Ubuntu Server 26.04

Option A: Azure Portal

• Open the Azure Marketplace and search for "Ubuntu Server 26.04 LTS SecureAnyCloud".
• Select the image and click Create.
• On the basics tab, set Subscription to your Azure subscription, Resource group to a new or existing group, Virtual machine name to a name of your choosing, and Region to your preferred Azure region.
• Set Size to Standard_B2s or larger.
• Under Administrator account, choose SSH public key and paste your public key. The user name is azureuser.
• Under Inbound port rules, allow SSH (port 22) from your own address range instead of the whole internet.
• Click Review + create, then click Create.

Option B: Azure CLI

az vm image terms accept --urn sac1647283583153:ubuntu-server-26-04:default:latest
az vm create \
  --resource-group myResourceGroup \
  --name my-ubuntu-2604-vm \
  --image sac1647283583153:ubuntu-server-26-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

The image ships no password and no authorized key of its own. The only credential that works is the SSH public key you supply here, which Azure injects at provisioning time.

ssh azureuser@<vm-ip>

To find the public address of your virtual machine:

az vm show --subscription <sub-id> --resource-group myResourceGroup \
  --name my-ubuntu-2604-vm --show-details --query publicIps -o tsv

Confirm the release and the kernel, and check that the Azure platform integration is healthy.

cat /etc/os-release

Expected output:

PRETTY_NAME="Ubuntu 26.04 LTS" NAME="Ubuntu" VERSION_ID="26.04" VERSION="26.04 LTS (Resolute Raccoon)" VERSION_CODENAME=resolute ID=ubuntu ID_LIKE=debian HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy" UBUNTU_CODENAME=resolute LOGO=ubuntu-logo

uname -r uname -m hostnamectl | grep -E "Operating System|Kernel|Virtualization|Architecture"

Expected output:

7.0.0-1010-azure x86_64 Virtualization: microsoft Operating System: Ubuntu 26.04 LTS Kernel: Linux 7.0.0-1010-azure Architecture: x86-64

The -azure kernel flavor is the Azure tuned kernel that Canonical maintains for this platform. Confirm that the Azure Linux Agent and cloud init are present:

systemctl is-active walinuxagent.service
systemctl is-enabled walinuxagent.service cloud-init --version

Expected output:

active enabled /usr/bin/cloud-init 26.1-0ubuntu2

Ubuntu rolls out some updates in phases, so a plain apt-get upgrade can report success while some updates, including security updates, are still held back on that machine. SecureAnyCloud patches this image with phased updates explicitly included, and you can verify this yourself.

First, check that nothing is pinned to an old version:

sudo apt-get update -qq apt-mark showhold

The apt-mark showhold command prints nothing, because no package is held. A held package silently blocks its own security updates.

Now simulate an upgrade with phased updates included and count the updates that remain:

sudo apt-get -s -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade | grep -c "^Inst " || true

Expected output on a freshly deployed instance, unless updates have been released since the build:

0

Zero means the image has every available update applied, not only the ones your machine was offered. If you run this some weeks after deployment, the number is higher because Ubuntu has published updates since the image was captured. Apply them with sudo apt-get update && sudo apt-get -o APT::Get::Always-Include-Phased-Updates=true dist-upgrade.

This image ships with no known credential. There is no default password, no bundled SSH key and no shared host key. Confirm this:

sudo passwd -S root | awk '{print $1, $2}'
sudo sshd -T | grep -E "^(permitrootlogin|passwordauthentication|pubkeyauthentication)"

Expected output:

root L permitrootlogin prohibit-password pubkeyauthentication yes passwordauthentication no

L means the root account is locked, so there is no root password to guess. passwordauthentication no means SSH does not accept a password from anyone, so the key you supplied at deployment is the only way in. The SSH host keys and the machine identifier are regenerated on the first boot of every instance, so no two deployments share them.

AppArmor, the mandatory access control system that Ubuntu uses to confine services, is enabled:

sudo aa-status --enabled && echo "apparmor: enabled"
sudo aa-status --profiled

Expected output:

apparmor: enabled 177

df -h / free -h systemctl is-system-running systemctl list-units --state=failed --no-legend | wc -l

Expected output on a Standard_B2s instance:

Filesystem Size Used Avail Use% Mounted on /dev/root 28G 2.2G 26G 8% / total used free shared buff/cache available Mem: 3.8Gi 532Mi 2.9Gi 4.0Mi 614Mi 3.3Gi Swap: 0B 0B 0B running 0

running with zero failed units means the system reached its target state cleanly. Swap: 0B is deliberate. Azure manages swap on the ephemeral resource disk through the Azure Linux Agent instead of on the operating system disk, so no swap is baked into the image.

The complete Ubuntu archive is available, so any package you need is one command away:

apt-cache policy nginx

Expected output:

nginx: Installed: (none) Candidate: 1.28.3-2ubuntu1.8

Install what you need in the usual way, for example sudo apt-get install -y nginx.

The image keeps the Ubuntu unattended upgrades mechanism enabled, so security updates apply without you logging in. Confirm the configuration:

cat /etc/apt/apt.conf.d/20auto-upgrades

Expected output:

APT::Periodic::Update-Package-Lists "1"; APT::Periodic::Unattended-Upgrade "1";

Then confirm that the service unit is enabled:

systemctl show -p UnitFileState --value unattended-upgrades.service

Expected output:

enabled

To see what the mechanism has done:

sudo tail -n 20 /var/log/unattended-upgrades/unattended-upgrades.log 2>/dev/null || echo "no upgrade run recorded yet on this instance"

To control patching yourself, disable the service with sudo systemctl disable --now unattended-upgrades.service. You then own the patching schedule.

Your Azure Network Security Group is the first line of defense and should already limit port 22 to your own address range. If you also want a host firewall, allow SSH first and then enable the firewall, so that you never lock yourself out.

sudo ufw allow from <your-mgmt-cidr> to any port 22 proto tcp
sudo ufw --force enable
sudo ufw status verbose

Replace the example address range with the range you administer the instance from. The image ships with the host firewall inactive, so it does not interfere with your own network design.

The instance runs in UTC with time synchronization active, which is the right default for servers. Check the current settings:

timedatectl | head -6

Expected output:

Local time: Sat 2026-07-25 17:42:38 UTC Universal time: Sat 2026-07-25 17:42:38 UTC RTC time: Sat 2026-07-25 17:42:37 Time zone: Etc/UTC (UTC, +0000) System clock synchronized: yes NTP service: active

To change the time zone or the host name:

sudo timedatectl set-timezone Europe/London
sudo hostnamectl set-hostname web01.<your-domain>