CentOS Linux 8 on Azure User Guide

End of life notice — read this first

CentOS Linux 8 reached end of life on 31 December 2021. It receives no further security updates from upstream. This cloudimg image is brought fully up to date against the final CentOS 8 package set preserved at the CentOS vault (release 8.5.2111), and it is patched only to that capture date. It is provided as a convenience for legacy migration work: lifting an application off an existing CentOS 8 estate, testing a port to a supported platform, or reproducing a CentOS 8 build environment. It is not a supported, currently patched operating system. For a production workload that needs ongoing security updates, choose a maintained distribution such as CentOS Stream 9/10, Rocky Linux 8/9/10 or AlmaLinux 8/9/10, all of which cloudimg also publishes.

Overview

This guide covers the deployment of CentOS Linux 8 on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

CentOS Linux 8 is a community rebuild of Red Hat Enterprise Linux 8, binary compatible with the RHEL 8 platform. This image tracks 8.5.2111, the final CentOS Linux 8 release. Because no CentOS 8 GenericCloud image was ever published at the 8.5 level, cloudimg builds this image from the last published CentOS 8 cloud image and brings it fully up to date against the 8.5.2111 vault, so /etc/centos-release reports CentOS Linux release 8.5.2111.

What's included:

• CentOS Linux 8.5.2111, binary compatible with RHEL 8 (platform:el8)
• A standard, plain partition layout: a single xfs root filesystem on /dev/sda1 (no LVM)
• Every package brought up to the final 8.5.2111 vault level at build time
• BaseOS, AppStream and Extras repositories repointed to the CentOS vault, so dnf keeps working after end of life
• dnf-automatic armed, so the machine keeps applying the final vault packages on a timer
• Azure Linux Agent (waagent) injected and cloud-init configured for Azure
• SELinux loaded with the targeted policy (permissive mode — see the security section)
• Gen1 Hyper V virtual machine (BIOS boot)
• 24/7 cloudimg support for the image and its deployment

Platform: Microsoft Azure (Gen1 Hyper V) Default user: azureuser

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

• The root account password is locked, so no one can log in as root with a password.
• PasswordAuthentication is disabled in the SSH daemon, so every login is by key.
• PermitRootLogin is set to no, so root cannot be reached over SSH at all.
• The SSH hardening is written into the main /etc/ssh/sshd_config (CentOS 8's stock config has no Include for drop in files, so a drop in alone would be ignored).
• The only key that works is the public key you supply when you create the virtual machine. Azure injects it into azureuser at first boot, so no two machines you launch ever share a secret.
• The machine identity and the SSH host keys are regenerated uniquely on every instance.
• The unused rpcbind listener on port 111 is disabled, and cockpit is masked, so the only port the image ships is SSH on 22.

SELinux mode. SELinux is loaded with the targeted policy but is set to permissive on this image. Permissive mode logs policy violations without blocking them. This is a deliberate choice for an end of life image whose priority is a reliable boot for legacy migration workloads; the SELinux policy shipped with CentOS 8 is frozen and will not receive fixes, so enforcing mode carries a real risk of blocking a legacy application on a policy that can never be corrected upstream. If your workload requires enforcing mode, you can switch it on and relabel:

sudo sed -i 's/^SELINUX=.*/SELINUX=enforcing/' /etc/selinux/config
sudo fixfiles -f -F relabel
sudo reboot

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for Linux VM access
4. Familiarity with Azure VM management

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Step 1: Deploy the Virtual Machine

Option A: Azure Portal

1. Navigate to the Azure Marketplace and search for "CentOS Linux 8 cloudimg"
2. Select the image and click Create
3. Configure the basics:
4. Subscription: Select your Azure subscription
5. Resource Group: Create new or select existing
6. Virtual Machine Name: Enter a name for your VM
7. Region: Select your preferred Azure region
8. Size: Standard_B2s recommended
9. Under Administrator Account, select SSH public key and enter your key
10. Under Inbound Port Rules, allow SSH (port 22)
11. Click Review + Create, then Create

Option B: Azure CLI

az vm create \
  --resource-group myResourceGroup \
  --name my-centos-8-vm \
  --image cloudimg:centos:centos8:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Step 2: Connect via SSH

Run these on your own workstation, not on the VM. Find the public IP, then connect:

az vm show --resource-group myResourceGroup --name my-centos-8-vm --show-details --query publicIps -o tsv
ssh azureuser@<vm-ip>

There is no password to enter. If SSH asks you for one, the key you supplied at create time is not the key your client is offering.

Step 3: Confirm the release

Check that the machine is the CentOS Linux 8.5.2111 release you expect:

cat /etc/centos-release
grep -E '^(NAME|VERSION|ID|PLATFORM_ID)=' /etc/os-release
uname -rm

Expected output:

CentOS Linux release 8.5.2111
NAME="CentOS Linux"
VERSION="8"
ID="centos"
PLATFORM_ID="platform:el8"
4.18.0-348.7.1.el8_5.x86_64 x86_64

CentOS Linux release 8.5.2111 is the final CentOS Linux 8 release. The el8_5 kernel is the last kernel published for CentOS 8.

Step 4: Verify the partition layout

This image uses a standard, plain layout: a single xfs root filesystem on a normal partition, with no LVM. Confirm it:

lsblk -o NAME,TYPE,FSTYPE,SIZE,MOUNTPOINT
findmnt /
sudo pvs

Expected output:

NAME   TYPE FSTYPE  SIZE MOUNTPOINT
sda    disk          10G
└─sda1 part xfs      10G /
sdb    disk           8G
└─sdb1 part ext4      8G /mnt

/dev/sda1 xfs /

(pvs prints nothing — there is no LVM)

Root is /dev/sda1, a plain xfs partition. sdb is the Azure ephemeral resource disk, mounted at /mnt — do not store anything you need to keep there, as it is wiped when the VM is deallocated.

Growing the root filesystem

To grow root, resize the OS disk larger in Azure first (stop the VM, set a larger disk size, start it), then grow the partition and the xfs filesystem:

sudo dnf install -y cloud-utils-growpart
sudo growpart /dev/sda 1
sudo xfs_growfs /

Step 5: Check the patch level

The image is fully updated to the final 8.5.2111 vault level at build time. dnf check-update returns exit code 100 when updates are pending and 0 when none are:

sudo dnf check-update
echo "exit code: $?"
dnf repolist --enabled

The repositories point at vault.centos.org/8.5.2111, not the dead mirror.centos.org/mirrorlist.centos.org endpoints, so dnf still works. There will be no new updates — CentOS 8 is end of life and the vault is frozen. dnf-automatic is armed so the machine re-applies the frozen vault package set on a timer, but it cannot fetch security fixes that upstream will never publish.

Step 6: Verify the security posture

Confirm root is locked, SSH is key only, and only port 22 is open:

sudo passwd -S root
sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|pubkeyauthentication|kbdinteractiveauthentication)'
ss -tlnp
getenforce

Expected output:

root LK ... (Password locked.)
permitrootlogin no
pubkeyauthentication yes
passwordauthentication no
kbdinteractiveauthentication no
State  ... Local Address:Port
LISTEN ... 0.0.0.0:22
Permissive

Step 7: Verify Azure integration and unattended updates

Confirm the Azure Linux Agent and cloud-init are healthy, that the update timer is armed, and check your resources:

systemctl is-active waagent
systemctl is-enabled waagent
cloud-init --version
systemctl is-enabled dnf-automatic.timer
df -h /
free -h

waagent is what lets Azure provision your SSH key, resize the OS disk, run extensions and report VM health. CentOS 8's GenericCloud image does not ship the Azure Linux Agent, so cloudimg injects and enables it in this image; it should always be active and enabled.

Step 8: Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22.

This image binds no unnecessary listeners: rpcbind on port 111 is disabled and cockpit on port 9090 is masked. If you need NFSv3 you can restore rpcbind with one command:

sudo systemctl enable --now rpcbind.socket

If your policy requires a host firewall as well, install and enable firewalld, adding the SSH service first so you do not lock yourself out:

sudo dnf install -y firewalld
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --reload

Step 9: Install software

AppStream carries the application packages. Search it, then install what you need:

dnf search nginx
dnf module list nginx
sudo dnf install -y nginx
sudo systemctl enable --now nginx

To add another administrator, create the account with sudo adduser <name>, add it to the wheel group with sudo usermod -aG wheel <name>, then copy your public key into /home/<name>/.ssh/authorized_keys with mode 600 and the .ssh directory mode 700, owned by that user.

Common Use Cases

• Migrating an application off an existing CentOS 8 estate to a supported platform
• Reproducing a CentOS 8 build or test environment for a legacy application
• Running legacy software certified against the RHEL 8 / CentOS 8 ABI while a longer term migration is planned

Troubleshooting

Cannot connect via SSH

1. Verify the VM is in Running state in the Azure Portal
2. Check that port 22 is allowed in the Network Security Group
3. Ensure you are using the correct username: azureuser
4. Verify your SSH key matches the one you supplied at create time. Password login is disabled by design, so a wrong key cannot fall back to a password prompt.

Azure agent not running

sudo systemctl status waagent
sudo systemctl enable --now waagent

Package manager cannot reach a repository

The repositories are pinned to the CentOS vault. Refresh the metadata cache:

sudo dnf clean all
sudo dnf makecache

If a repository is unreachable, confirm you can reach the vault with getent hosts vault.centos.org. Do not re-enable the stock mirror.centos.org/mirrorlist.centos.org repositories — those endpoints were retired when CentOS 8 went end of life and will only produce errors.

Important Notes

End of life. CentOS Linux 8 reached end of life on 31 December 2021 and receives no further upstream security updates. This image is patched only to the final 8.5.2111 vault package set as of its build date and is provided for legacy migration use, not as a currently supported operating system. Treat any internet facing deployment with appropriate caution and plan a migration to a maintained distribution.

Licensing. CentOS Linux is free and open source. It is not covered by a single licence: it is a distribution assembled from thousands of independently packaged components, each carrying its own terms, including the GPL, LGPL, MIT, BSD, Apache 2.0 and MPL. Every package's terms are readable with rpm -qi <package> and under /usr/share/licenses/. No subscription, licence key or Red Hat entitlement is required.

Trademarks. CentOS and Red Hat are trademarks of Red Hat, Inc. The names are used here nominatively, only to identify the distribution this image contains. cloudimg is not affiliated with, endorsed by or sponsored by Red Hat, Inc. or the CentOS Project.

Support

For assistance with this image, contact cloudimg support:

• Website: www.cloudimg.co.uk
• Product Catalogue: www.cloudimg.co.uk/products
• User Guides: www.cloudimg.co.uk/guides
• SLA: 24 hour response guaranteed