Operating Systems Azure

AlmaLinux 9 Minimal on Azure User Guide

| Product: AlmaLinux 9 Minimal on Azure

Overview

This guide covers the deployment and configuration of AlmaLinux 9 Minimal on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

AlmaLinux is a community driven enterprise Linux distribution, produced by the AlmaLinux OS Foundation to be binary compatible with Red Hat Enterprise Linux 9. This is the Minimal edition: the same AlmaLinux 9 with the packages a headless cloud server never uses removed, so the machine you run has a smaller installed package set and a smaller attack surface to patch and audit.

The value of Minimal here is fewer moving parts, not a dramatic disk saving. The AlmaLinux 9 base is already lean — unlike the RHEL 8 generation it does not ship the multi gigabyte linux-firmware package — so the on disk footprint drops modestly, from roughly 1.36 GB to 1.20 GB at build time. What changes more meaningfully is the package set: the Cockpit web console, the tuned tuning daemon, the sosreport collector, the boot splash and the residual firmware and GeoIP datasets are all removed. Each is one fewer service or dataset to keep patched and account for in a security review.

What's included:

  • AlmaLinux 9, binary compatible with RHEL 9, rolled forward to the current 9.x point release at build time
  • A reduced package set: no Cockpit web console, no tuned daemon, no sosreport, no boot splash, no residual firmware or GeoIP datasets
  • Every available update applied at build time, verified with a zero pending check
  • Unattended updates already armed, so the machine keeps patching itself
  • Azure Linux Agent (waagent) and cloud-init for Azure integration
  • Chronyd for NTP time synchronisation
  • SELinux in enforcing mode, both at runtime and persisted for the next boot
  • BaseOS and AppStream repositories enabled, with signature checking on
  • Exactly one externally reachable port: SSH on 22
  • Gen2 Hyper V virtual machine support
  • 24/7 cloudimg support

Platform: Microsoft Azure (Gen2 Hyper V) Default user: azureuser

What "Minimal" means here, precisely

Unlike the RHEL 8 generation, an AlmaLinux 9 cloud image does not ship the multi gigabyte linux-firmware package, so there is no single dominant item to remove and the disk saving is modest. Minimal here is about the package set rather than the size headline. Removed are the packages a headless cloud server has no use for: the Cockpit web console (a network facing management surface), the tuned tuning daemon, the sosreport support collector, the boot splash, and the residual wireless and sound card firmware and bundled GeoIP datasets. Each is one fewer service or dataset to keep patched and to account for in a security review — which is the reason a compliance driven deployment chooses a Minimal image.

What is deliberately kept: systemd, NetworkManager, the SSH server, cloud-init, the Azure Linux Agent, dnf, sudo, chrony and dnf-automatic. The build fails closed if any of those is missing after the trim, and the image is rebooted before capture to prove it still boots and reaches the network.

Confirm the footprint on your own machine:

df -h / | awk 'NR==2 {print "root filesystem used: " $3}'
rpm -qa | wc -l

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

  • The root account password is locked, so no one can log in as root with a password.
  • PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
  • KbdInteractiveAuthentication is also disabled, closing the other password path.
  • PermitRootLogin is set to prohibit-password, so root cannot be reached with a password even if one were later set.
  • The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
  • SSH host keys are not baked into the image. cloud-init regenerates them on every machine, so no two customers share a host identity.

Verify the effective SSH configuration on your own machine, reading the parsed values rather than the file text:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|permitemptypasswords) '

1. Connect to the machine

Replace the address with your own virtual machine's public IP:

ssh azureuser@<YOUR-VM-IP>

2. Confirm the release and patch level

cat /etc/almalinux-release

This is a major level image, so it reports the current 9.x point release rather than a pinned minor. Confirm nothing is outstanding:

sudo dnf -q check-update >/dev/null 2>&1; echo "check-update rc=$? (100 would mean updates pending)"

3. Confirm the trim actually shipped

The packages a cloud guest cannot use should be absent, and the platform essentials present:

for p in linux-firmware tuned cockpit sos plymouth; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: absent"; done

for p in systemd NetworkManager openssh-server cloud-init WALinuxAgent dnf sudo chrony; do rpm -q $p >/dev/null 2>&1 && echo "$p: present" || echo "$p: MISSING"; done

4. Confirm Azure integration and SELinux

systemctl is-active waagent.service 2>/dev/null || systemctl is-active walinuxagent.service

getenforce

5. Unattended updates

The image arms dnf-automatic so the machine keeps patching itself after you deploy it:

systemctl is-enabled dnf-automatic.timer

Review what it will do, and when:

systemctl list-timers dnf-automatic.timer --no-pager | head -3

6. Adding software back

Nothing about the trim prevents you installing anything you need — the full AlmaLinux repositories are enabled and signature checked. If you later run this image on hardware that genuinely needs firmware blobs, reinstall the package:

# Only needed on physical hardware; an Azure guest does not use it.
sudo dnf install -y linux-firmware

7. Support

cloudimg provides 24/7 support for this image at support@cloudimg.co.uk.

AlmaLinux is free and open source software. It is not a single licence: the distribution is assembled from thousands of independently packaged components, each carrying its own terms, and every package's licence is readable with rpm -qi <package> or under /usr/share/licenses/. No subscription, licence key or support contract is required to use AlmaLinux itself.

AlmaLinux is a trademark of the AlmaLinux OS Foundation. cloudimg is not affiliated with, endorsed by, or sponsored by the AlmaLinux OS Foundation; the name is used only to identify the distribution this image contains.