Rocky Linux 10

Option A: Azure Portal

• In the Azure Marketplace, search for "Rocky Linux 10 SecureAnyCloud".
• Select the image and click Create.
• On the basics tab, set Subscription to your Azure subscription and Resource Group to a new or existing group.
• Enter a Virtual Machine Name, choose your preferred Region, and set Size to Standard_B2s (recommended).
• Under Administrator Account, select SSH public key and paste your public key. This key becomes the azureuser login. The image ships no password and no pre-installed key.
• Under Inbound Port Rules, allow SSH (port 22).
• Click Review + Create, then Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:rocky-linux-10:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-rocky10-vm \
  --image sac1647283583153:rocky-linux-10:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Look up your VM's public IP address, then connect:

az vm show --resource-group myResourceGroup --name my-rocky10-vm --show-details --query publicIps -o tsv ssh azureuser@<public-ip-address>

The VM accepts only the SSH key you supplied at deploy time. Password authentication is disabled on the image.

After you connect, confirm that the VM runs Rocky Linux 10:

cat /etc/rocky-release grep -E 'PRETTY_NAME|VERSION_ID' /etc/os-release uname -r

The output looks like this:

Rocky Linux release 10.2 (Red Quartz) VERSION_ID="10.2" PRETTY_NAME="Rocky Linux 10.2 (Red Quartz)" 6.12.0-211.34.1.el10_2.x86_64

Then check the available disk space and memory:

df -h / free -h

The image is patched at build time. Check for updates released since the build:

sudo dnf -q check-update ; echo "exit=$? (100 = updates available, 0 = fully patched)"

An exit code of 100 means updates were released since the build. Run sudo dnf update -y to apply them.

This image is secure by default. Verify the key hardening properties:

getenforce
sudo sshd -T | grep -E '^passwordauthentication'
sudo passwd -S root | awk '{print $1, $2}'

You should see SELinux Enforcing, passwordauthentication no, and root reported as L / LK (locked). Access is by your SSH key only.

Confirm that the Azure Linux Agent and time synchronisation are healthy:

systemctl is-active waagent
systemctl is-active chronyd

Rocky Linux 10 is the current major stream, so the standard BaseOS and AppStream repositories are enabled. You can move forward at any time.

Apply the latest security errata and package updates within the Rocky 10 stream:

sudo dnf update -y

Reboot if a new kernel was installed:

sudo needs-restarting -r || sudo systemctl reboot

To review only security advisories before you apply them:

sudo dnf updateinfo list security sudo dnf update --advisory=<RLSA-ID>

The Azure Network Security Group (NSG) is the first line of network control. Rocky Linux also ships firewalld for host-level rules:

sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh sudo firewall-cmd --permanent --add-port=80/tcp sudo firewall-cmd --permanent --add-port=443/tcp sudo firewall-cmd --reload