86-64
• A standard (non-LVM) ext4 root. The OS disk is GPT: partition 1 is a 1 MiB bios_grub partition that holds the BIOS bootloader, partition 2 is the FAT /boot partition and partition 3 is the ext4 root
• Every available 24.03-LTS-SP4 package applied at build time, so the image is fully patched to its capture date
• The official openEuler repositories, served from the official openEuler mirror at mirrors.ocf.berkeley.edu (with mirrors.xtom.de and repo.openeuler.org as fallbacks), so dnf refreshes quickly on Azure (see Package mirror)
• Azure Linux Agent (WALinuxAgent 2.10) injected and enabled for Azure provisioning
• dnf-automatic armed, so the machine keeps applying updates unattended
• Serial console enabled (console=ttyS0) for Azure out-of-band recovery
• Gen1 Hyper-V virtual machine support (BIOS boot)
• 24/7 SecureAnyCloud support

Platform: Microsoft Azure (Gen1 Hyper-V). Default user: azureuser. Open ports: TCP 22 (SSH) only.

Security posture

This image ships with no known credential. It has no default password and no baked-in SSH key.

• The root account password is locked, so no one can log in as root with a password.
• SSH password login follows the authentication type you choose when you create the VM. Choose SSH public key and only your key works. Choose Password and the password you set works for that user. The image pins no PasswordAuthentication value that would override your choice.
• PermitRootLogin is set to prohibit-password.
• With key authentication, the only key that works is the public key you supply when you create the virtual machine. The Azure Linux Agent injects it into azureuser at first boot, so no two machines you launch share a secret.
• The machine identity (/etc/machine-id) and the SSH host keys are regenerated on every instance, so two VMs launched from this image are cryptographically distinct.
• The unused rpcbind listener on port 111 is disabled. Re-enable it with systemctl enable --now rpcbind.socket if you need NFSv3.
• The only externally bound listener is SSH on port 22.

Provisioning agent and SELinux

• The Azure Linux Agent (WALinuxAgent) handles provisioning, not cloud-init. openEuler's generic-cloud image does not ship cloud-init, so this image uses waagent to create azureuser, inject your SSH key and regenerate a per-VM SSH host key on first boot. Azure supports this model, but it means custom-data and cloud-init user-data are not consumed.
• SELinux is not enforced in this image. openEuler's generic-cloud image ships without a SELinux targeted policy, and SecureAnyCloud keeps that upstream default rather than force-enabling SELinux on the imported image. If your workload requires SELinux, install the policy (dnf install selinux-policy-targeted policycoreutils), set SELINUX=enforcing in /etc/selinux/config, touch /.autorelabel, and reboot.

Licence

openEuler is free and open source. Its own components are licensed under the Mulan Permissive Software License v2 (Mulan PSL v2). The distribution is assembled from thousands of independently packaged upstream components, each with its own terms (GPL, LGPL, MIT, BSD, Apache-2.0, MPL and more). You can read the terms per package with rpm -qi <pkg> and under /usr/share/licenses/. No paid subscription, licence key or support contract is required.

Prerequisites

Before you deploy this image, make sure you have:

• An active Microsoft Azure subscription
• Access to the Azure Portal or Azure CLI
• An SSH key pair for Linux VM access
• Familiarity with Azure VM management

Deployment

Create the VM (Azure CLI)

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openeuler:default:latest
az vm create \
  --resource-group my-resource-group \
  --name my-openeuler-vm \
  --image sac1647283583153:openeuler:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --public-ip-sku Standard

This is a Gen1 (BIOS) image, so choose a VM size that supports Gen1, such as the Standard_B, D_v5/Ds_v5 or F-series. Only your SSH public key is injected.

Connect over SSH

ssh azureuser@<public-ip>

You are signed in as azureuser, a member of the sudo/wheel group. Use sudo for administrative tasks.

First steps after login

Confirm the release:

cat /etc/openEuler-release
# openEuler release 24.03 (LTS-SP4)
cat /etc/os-release | grep -E '^(NAME|VERSION|ID)='

Apply any updates published since the image was captured:

sudo dnf -y upgrade

dnf-automatic is already armed, so the machine also applies updates on a timer:

systemctl status dnf-automatic.timer cat /etc/dnf/automatic.conf
# upgrade_type=default, apply_updates=yes

Package management

openEuler uses dnf (DNF4) with RPM packages. Confirm the enabled repositories and the release package:

dnf repolist rpm -q openEuler-release
dnf --version

The enabled repositories (OS, everything, EPOL, update and others) are the official openEuler 24.03-LTS-SP4 repositories, fetched from an official mirror (see below). The EPOL (Extra Packages for openEuler) repository is enabled, which gives you a wider package set.

Day-to-day usage follows the usual dnf verbs. Run sudo dnf install <package> to install, sudo dnf remove <package> to remove and dnf search <keyword> to search.

Package mirror

openEuler's main repository server, repo.openeuler.org, is in Hong Kong and is slow to reach from most Azure regions. Refreshing its metadata alone can take more than 15 minutes. This image therefore fetches packages from https://mirrors.ocf.berkeley.edu/openeuler, an official openEuler mirror that is listed on openEuler's mirror list and kept in sync with repo.openeuler.org. Measured from Azure East US and North Europe, a full metadata refresh takes under a minute and a typical update run takes about two minutes.

The mirror is set in one place, the dnf variable file /etc/dnf/vars/oemirror. Every repository in /etc/yum.repos.d/openEuler.repo uses it as its first baseurl. mirrors.xtom.de and repo.openeuler.org follow as automatic fallbacks:

cat /etc/dnf/vars/oemirror
# https://mirrors.ocf.berkeley.edu/openeuler grep -A3 '^\[update\]' /etc/yum.repos.d/openEuler.repo
# baseurl=$oemirror/openEuler-24.03-LTS-SP4/update/$basearch/
# https://mirrors.xtom.de/openeuler/openEuler-24.03-LTS-SP4/update/$basearch/
# https://repo.openeuler.org/openEuler-24.03-LTS-SP4/update/$basearch/

To switch to another mirror, write its base URL into that file and refresh the cache. Use the directory that contains openEuler-24.03-LTS-SP4/, with no trailing slash. For example, pick a mirror closer to your region from the official list at openeuler.org/en/mirror/list, or use a private mirror:

echo 'https://mirror.accum.se/mirror/openeuler.org' | sudo tee /etc/dnf/vars/oemirror
sudo dnf clean all && sudo dnf makecache

To go back to openEuler's own server, run echo 'https://repo.openeuler.org' | sudo tee /etc/dnf/vars/oemirror.

Changing the mirror does not weaken package verification. gpgcheck=1 stays on for every repository. Whichever server a package comes from, it is verified against the openEuler signing key shipped in the image at /etc/pki/rpm-gpg/RPM-GPG-KEY-openEuler (fingerprint 8AA1 6BF9 F2CA 5244 010D CA96 3B47 7C60 B675 600B). You can check the fingerprint yourself:

gpg --show-keys --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-openEuler

openEuler.repo is a protected configuration file. When the openEuler-repos package is updated, your copy is kept and the new upstream default is written alongside it as openEuler.repo.rpmnew. A routine dnf upgrade therefore never switches you back to the slower server.

Managing services

openEuler uses systemd. List the running services:

systemctl list-units --type=service --state=running --no-legend | head

To manage a specific unit, use sudo systemctl start <service>, sudo systemctl enable <service> (start at boot) and sudo systemctl status <service>. Use journalctl -u <service> to view its logs.

Networking and the firewall

The Azure Network Security Group controls inbound and outbound traffic. It is the first place to open a port, and usually the only one. The image advertises a single inbound port, SSH on 22. Confirm what is listening before you open anything:

ss -tlnp

The only externally reachable listener is sshd on port 22. The rpcbind listener on port 111 is disabled. Re-enable it with sudo systemctl enable --now rpcbind.socket if you need NFSv3.

The image does not install a host firewall daemon (firewalld) by default, because the openEuler generic-cloud image does not ship one. Port control is handled at the Azure NSG. If your policy also requires a host firewall, install and enable firewalld with sudo dnf install -y firewalld && sudo systemctl enable --now firewalld. Add the SSH service first (sudo firewall-cmd --permanent --add-service=ssh && sudo firewall-cmd --reload) so you do not lock yourself out.

The Azure serial console

The image enables the kernel serial console (console=ttyS0). If you lose SSH access, open the Serial console blade in the Azure Portal for out-of-band recovery.

Support

SecureAnyCloud provides 24/7 support for this image. For help with deployment or configuration, contact support through the Azure Marketplace listing.

For openEuler documentation and community resources, see the openEuler community website and documentation.

Deploy on Azure

Launch openEuler 24.03 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com