Operating Systems Azure

CentOS 7 Minimal on Azure User Guide

| Product: CentOS 7 Minimal on Azure

Overview

This guide covers the deployment and configuration of CentOS 7 Minimal (CentOS Linux 7.9.2009, the final CentOS 7 release, with a reduced package set) on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

CentOS Linux is a community rebuild of Red Hat Enterprise Linux, binary compatible with RHEL 7. This image is provided deliberately for legacy-migration workloads: teams moving software that is still certified only on the CentOS 7 / RHEL 7 platform, and needing a clean, hardened CentOS 7.9 base while they re-platform.

It is the Minimal variant. It is the same CentOS Linux 7.9.2009 as cloudimg's standard CentOS 7 image, with the packages an Azure guest cannot use removed. If you want the standard package set, use that image instead — the two are separate listings and you can run both.

End-of-life notice — read this first

CentOS Linux 7 reached end-of-life on 30 June 2024. The upstream CentOS Project no longer produces any updates for it, including security updates. Consequently:

  • This image is patched only to its capture date, from the frozen CentOS 7.9.2009 vault (vault.centos.org). The vault's updates repository was last published on 21 June 2024, nine days before end-of-life, and nothing has been added to it since. "Fully patched" therefore means patched to the last packages that will ever exist for this release.
  • After the end-of-life date, no further upstream security updates are published. Over time the image will carry unpatched vulnerabilities that cannot be remediated by updating CentOS 7, because upstream ships nothing further.
  • This image is provided for legacy-migration use — running or testing software that is only certified on the CentOS 7 / RHEL 7 platform while you migrate. Plan a migration to a supported distribution such as AlmaLinux, Rocky Linux, CentOS Stream, or a current RHEL for any workload that must remain secure.

The stock CentOS 7 repositories point at mirror.centos.org, which was retired at end-of-life. This image has already repointed every repository to the CentOS 7.9.2009 vault, so yum keeps working — against the frozen, final package set — out of the box.

Removing packages does not change any of this. A smaller package set means fewer components that can carry a vulnerability, which is a genuine benefit on an end-of-life platform, but it is not a substitute for migrating.

What makes this the Minimal image

Every number below was measured during the build of this image, on the same kernel and the same day, against cloudimg's standard CentOS 7 image that this one is cut from. The image ships the comparison itself at /usr/share/cloudimg/centos-7-minimal.manifest, so you can verify it on your own running machine rather than taking this page's word for it.

Standard CentOS 7 CentOS 7 Minimal Difference
Installed packages 309 296 13 fewer
Package payload on disk 1,118 MB 672 MB 446 MB smaller (40%)
Root filesystem used 1,517 MB 841 MB 676 MB smaller (45%)
Externally reachable TCP listeners 22 22 unchanged
Loopback listeners mail transport on 25, time on 323 time on 323 mail transport removed

The removals are chosen on one test: can an Azure virtual machine ever use this? Nothing was removed to hit a size target, and nothing that the platform needs to boot, network, authenticate, patch or be managed by Azure was touched.

Removed Why an Azure guest cannot use it
linux-firmware 394 MB of firmware for physical network cards, GPUs, wireless radios and storage controllers. An Azure virtual machine has none of that hardware: its disks and network are the in kernel Hyper V synthetic drivers, which load no firmware at all.
microcode_ctl CPU microcode updates. A guest cannot apply microcode; the Azure host does it.
postfix, mariadb-libs A local mail transport listening on 127.0.0.1:25. A minimal base ships no mail server, and removing it closes two listeners.
lshw, hwdata A hardware inventory tool and its 14 MB PCI and USB identifier database, for enumerating physical hardware.
btrfs-progs btrfs is deprecated and unsupported on CentOS 7, and Azure images use xfs.
sg3_utils SCSI generic passthrough tools. Azure storage uses the synthetic driver, and the Azure disk naming rules on this image do not call these tools.
tuned Tuning profile daemon. Azure guests use the platform defaults.
qemu-guest-agent The KVM and QEMU guest agent, inherited from the upstream cloud image's origin. Azure uses the Azure Linux Agent instead, so this was a live daemon doing nothing.
kexec-tools Crash dump tooling. kdump reserves memory on a small virtual machine for a dump path a marketplace image never uses.
dracut-config-rescue, teamd Rescue boot image generation, and network interface teaming, which Azure networking does not use.

What was deliberately kept. binutils looks like an obvious 24 MB saving and is not removable on CentOS 7: /usr/bin/nm is required by kmod, and the dependency cascade from there reaches openssh and systemd. The same applies to wpa_supplicant (required by NetworkManager), cracklib-dicts, grub2-tools-extra, bind-export-libs, nss-tools, shared-mime-info, kbd-misc, python-babel and gettext. Every candidate in the build was checked with rpm -e --test and against the full yum removal transaction before anything was erased, so this image contains no package removed by force and no broken dependency.

NFS client support is retained in full. Only the rpcbind portmapper is switched off, and NFSv4 does not use it.

What's included

  • CentOS Linux 7.9.2009 (Core), binary compatible with RHEL 7, with a reduced package set
  • A standard (non-LVM) single-partition xfs root
  • Every available 7.9.2009 vault package applied at build time (patched to capture date)
  • Repositories repointed to vault.centos.org/7.9.2009 so yum keeps working post-EOL
  • Azure Linux Agent (WALinuxAgent) and cloud-init, for Azure provisioning
  • Chronyd for NTP time synchronisation
  • SELinux in enforcing mode
  • A package set manifest at /usr/share/cloudimg/centos-7-minimal.manifest
  • Gen1 Hyper V virtual machine support (BIOS boot)
  • 24/7 cloudimg support

Platform: Microsoft Azure (Gen1 Hyper V) Default user: azureuser

Security posture

  • No baked-in credentials: the root password is locked, and there is no shipped SSH key
  • SSH host keys are regenerated on first boot, so no two virtual machines share an identity
  • SSH is key only: password authentication and root login are both disabled
  • SELinux is enforcing, with the targeted policy
  • Exactly one externally reachable TCP listener, sshd on port 22
  • The rpcbind RPC listener on port 111 is disabled and masked
  • No local mail transport, and therefore no listener on port 25
  • No swap is baked into the image; Azure manages swap on the ephemeral resource disk

Prerequisites

Before deploying this image, ensure you have:

  1. An active Microsoft Azure subscription
  2. Access to the Azure Portal or Azure CLI
  3. An SSH key pair for Linux VM access
  4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

  1. Navigate to the Azure Marketplace and search for "CentOS 7 Minimal cloudimg"
  2. Select the image and click Create
  3. Configure the basics:
  4. Subscription: Select your Azure subscription
  5. Resource Group: Create new or select existing
  6. Virtual Machine Name: Enter a name for your VM
  7. Region: Select your preferred Azure region
  8. Size: Standard_B2s recommended
  9. Under Administrator Account, select SSH public key and enter your key
  10. Under Inbound Port Rules, allow SSH (port 22)
  11. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-centos-7-minimal-vm \
  --image cloudimg:centos:centos7min:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-centos-7-minimal-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release

Check that the machine is the CentOS Linux 7.9.2009 release you expect:

cat /etc/centos-release
grep -E '^(NAME|VERSION|ID|VERSION_ID)=' /etc/os-release
uname -rm
rpm -qa | wc -l

Expected output:

CentOS Linux release 7.9.2009 (Core)
NAME="CentOS Linux"
VERSION="7 (Core)"
ID="centos"
VERSION_ID="7"
3.10.0-1160.119.1.el7.x86_64 x86_64
296

(CentOS 7's /etc/os-release has no PLATFORM_ID field — that was introduced in the el8 line.)

Terminal showing cat of etc centos-release reporting CentOS Linux release 7.9.2009 Core, os-release fields ID centos and VERSION_ID 7, uname reporting the 3.10.0 el7 kernel on x86_64, and rpm reporting 296 installed packages

Step 4: Confirm the minimal package set

This is the property you are choosing when you pick this image over the standard CentOS 7 one, so verify it directly. The manifest is generated during the build and shipped in the image:

cat /usr/share/cloudimg/centos-7-minimal.manifest
rpm -q linux-firmware microcode_ctl postfix tuned qemu-guest-agent || echo "(absent by design in the Minimal image)"
df -h /

Expected output:

cloudimg CentOS 7 Minimal — package-set manifest

Standard CentOS 7 : 309 packages, 1118 MB of package payload
CentOS 7 Minimal  : 296 packages, 672 MB of package payload
Delta             : -13 packages, -446 MB
...
package linux-firmware is not installed
package microcode_ctl is not installed
package postfix is not installed
package tuned is not installed
package qemu-guest-agent is not installed
(absent by design in the Minimal image)
Filesystem      Size  Used Avail Use% Mounted on
/dev/sda1       8.0G  1.1G  7.0G  13% /

The is not installed lines are the point of the image, not an error. The manifest lists every removal, why it was safe on Azure, and which packages were deliberately kept because removing them would break CentOS 7.

Terminal showing the shipped cloudimg package set manifest reporting the standard CentOS 7 image at 309 packages and 1118 MB against this Minimal image at 296 packages and 672 MB, a delta of minus 13 packages and minus 446 MB, the full list of removed packages, and rpm confirming linux firmware microcode postfix tuned and the QEMU guest agent are not installed

Step 5: Verify the security posture

Confirm SELinux is enforcing, root is locked, SSH is key only, and that exactly one port is reachable from the network:

getenforce
sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication) '
ss -tlnH | awk '{print $1, $4}'
ss -ulnH | awk '{print $1, $4}'

Expected output:

Enforcing
root LK 2009-12-22 -1 -1 -1 -1 (Alternate authentication scheme in use.)
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
LISTEN *:22
LISTEN [::]:22
UNCONN *:68
UNCONN 127.0.0.1:323
UNCONN [::1]:323

Read the third column of ss output, which is the local address the socket is bound to. The only externally reachable TCP listener is sshd on port 22. On UDP, *:68 is the DHCP client, which every Azure virtual machine needs to hold its network lease, and 127.0.0.1:323 is chrony's time synchronisation control socket, reachable only from the machine itself.

Note what is not in that list: the standard CentOS 7 image also binds a local mail transport on 127.0.0.1:25 and ::1:25. This image removed it with the package.

Terminal showing getenforce reporting Enforcing with the targeted policy, passwd reporting root as LK meaning locked, the effective sshd policy reporting permitrootlogin no passwordauthentication no and pubkeyauthentication yes, and ss reporting only port 22 listening on TCP with the DHCP client and chrony on UDP

Step 6: Verify the vault update path and Azure integration

Because CentOS 7 is end-of-life, its original mirrors are gone. This image repoints every repository to the CentOS 7.9.2009 vault, so yum keeps working against the frozen final package set. Confirm that, and that the Azure Linux Agent survived the package trim:

yum repolist enabled
grep '^baseurl' /etc/yum.repos.d/CentOS-Base.repo
sudo yum -q check-update; echo "check-update exit: $?"
systemctl is-active waagent
systemctl is-enabled waagent
cloud-init --version
systemctl is-active chronyd

Expected output:

repo id            repo name                            status
base/x86_64        CentOS-7.9.2009 - Base (vault)       10,072
extras/x86_64      CentOS-7.9.2009 - Extras (vault)        526
updates/x86_64     CentOS-7.9.2009 - Updates (vault)     6,173
repolist: 16,771
baseurl=https://vault.centos.org/7.9.2009/os/$basearch/
baseurl=https://vault.centos.org/7.9.2009/updates/$basearch/
baseurl=https://vault.centos.org/7.9.2009/extras/$basearch/
check-update exit: 0
active
enabled
/bin/cloud-init 19.4
active

check-update returning 0 means no newer packages exist in the vault: the image is patched to the end of the CentOS 7 lifecycle. No further security updates will ever be published upstream. For anything beyond legacy migration, move to a supported distribution.

waagent is what lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health, so it should always be active and enabled. The package trim deliberately protects it: an image that saved space by dropping the Azure Linux Agent would not provision at all.

Terminal showing yum repolist with the base updates and extras repositories repointed to the CentOS 7.9.2009 vault, yum check-update exiting 0 meaning patched to the final vault packages, and the Azure Linux Agent reporting active and enabled alongside cloud-init and chronyd

Step 7: Putting back anything you need

Nothing in this image is removed by force, so anything trimmed reinstalls normally from the vault. If you need a package that is not here, install it the usual way with sudo yum install -y <package>.

Two cases are worth calling out:

  • Mail delivery. postfix is not installed, so there is no /usr/sbin/sendmail and cron cannot mail job output to MAILTO. If you need local mail, sudo yum install -y postfix && sudo systemctl enable --now postfix restores exactly the standard image's behaviour, including the loopback listener on port 25.
  • NFSv3. The NFS client is fully installed, but the rpcbind portmapper is disabled and masked because NFSv4 does not need it. NFSv3 does. Restore it with sudo systemctl unmask rpcbind.socket followed by sudo systemctl enable --now rpcbind.socket.

Reinstalling a trimmed package is supported and safe. It simply returns that part of the image to the standard CentOS 7 behaviour.

Step 8: Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22.

Confirm what is listening before you open anything:

sudo ss -tlnp

If your policy requires a host firewall as well, install and enable firewalld — sudo yum install -y firewalld && sudo systemctl enable --now firewalld — then add the SSH service first with sudo firewall-cmd --permanent --add-service=ssh and sudo firewall-cmd --reload so you do not lock yourself out.

Common Use Cases

  • Running legacy software that is only certified on the CentOS 7 / RHEL 7 platform, while you re-platform
  • A lean base for building and validating packages against the RHEL 7 ABI, where a smaller image means faster provisioning and fewer components to review
  • Lift-and-shift of an existing on-premises CentOS 7 estate into Azure as a migration staging step, on a reduced attack surface

For any workload that must stay secure long term, migrate to AlmaLinux, Rocky Linux, CentOS Stream, or a current RHEL — CentOS 7 receives no further upstream security updates.

Troubleshooting

Cannot connect via SSH

  1. Verify the VM is in Running state in the Azure Portal
  2. Check that port 22 is allowed in the Network Security Group
  3. Ensure you are using the correct username: azureuser
  4. Verify your SSH key matches the one you supplied at create time. Password login is disabled by design, so a wrong key cannot fall back to a password prompt.

A command or tool is missing

This is the Minimal image, so some tooling present on the standard CentOS 7 image is not installed. Check the manifest to see whether a package was removed deliberately, then reinstall it from the vault if you need it:

grep -A 20 '^Removed' /usr/share/cloudimg/centos-7-minimal.manifest

Package manager cannot reach a mirror

CentOS 7's original mirrors were retired at end-of-life. This image already points at the vault, but if you add a third-party .repo that still references mirror.centos.org you will see 404s. Repoint it to https://vault.centos.org/7.9.2009/... or remove it. Confirm nothing still references the retired mirrors:

grep -R mirror.centos.org /etc/yum.repos.d/ || echo "all repos already on the vault"

Azure agent not running

Check the agent's status:

systemctl status waagent --no-pager

If it is not running, start and enable it with sudo systemctl enable --now waagent.

Important Notes

CentOS Linux is free and open source. It is not covered by a single licence: it is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. Every package's terms are readable with rpm -qi <package> and under /usr/share/licenses/. No subscription, licence key or Red Hat entitlement is required. Removing packages changes no licence term.

CentOS Linux 7 reached end-of-life on 30 June 2024 and receives no further upstream security updates. This image is patched only to its capture date, from the frozen CentOS 7.9.2009 vault, and is provided for legacy-migration use. Plan a migration to a supported distribution (AlmaLinux, Rocky Linux, CentOS Stream, or a current RHEL) for any workload that must remain secure.

CentOS is a trademark of Red Hat, Inc. The name is used here nominatively, only to identify the distribution this image contains. cloudimg is not affiliated with, endorsed by or sponsored by Red Hat.

Support

For assistance with this image, contact cloudimg support: