CentOS 7.7 on Azure User Guide

Overview

This guide covers the deployment and configuration of CentOS 7.7 (CentOS Linux 7.7.1908) on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

CentOS Linux is a community rebuild of Red Hat Enterprise Linux, binary compatible with RHEL 7. This image is deliberately pinned to the 7.7.1908 point release: its package repositories point at the frozen CentOS 7.7.1908 vault, so a routine yum update applies the errata issued for 7.7 and does not roll the machine forward to 7.8 or later.

That matters when an application, a kernel module, a driver or a vendor support statement is certified against one specific CentOS 7 point release rather than the CentOS 7 series as a whole. If you do not need a specific point release, use the CentOS 7 image instead — it ships 7.9.2009, the final CentOS 7 release.

End-of-life notice — read this first

CentOS Linux 7 reached end-of-life on 30 June 2024, and 7.7.1908 is a back-catalogue point release that was superseded upstream by 7.8 and 7.9. Both facts matter:

• This image is patched to the last packages that exist for 7.7.1908, from the frozen CentOS 7.7.1908 vault (vault.centos.org). "Fully patched" here means patched to the end of that point release's own errata stream — the newest kernel it ever received is 3.10.0-1062.18.1.el7.
• Errata published after 7.8 shipped were released against later point releases, not against 7.7. Staying on 7.7 means deliberately forgoing them.
• CentOS 7 as a whole receives no further upstream security updates of any kind after its end-of-life date. Over time this image will carry unpatched vulnerabilities that cannot be remediated by updating CentOS 7, because upstream ships nothing further.
• This image is provided for legacy-migration and version-pinned use — running software certified only against CentOS 7.7, or reproducing an environment at the exact release it was signed off on. Plan a migration to a supported distribution such as AlmaLinux, Rocky Linux, CentOS Stream, or a current RHEL for any workload that must remain secure.

The stock CentOS 7 repositories point at mirror.centos.org, which was retired at end-of-life. This image has already repointed every repository to the CentOS 7.7.1908 vault, so yum keeps working — against the frozen 7.7 package set — out of the box.

What's included

• CentOS Linux 7.7.1908 (Core), binary compatible with RHEL 7
• Repositories pinned to vault.centos.org/7.7.1908, so yum keeps working post-EOL and stays on 7.7
• Every package that exists for 7.7.1908 applied at build time, including kernel 3.10.0-1062.18.1.el7
• A standard (non-LVM) single-partition xfs root
• Azure Linux Agent (WALinuxAgent) enabled, handling provisioning, SSH key injection and host key regeneration
• Chronyd for NTP time synchronisation
• SELinux in enforcing mode
• Gen1 Hyper V virtual machine support (BIOS boot)
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen1 Hyper V) Default user: azureuser

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

• The root account password is locked, so no one can log in as root with a password.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
• PermitRootLogin is set to no in the main /etc/ssh/sshd_config. CentOS 7's sshd has no sshd_config.d include directory, so the setting is applied in the main file, not a drop-in.
• The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• The machine identity and the SSH host keys are regenerated uniquely on every instance.
• SELinux is left in enforcing mode, the CentOS default.
• The only externally reachable listener is SSH on port 22. rpcbind is not installed at all, and its socket unit is masked so a later package install cannot silently reopen port 111.

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. Navigate to the Azure Marketplace and search for "CentOS 7.7 cloudimg"
2. Select the image and click Create
3. Configure the basics:
4. Subscription: Select your Azure subscription
5. Resource Group: Create new or select existing
6. Virtual Machine Name: Enter a name for your VM
7. Region: Select your preferred Azure region
8. Size: Standard_B2s recommended
9. Under Administrator Account, select SSH public key and enter your key
10. Under Inbound Port Rules, allow SSH (port 22)
11. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-centos-77-vm \
  --image cloudimg:centos:centos77:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-centos-77-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the point release

Check that the machine is the CentOS Linux 7.7.1908 release you expect. The centos-release package is the authoritative answer — /etc/os-release only carries the major version on CentOS 7:

cat /etc/centos-release
rpm -q centos-release
grep -E '^(NAME|VERSION|ID|VERSION_ID)=' /etc/os-release
uname -rm

Expected output:

CentOS Linux release 7.7.1908 (Core)
centos-release-7-7.1908.0.el7.centos.x86_64
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
VERSION_ID="7"
3.10.0-1062.18.1.el7.x86_64 x86_64

VERSION_ID="7" is expected: CentOS 7's /etc/os-release records only the major version, which is why /etc/centos-release and rpm -q centos-release are the checks that actually confirm the point release. Kernel 3.10.0-1062.18.1.el7 is the newest kernel ever published for 7.7. (CentOS 7's /etc/os-release has no PLATFORM_ID field — that was introduced in the el8 line.)

Step 4: The point release pin and the vault update path

This is the defining feature of this image. Because CentOS 7 is end-of-life its original mirrors are gone, so every repository is repointed to the CentOS 7.7.1908 vault — and pinning to that particular vault tree is what keeps the machine on 7.7:

yum repolist enabled
grep '^baseurl' /etc/yum.repos.d/CentOS-Base.repo
sudo yum -q check-update; echo "check-update exit: $?"

Expected output. Every repository resolves to vault.centos.org/7.7.1908, and check-update exits 0 because the image is already patched to the last packages published for this point release:

Loaded plugins: fastestmirror
Determining fastest mirrors
repo id                    repo name                                      status
base/x86_64                CentOS-7.7.1908 - Base (vault)                 10,097
extras/x86_64              CentOS-7.7.1908 - Extras (vault)                  341
updates/x86_64             CentOS-7.7.1908 - Updates (vault)               1,787
repolist: 12,225
baseurl=https://vault.centos.org/7.7.1908/os/$basearch/
baseurl=https://vault.centos.org/7.7.1908/updates/$basearch/
baseurl=https://vault.centos.org/7.7.1908/extras/$basearch/
baseurl=https://vault.centos.org/7.7.1908/centosplus/$basearch/
check-update exit: 0

Why the pin holds. A vault tree for a point release is frozen and self contained. The updates repository for 7.7.1908 carries the errata issued during 7.7's own lifetime, and it contains no centos-release package — so yum update applies those errata and stops. It cannot pull in the centos-release package from a later tree, which is what would otherwise move the machine to 7.8 or beyond.

CentOS also ships a CentOS-Vault.repo listing every historical point release. On this image every one of those sections is left disabled, so nothing crosses point releases unless you deliberately enable it:

awk '/^enabled=1/{n++} END{print n+0}' /etc/yum.repos.d/CentOS-Vault.repo

Expected output:

0

check-update returning 0 means no newer packages exist in the 7.7.1908 vault — the image is patched to the end of this point release's errata stream. No further security updates will ever be published upstream, for 7.7 or for CentOS 7 at all. For anything beyond legacy migration or version pinning, move to a supported distribution.

Step 5: Verify the security posture

Confirm SELinux is enforcing, root is locked, and SSH is key only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) '
systemctl is-active rpcbind.socket || true

Expected output:

Enforcing
root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.)
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
unknown

root LK means the root password is locked. rpcbind.socket reporting unknown is intentional and is stronger than inactive: the rpcbind package is not installed on this image at all, so there is no RPC listener on port 111 to disable. If you need NFSv3 later, install nfs-utils first, then sudo systemctl unmask rpcbind.socket && sudo systemctl enable --now rpcbind.socket.

Step 6: Verify Azure integration

Confirm the Azure Linux Agent and time synchronisation are healthy, and check your resources:

systemctl is-active waagent
systemctl is-enabled waagent
rpm -q WALinuxAgent
grep -E '^Provisioning\.(Agent|Enabled|UseCloudInit)=' /etc/waagent.conf
systemctl is-active chronyd
df -h /
free -h

Expected output:

active
enabled
WALinuxAgent-2.2.38-2.el7_7.noarch
Provisioning.Enabled=y
Provisioning.UseCloudInit=n
Provisioning.Agent=waagent
active
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1        10G  1.4G  8.7G  14% /
              total        used        free      shared  buff/cache   available
Mem:           3.9G        195M        3.3G         16M        377M        3.4G
Swap:            0B          0B          0B

waagent is what lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled.

On this image the Azure Linux Agent is the sole provisioning agent and cloud-init is not installed. That is deliberate. The two cannot run side by side on CentOS 7 — the agent refuses to provision at all if it finds cloud-init running — and of the two only WALinuxAgent injects your SSH key dependably on this release. Leaving cloud-init out is what makes the image provision reliably and receive your key on first boot. cloud-utils-growpart is still installed, so the manual root-grow path described below works normally.

Swap: 0B is deliberate. Azure manages swap on the temporary resource disk through waagent, and no swap file or swap partition ships inside the image.

Step 7: Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22.

Confirm what is listening before you open anything. Use sudo ss: on CentOS 7 the ss binary lives in /usr/sbin, which is only added to a non-root PATH by /etc/profile — and a non-interactive ssh host 'command' never sources it, so a bare ss returns "command not found" there.

sudo ss -tln | awk 'NR==1 || $1=="LISTEN"'

Expected output:

State      Recv-Q Send-Q Local Address:Port               Peer Address:Port
LISTEN     0      128          *:22                       *:*
LISTEN     0      100    127.0.0.1:25                       *:*
LISTEN     0      128       [::]:22                    [::]:*
LISTEN     0      100      [::1]:25                    [::]:*

The only externally reachable listener is sshd on port 22. You will also see postfix bound to 127.0.0.1:25 and [::1]:25 — that is the local mail transport, reachable only from the machine itself, not from the network.

This image has two firewalls, and a new port must be opened in both. That is standard CentOS 7 behaviour and it is kept deliberately:

1. The Azure Network Security Group, which filters before traffic reaches the VM.
2. firewalld on the machine itself, which ships enabled and active in the public zone, permitting only the ssh and dhcpv6-client services.

Opening a port in the NSG alone is the most common reason a newly installed service is still unreachable — firewalld is silently dropping it. Inspect the host firewall with sudo firewall-cmd --list-all:

sudo firewall-cmd --list-all

Expected output:

public (active)
  target: default
  icmp-block-inversion: no
  interfaces: eth0
  sources:
  services: dhcpv6-client ssh
  ports:
  protocols:
  masquerade: no
  forward-ports:
  source-ports:
  icmp-blocks:
  rich rules:

To open a port for a service you install later, add it to firewalld permanently and reload — for HTTPS that is sudo firewall-cmd --permanent --add-service=https followed by sudo firewall-cmd --reload, and for an arbitrary port sudo firewall-cmd --permanent --add-port=8080/tcp then the same reload. Add the matching inbound rule to the Network Security Group as well. Never remove the ssh service from the zone while you are connected over SSH — that locks you out of the machine.

Growing the root filesystem

The root filesystem is a single xfs partition on /dev/sda, and growpart and xfs_growfs are preinstalled. If you give the VM a larger OS disk than the image ships with, stop the VM, raise the OS disk size in the Azure Portal (or with az disk update --size-gb), start it again, then grow the partition with sudo growpart /dev/sda 1 followed by sudo xfs_growfs /. Both operate on the mounted filesystem, so no reboot is needed after the resize. If the partition already fills the disk, growpart reports NOCHANGE and exits non zero — that is the expected answer and means there is no unallocated space to claim.

Common Use Cases

• Running software certified specifically against CentOS 7.7, rather than against the CentOS 7 series
• Reproducing a legacy environment at the exact point release it was built and signed off on
• Lift-and-shift of a version pinned on-premises CentOS 7.7 estate into Azure as a migration staging step
• Compatibility and RPM validation work against the RHEL 7.7 ABI

For any workload that must stay secure long term, migrate to AlmaLinux, Rocky Linux, CentOS Stream, or a current RHEL — CentOS 7 receives no further upstream security updates.

Troubleshooting

Cannot connect via SSH

1. Verify the VM is in Running state in the Azure Portal
2. Check that port 22 is allowed in the Network Security Group
3. Ensure you are using the correct username: azureuser
4. Verify your SSH key matches the one you supplied at create time. Password login is disabled by design, so a wrong key cannot fall back to a password prompt.

Package manager cannot reach a mirror

CentOS 7's original mirrors were retired at end-of-life. This image already points at the 7.7.1908 vault, but if you add a third-party .repo that still references mirror.centos.org you will see 404s. Repoint it to https://vault.centos.org/7.7.1908/... or remove it. Confirm nothing still references the retired mirrors:

grep -RE '^[[:space:]]*(baseurl|mirrorlist)[[:space:]]*=.*mirror(list)?\.centos\.org' /etc/yum.repos.d/ || echo "all repos already on the vault"

The pattern deliberately matches only active baseurl= / mirrorlist= directives. A plain search for the hostname also hits the commented-out stock lines and the explanatory comment cloudimg writes into CentOS-Base.repo, so it reports a hit on a perfectly correct image.

A package I need is not in the repositories

The 7.7.1908 vault is frozen, and it is smaller than the final 7.9 tree — anything added to CentOS 7 after 7.7 shipped is not in it. EPEL-only packages (for example nginx) are not present in base, updates or extras at all. Either install from an external repository you control, or use the CentOS 7 image, which ships the final 7.9.2009 package set.

Note that enabling one of the other point release sections in /etc/yum.repos.d/CentOS-Vault.repo will pull packages from a different release and defeat the point release pin this image exists to provide.

Azure agent not running

Check the agent's status:

systemctl status waagent --no-pager

If it is not running, start and enable it with sudo systemctl enable --now waagent.

Important Notes

CentOS Linux is free and open source. It is not covered by a single licence: it is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. Every package's terms are readable with rpm -qi <package> and under /usr/share/licenses/. No subscription, licence key or Red Hat entitlement is required.

CentOS Linux 7 reached end-of-life on 30 June 2024 and receives no further upstream security updates, and 7.7.1908 was superseded upstream by 7.8 and 7.9. This image is patched to the last packages that exist for 7.7.1908, from the frozen CentOS 7.7.1908 vault, and is provided for legacy-migration and version-pinned use. Plan a migration to a supported distribution (AlmaLinux, Rocky Linux, CentOS Stream, or a current RHEL) for any workload that must remain secure.

CentOS is a trademark of Red Hat, Inc. The name is used here nominatively, only to identify the distribution this image contains. cloudimg is not affiliated with, endorsed by or sponsored by Red Hat.

Support

For assistance with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• Product Catalogue: www.cloudimg.co.uk/products
• User Guides: www.cloudimg.co.uk/guides
• SLA: 24 hour response guaranteed