CentOS 7 on Azure User Guide

Overview

This guide covers the deployment and configuration of CentOS 7 (CentOS Linux 7.9.2009, the final CentOS 7 release) on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

CentOS Linux is a community rebuild of Red Hat Enterprise Linux, binary compatible with RHEL 7. This image is provided deliberately for legacy-migration workloads: teams moving software that is still certified only on the CentOS 7 / RHEL 7 platform, and needing a clean, hardened CentOS 7.9 base while they re-platform.

End-of-life notice — read this first

CentOS Linux 7 reached end-of-life on 30 June 2024. The upstream CentOS Project no longer produces any updates for it, including security updates. Consequently:

• This image is patched only to its capture date, from the frozen CentOS 7.9.2009 vault (vault.centos.org). No newer CentOS 7 packages exist upstream, so "fully patched" means patched to the last packages the vault ever published.
• After the end-of-life date, no further upstream security updates are published. Over time the image will carry unpatched vulnerabilities that cannot be remediated by updating CentOS 7, because upstream ships nothing further.
• This image is provided for legacy-migration use — running or testing software that is only certified on the CentOS 7 / RHEL 7 platform while you migrate. Plan a migration to a supported distribution such as AlmaLinux, Rocky Linux, CentOS Stream, or a current RHEL for any workload that must remain secure.

The stock CentOS 7 repositories point at mirror.centos.org, which was retired at end-of-life. This image has already repointed every repository to the CentOS 7.9.2009 vault, so yum keeps working — against the frozen, final package set — out of the box.

What's included

• CentOS Linux 7.9.2009 (Core), binary compatible with RHEL 7
• A standard (non-LVM) single-partition xfs root
• Every available 7.9.2009 vault package applied at build time (patched to capture date)
• Repositories repointed to vault.centos.org/7.9.2009 so yum keeps working post-EOL
• Azure Linux Agent (WALinuxAgent) injected and enabled, plus cloud-init, for Azure provisioning
• Chronyd for NTP time synchronisation
• SELinux in enforcing mode
• Gen1 Hyper V virtual machine support (BIOS boot)
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen1 Hyper V) Default user: azureuser

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

• The root account password is locked, so no one can log in as root with a password.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
• PermitRootLogin is set to no in the main /etc/ssh/sshd_config. CentOS 7's sshd has no sshd_config.d include directory, so the setting is applied in the main file, not a drop-in.
• The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• The machine identity and the SSH host keys are regenerated uniquely on every instance.
• SELinux is left in enforcing mode, the CentOS default.
• The unused rpcbind listener on port 111 is disabled.

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. Navigate to the Azure Marketplace and search for "CentOS 7 cloudimg"
2. Select the image and click Create
3. Configure the basics:
4. Subscription: Select your Azure subscription
5. Resource Group: Create new or select existing
6. Virtual Machine Name: Enter a name for your VM
7. Region: Select your preferred Azure region
8. Size: Standard_B2s recommended
9. Under Administrator Account, select SSH public key and enter your key
10. Under Inbound Port Rules, allow SSH (port 22)
11. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-centos-7-vm \
  --image cloudimg:centos:centos7:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-centos-7-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release

Check that the machine is the CentOS Linux 7.9.2009 release you expect:

cat /etc/centos-release
grep -E '^(NAME|VERSION|ID|VERSION_ID)=' /etc/os-release
uname -rm

Expected output:

CentOS Linux release 7.9.2009 (Core)
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
VERSION_ID="7"
3.10.0-1160.119.1.el7.x86_64 x86_64

(CentOS 7's /etc/os-release has no PLATFORM_ID field — that was introduced in the el8 line.)

Step 4: The vault update path (end-of-life)

Because CentOS 7 is end-of-life, its original mirrors are gone. This image repoints every repository to the CentOS 7.9.2009 vault, so yum keeps working against the frozen final package set:

yum repolist enabled
grep '^baseurl' /etc/yum.repos.d/CentOS-Base.repo
sudo yum -q check-update; echo "check-update exit: $?"

Expected output (repositories point at vault.centos.org, and check-update exits 0 because the image is already patched to the last vault packages):

repo id            repo name                            status
base/x86_64        CentOS-7.9.2009 - Base (vault)       10,072
extras/x86_64      CentOS-7.9.2009 - Extras (vault)        526
updates/x86_64     CentOS-7.9.2009 - Updates (vault)     6,173
repolist: 16,771
baseurl=https://vault.centos.org/7.9.2009/os/$basearch/
baseurl=https://vault.centos.org/7.9.2009/updates/$basearch/
baseurl=https://vault.centos.org/7.9.2009/extras/$basearch/
check-update exit: 0

check-update returning 0 means no newer packages exist in the vault — the image is patched to the end of the CentOS 7 lifecycle. No further security updates will ever be published upstream. For anything beyond legacy migration, move to a supported distribution.

Step 5: Verify the security posture

Confirm SELinux is enforcing, root is locked, and SSH is key only:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) '
systemctl is-active rpcbind.socket || true

Expected output:

Enforcing
root LK 2022-11-11 0 99999 7 -1 (Password locked.)
permitrootlogin no
passwordauthentication no
pubkeyauthentication yes
inactive

rpcbind.socket reporting inactive is intentional: the unadvertised RPC listener on port 111 is disabled.

Step 6: Verify Azure integration

Confirm the Azure Linux Agent, cloud-init and time synchronisation are healthy, and check your resources:

systemctl is-active waagent
systemctl is-enabled waagent
cloud-init --version
systemctl is-active chronyd
df -h /
free -h

waagent is what lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled.

Step 7: Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22.

Confirm what is listening before you open anything:

ss -tlnp

The only externally reachable listener is sshd on port 22. You will also see postfix bound to 127.0.0.1:25 and ::1:25 — that is the local mail transport, reachable only from the machine itself, not from the network.

This image binds no unnecessary external listeners: rpcbind (the local RPC helper on port 111 that the stock cloud image leaves running) is disabled, because NFSv4 does not use it. If you need NFSv3 you can restore it with sudo systemctl enable --now rpcbind.socket.

If your policy requires a host firewall as well, install and enable firewalld — sudo yum install -y firewalld && sudo systemctl enable --now firewalld — then add the SSH service first with sudo firewall-cmd --permanent --add-service=ssh and sudo firewall-cmd --reload so you do not lock yourself out.

Common Use Cases

• Running legacy software that is only certified on the CentOS 7 / RHEL 7 platform, while you re-platform
• Lift-and-shift of an existing on-premises CentOS 7 estate into Azure as a migration staging step
• Reproducing and testing against a CentOS 7 environment for compatibility work
• A short-lived base for building and validating packages against the RHEL 7 ABI

For any workload that must stay secure long term, migrate to AlmaLinux, Rocky Linux, CentOS Stream, or a current RHEL — CentOS 7 receives no further upstream security updates.

Troubleshooting

Cannot connect via SSH

1. Verify the VM is in Running state in the Azure Portal
2. Check that port 22 is allowed in the Network Security Group
3. Ensure you are using the correct username: azureuser
4. Verify your SSH key matches the one you supplied at create time. Password login is disabled by design, so a wrong key cannot fall back to a password prompt.

Package manager cannot reach a mirror

CentOS 7's original mirrors were retired at end-of-life. This image already points at the vault, but if you add a third-party .repo that still references mirror.centos.org you will see 404s. Repoint it to https://vault.centos.org/7.9.2009/... or remove it. Confirm nothing still references the retired mirrors:

grep -R mirror.centos.org /etc/yum.repos.d/ || echo "all repos already on the vault"

Azure agent not running

Check the agent's status:

systemctl status waagent --no-pager

If it is not running, start and enable it with sudo systemctl enable --now waagent.

Important Notes

CentOS Linux is free and open source. It is not covered by a single licence: it is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. Every package's terms are readable with rpm -qi <package> and under /usr/share/licenses/. No subscription, licence key or Red Hat entitlement is required.

CentOS Linux 7 reached end-of-life on 30 June 2024 and receives no further upstream security updates. This image is patched only to its capture date, from the frozen CentOS 7.9.2009 vault, and is provided for legacy-migration use. Plan a migration to a supported distribution (AlmaLinux, Rocky Linux, CentOS Stream, or a current RHEL) for any workload that must remain secure.

CentOS is a trademark of Red Hat, Inc. The name is used here nominatively, only to identify the distribution this image contains. cloudimg is not affiliated with, endorsed by or sponsored by Red Hat.

Support

For assistance with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• Product Catalogue: www.cloudimg.co.uk/products
• User Guides: www.cloudimg.co.uk/guides
• SLA: 24 hour response guaranteed