Rocky 10 arm64

Option A: Azure Portal

• Open the Azure Marketplace and search for "Rocky Linux 10 Arm64 SecureAnyCloud".
• Select the image and click Create.
• On the basics tab, set:
  • Subscription: select your Azure subscription
  • Resource Group: create a new one or select an existing one
  • Virtual Machine Name: enter a name for your VM
  • Region: select a region that offers Arm sizes
  • Size: Standard_D2ps_v6 is recommended (an Arm64 size)
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

Run the following on your own workstation, substituting your resource group, VM name and preferred region. Accept the Marketplace terms once per subscription, then create the machine:

az vm image terms accept --urn sac1647283583153:rocky-10-arm64:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-rocky-10-arm64-vm \
  --image sac1647283583153:rocky-10-arm64:default:latest \
  --size Standard_D2ps_v6 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The --size must be an Arm64 family (Standard_D2ps_v6 above). Azure rejects an x86 size for an Arm image when you create the VM.

Run the following on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-rocky-10-arm64-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key you supplied when you created the VM.

Check that the machine runs Rocky Linux 10:

cat /etc/rocky-release

Rocky Linux release 10.2 (Red Quartz)

The os-release fields carry the same information in a machine-readable form, which is what configuration management tools read:

grep -E '^(NAME|VERSION|ID|VERSION_ID|PLATFORM_ID)=' /etc/os-release

NAME="Rocky Linux" VERSION="10.2 (Red Quartz)" ID="rocky" VERSION_ID="10.2" PLATFORM_ID="platform:el10"

The RHEL compatibility lineage is asserted by the distribution itself:

cat /etc/redhat-release

Rocky Linux release 10.2 (Red Quartz)

Check the kernel and page size to confirm the architecture. aarch64 confirms the native 64-bit Arm build, and 4096 confirms the standard 4k page size kernel:

uname -srm getconf PAGESIZE

Linux 6.12.0-211.54.1.el10_2.aarch64 aarch64 4096

Then check the processor. On Azure's Arm sizes it is the Azure Cobalt 100, built on Arm Neoverse N2 cores:

lscpu | grep -E '^(Architecture|Vendor ID|Model name|BIOS Model name):'

Architecture: aarch64 Vendor ID: ARM Model name: Neoverse-N2 BIOS Model name: Cobalt 100 None CPU @ 3.4GHz

The version reported is the Rocky Linux 10 point release the image was patched to. This listing tracks the 10 major release, so dnf update rolls the machine forward across future point releases.

Every available update was applied when this image was built. Run dnf check-update, which exits 100 when updates are pending and 0 when none are:

dnf -q check-update >/dev/null 2>&1; echo "exit=$?"

exit=0

Confirm that no reboot is pending:

dnf needs-restarting -r

No core libraries or services have been updated since boot-up. Reboot should not be necessary.

Exactly one kernel is installed, and it is the one the machine runs. The superseded kernel that the vendor base carried is removed before capture, so the image is not flagged for an advisory against a kernel it does not run:

rpm -q kernel-core

kernel-core-6.12.0-211.54.1.el10_2.aarch64

Check that your update path is intact. BaseOS, AppStream and Extras are enabled, which is the Rocky Linux 10 cloud image default:

dnf repolist --enabled

repo id repo name appstream Rocky Linux 10 - AppStream baseos Rocky Linux 10 - BaseOS extras Rocky Linux 10 - Extras

CRB (CodeReady Builder) and the Rocky security repository are present but disabled, matching the vendor default. When you need build-time dependencies, enable CRB with sudo dnf config-manager --set-enabled crb.

Automatic updates

The stock Rocky Linux 10 Arm64 cloud image does not include dnf-automatic. This image installs it and enables its timer, so the machine applies updates on its own schedule. Confirm the timer and its schedule:

systemctl is-enabled dnf-automatic.timer

enabled

systemctl cat dnf-automatic.timer | grep -E 'OnCalendar|RandomizedDelaySec'

OnCalendar=*-*-* 6:00 RandomizedDelaySec=60m

The policy applies all available updates, not only those tagged as security errata. It never reboots automatically, so a kernel update waits for a window you choose instead of restarting a production machine without warning:

grep -E '^(apply_updates|upgrade_type|download_updates|reboot) ' /etc/dnf/automatic.conf

upgrade_type = default download_updates = yes apply_updates = yes reboot = never

upgrade_type is deliberately default rather than security. A security-only policy depends on errata metadata being present for every update, and where it is missing, the policy silently applies nothing. default is the setting that keeps the machine current.

Because reboot = never, check periodically whether a restart is owed after a kernel update, using the needs-restarting -r command above. To opt out of automatic updates entirely, run sudo systemctl disable --now dnf-automatic.timer.

Confirm SELinux is enforcing:

getenforce

Enforcing

Confirm the root account is locked. The L in the second field means locked:

passwd -S root

root L 2009-12-22 -1 -1 -1 -1

Confirm no account on the machine has a usable password. This prints nothing on a clean image:

sudo awk -F: '($2 !~ /^[!*]/) && ($2 != "") {print $1}' /etc/shadow

Read the SSH daemon's effective policy rather than the config file, because the running daemon is what a client actually meets. OpenSSH reports prohibit-password as without-password:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication) '

permitrootlogin without-password pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no

A drop-in file pins that policy. It sorts ahead of every other SSH configuration file, so a later package update to the main configuration cannot quietly loosen it:

grep -vE '^#' /etc/ssh/sshd_config.d/00-sac-hardening.conf

PermitRootLogin prohibit-password PasswordAuthentication no KbdInteractiveAuthentication no PermitEmptyPasswords no

There is no swap on the operating system disk. A swap file baked into a Marketplace image is not permitted, so this prints nothing:

swapon --show

Confirm what is listening. SSH on port 22 is the only service reachable from the network. The only other socket belongs to chronyd, bound to the loopback address for time synchronisation:

ss -tln
ss -uln

State Recv-Q Send-Q Local Address:Port Peer Address:Port LISTEN 0 128 0.0.0.0:22 0.0.0.0:* LISTEN 0 128 [::]:22 [::]:* State Recv-Q Send-Q Local Address:Port Peer Address:Port UNCONN 0 0 127.0.0.1:323 0.0.0.0:* UNCONN 0 0 [::1]:323 [::]:*

This image closes two listeners that the stock vendor image leaves open. The Cockpit web console would otherwise bind *:9090 on every interface, and rpcbind, which NFS version 3 relies on, would bind port 111. Both units ship disabled rather than removed:

systemctl is-enabled rpcbind.socket cockpit.socket || true

disabled disabled

The base operating system still ships nfs-utils for NFS version 4 client mounts, which need no extra listener. If you need NFS version 3, run sudo systemctl enable --now rpcbind.socket and open only what you need in your network security group.

To bring back the Cockpit console, run sudo systemctl enable --now cockpit.socket, then open 9090 in the network security group.

The Azure Linux Agent handles extensions and the portal's recovery features, and cloud-init provisions the machine:

systemctl is-active waagent rpm -q WALinuxAgent cloud-init chrony

active WALinuxAgent-2.14.0.1-3.el10.noarch cloud-init-24.4-7.el10_2.1.rocky.0.1.noarch chrony-4.8-2.el10.aarch64

Cloud-init should report done, which means provisioning finished cleanly:

cloud-init status

status: done

The kernel puts a console on ttyAMA0, the Arm PL011 serial port. This makes boot diagnostics and the portal's serial console work when you cannot reach the machine over SSH. On x86 images the console is ttyS0, and on Arm it is ttyAMA0:

grep -o 'console=ttyAMA0' /proc/cmdline

console=ttyAMA0

Confirm that nothing failed on boot. On the stock vendor image, rngd fails here and the machine reports degraded. With that unit disabled, the system reaches running with no failed units:

systemctl is-system-running

running

Time synchronisation runs through chronyd against the Azure host clock (your offsets will differ):

chronyc -n sources | head -3

MS Name/IP address Stratum Poll Reach LastRx Last sample =============================================================================== #* PHC0 2 3 377 7 +28us[ +29us] +/- 9523ns

The operating system disk uses a flat layout with XFS for the root and boot filesystems, and no LVM:

lsblk -o NAME,SIZE,TYPE,FSTYPE,MOUNTPOINT df -h /

NAME SIZE TYPE FSTYPE MOUNTPOINT sda 10G disk ├─sda1 100M part vfat /boot/efi ├─sda2 1000M part xfs /boot └─sda3 8.9G part xfs / /dev/sda3 8.9G 1.3G 7.6G 15% /

The root partition grows to fill the operating system disk you choose when you create the VM. If you ask for a larger disk than the image's 10 GB, you get the space without a manual resize.

Standard_D2ps_v6 has no local temporary disk, so there is no scratch disk at /mnt on that size. Arm sizes with a d in the name, such as Standard_D2pds_v6, add a local temporary disk. Treat anything on a temporary disk as disposable, because it is erased whenever the machine is deallocated or moved.

The Azure network security group (NSG) controls inbound and outbound traffic. It is the first, and usually the only, place you need to open a port.

firewalld is not installed on this image:

rpm -q firewalld || echo "(firewalld absent - the Azure NSG is your only firewall)"

package firewalld is not installed (firewalld absent - the Azure NSG is your only firewall)

This matches the Rocky Linux cloud image default. With no host firewall in the way, your NSG rules take effect exactly as written, with no second layer to keep in sync. If your policy also requires a host firewall, install and enable it yourself:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload

Once firewalld is running, a port must be open in both the Azure NSG and firewalld before traffic reaches your service.

AppStream carries the application packages. Everything in the repositories is built for Arm, so dnf resolves aarch64 packages automatically, with nothing extra to configure:

dnf -q list --available nginx 2>/dev/null | tail -2

Available Packages nginx.aarch64 2:1.26.3-6.el10_2.6 appstream

Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx. Then open the port in your network security group.

To add another administrator, create the account with sudo adduser <name> and add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys, owned by that user, with mode 600 on the file and mode 700 on the .ssh directory.

The image ships with no human accounts at all. The administrator you named when you created the VM is the only login until you add another:

getent group wheel

wheel:x:10: