Rocky Linux 8 Server

Option A: Azure Portal

• Open the Azure Marketplace and search for "Rocky Linux 8 SecureAnyCloud".
• Open the Rocky Linux 8 listing and choose Get it now, then Create.
• On the Basics tab, configure the following:
• Subscription: select your Azure subscription.
• Resource Group: create a new one or select an existing one.
• Virtual Machine Name: enter a name for your VM.
• Region: select your preferred Azure region.
• Size: select a size for your workload.
• Under Administrator Account, select SSH public key and enter your key.
• Under Inbound Port Rules, allow SSH (port 22), ideally from your own network only.
• Choose Review + Create, then Create.

Option B: Azure CLI

The image carries a Marketplace purchase plan, so accept its terms once per subscription, then create the virtual machine. Replace <your-vm-size> with the size you chose:

az vm image terms accept --urn sac1647283583153:608f7ee7-2a42-4f52-893d-be662ec11828:608f7ee7-2a42-4f52-893d-be662ec11828:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-rocky-8-vm \
  --image sac1647283583153:608f7ee7-2a42-4f52-893d-be662ec11828:608f7ee7-2a42-4f52-893d-be662ec11828:latest \
  --size <your-vm-size> \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The offer and the first plan are both named by the same identifier (608f7ee7-2a42-4f52-893d-be662ec11828), which is why it appears twice in the URN. For a Gen2 size, use the Gen2 plan instead in both commands:

sac1647283583153:608f7ee7-2a42-4f52-893d-be662ec11828:608f7ee7-2a42-4f52-893d-be662ec11828-gen2:latest

Run these commands on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-rocky-8-vm --show-details --query publicIps -o tsv ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks for one, your client is not offering the key that you supplied at create time.

The login message Activate the web console with: systemctl enable --now cockpit.socket comes from the cockpit-ws package on the image. The web console is not set up: the main cockpit package is not installed and the socket is disabled. Step 8 shows how to turn it on if you want it.

Check that the machine is the Rocky Linux 8.10 release you expect:

cat /etc/rocky-release grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release uname -rm

The expected output on a fresh virtual machine from image 4.0.1 is:

Rocky Linux release 8.10 (Green Obsidian) NAME="Rocky Linux" VERSION="8.10 (Green Obsidian)" ID="rocky" PLATFORM_ID="platform:el8" 4.18.0-553.172.1.el8_10.x86_64 x86_64

The el8_10 tag in the kernel version shows that the machine is on the 8.10 maintenance stream. After you apply updates (Step 4) and reboot, the kernel version moves on while the release stays 8.10.

dnf check-update returns exit code 100 when updates are pending and 0 when none are. Run:

sudo dnf check-update > /dev/null 2>&1 echo "check-update exit code: $?" dnf repolist --enabled

The expected output on a fresh virtual machine is:

check-update exit code: 100 repo id repo name appstream Rocky Linux 8 - AppStream baseos Rocky Linux 8 - BaseOS extras Rocky Linux 8 - Extras

The image was patched when it was built, so the exit code 100 reflects only the updates published since then (on 2 November 2026, a fresh virtual machine had 37 waiting). sudo dnf history list shows the build-time upgrade as its newest entry.

Apply the updates, and reboot if a new kernel was installed:

sudo dnf upgrade -y sudo systemctl reboot

The image does not update itself. dnf-makecache.timer is enabled, but it only refreshes the repository metadata, and dnf-automatic is not installed. To have updates applied on a schedule, install and enable it:

sudo dnf install -y dnf-automatic
sudo sed -i 's/^apply_updates = no/apply_updates = yes/' /etc/dnf/automatic.conf
sudo systemctl enable --now dnf-automatic.timer

Confirm that SELinux is enforcing, root is locked and SSH is key-only:

getenforce grep -E '^[[:space:]]*SELINUX=' /etc/selinux/config
sudo passwd -S root | cut -d' ' -f1-2 sudo sshd -T | grep -E '^(pubkeyauthentication|passwordauthentication|kbdinteractiveauthentication) '

The expected output is:

Enforcing SELINUX=enforcing root LK pubkeyauthentication yes passwordauthentication no kbdinteractiveauthentication no

root LK means the root password is locked.

sudo sshd -T | grep '^permitrootlogin' prints permitrootlogin yes, from the PermitRootLogin yes line in /etc/ssh/sshd_config (the Rocky Linux 8 default). Root still cannot log in, because its password is locked and the only entry in /root/.ssh/authorized_keys is cloud-init's, which prints the "Please login as the user" message and closes the connection.

To turn root login off in the SSH daemon as well, change that line:

sudo cp -a /etc/ssh/sshd_config /etc/ssh/sshd_config.orig
sudo sed -i 's/^PermitRootLogin yes$/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sshd -t && sudo systemctl restart sshd
sudo sshd -T | grep '^permitrootlogin'

The last command then prints permitrootlogin no. Keep your current session open until you have checked that a new ssh azureuser@<vm-ip> connection still works.

Confirm the Azure Linux Agent, cloud-init and time synchronisation are healthy:

systemctl is-active waagent
systemctl is-enabled waagent cloud-init --version sudo cloud-init status
systemctl is-active chronyd timedatectl | grep 'Time zone'

The expected output is:

active enabled /usr/bin/cloud-init 23.4-7.el8_10.11.0.2 status: done active Time zone: UTC (UTC, +0000)

waagent is what lets Azure provision your SSH key, run extensions and report VM health, so it should always be active and enabled. chronyc sources shows PHC0, the Azure host clock, as the selected time source.

python3 --version reports Python 3.6.8. That is the platform Python that dnf itself uses. For application work, install a newer interpreter from AppStream alongside it, for example sudo dnf install -y python3.11.

The Azure CLI is not installed. To add it, use Microsoft's repository for RHEL 8-compatible systems:

sudo rpm --import https://packages.microsoft.com/keys/microsoft.asc
sudo dnf install -y https://packages.microsoft.com/config/rhel/8/packages-microsoft-prod.rpm
sudo dnf install -y azure-cli az version

Sign in with az login before using it against your subscription.

The Azure Network Security Group is the control plane for inbound and outbound traffic. It is the first, and usually the only, place where you need to open a port. The image needs a single inbound port, SSH on 22.

firewalld is not installed (rpm -q firewalld prints package firewalld is not installed), so your NSG rules take effect exactly as written. Confirm what is listening before you open anything:

ss -tlnu

On a fresh virtual machine, you see sshd on port 22 and rpcbind on port 111 (TCP and UDP), on all addresses. You also see chronyd on 127.0.0.1:323 and [::1]:323, which only the machine itself can reach.

Keep port 111 closed in your NSG. If you do not use NFS, switch rpcbind off:

sudo systemctl disable --now rpcbind.service rpcbind.socket

If your policy requires a host firewall as well, install and enable it, keeping SSH open:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --list-services

--list-services then prints cockpit dhcpv6-client ssh, because firewalld's default zone already allows SSH. Once firewalld is running, a port must be open in both the NSG and firewalld before traffic reaches your service.

AppStream carries the application packages. Search it, then install what you need:

dnf search nginx

The 8 series ships several versions of some languages, databases and servers as module streams, so you can pick a version rather than take the default:

dnf module list nginx

The list shows the streams from 1.14 [d] (the default) up to 1.24. Install a package and enable it in the usual way, for example sudo dnf install -y nginx followed by sudo systemctl enable --now nginx.

To use the web console that the login message mentions, install it and enable the socket. Reach port 9090 over an SSH tunnel rather than opening it in the NSG:

sudo dnf install -y cockpit
sudo systemctl enable --now cockpit.socket

To add another administrator, create the account with sudo adduser <name> and add it to the wheel group with sudo usermod -aG wheel <name>. Then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600, and give the .ssh directory mode 700, owned by that user.

azureuser is the only login account until you add one. Check the wheel group:

getent group wheel