NetBSD 10.1 on Azure User Guide

Overview

This guide covers deploying NetBSD 10.1 on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

NetBSD is a free, open source, general purpose Unix like operating system distributed under the permissive two clause BSD licence. It is known for its clean design, portability and a very complete, well documented base system. This image is the official NetBSD 10.1 amd64 release, adapted by cloudimg to run as a first class Azure virtual machine and administered over SSH as root.

NetBSD is an agentless system on Azure: it has no cloud-init, no Azure Linux Agent and no systemd. cloudimg therefore adds one small first boot service so the image behaves like any other Azure VM. It reads the SSH key you supply at deploy time from the Azure Instance Metadata Service and installs it, and it reports provisioning success to the Azure fabric so the VM comes up cleanly. The NetBSD 10.1 GENERIC kernel already contains the Hyper V drivers Azure needs (hvn for networking, hvs for storage), so no custom kernel is involved.

What's included:

• NetBSD 10.1, the current stable release, official amd64 build with the stock GENERIC kernel
• Agentless Azure integration: your SSH key is injected at first boot from the Instance Metadata Service, with no baked in credential
• The Azure NIC (hvn0) configured for DHCP via dhcpcd so the VM gets its Azure address automatically
• OpenSSH from the base system, key only, listening on port 22
• Serial console on com0 wired up for Azure boot diagnostics
• Per machine identity: NetBSD regenerates its SSH host keys on first boot, and the hostname is taken from Azure
• Gen1 Hyper V (BIOS) virtual machine support
• 24/7 cloudimg support

Platform: Microsoft Azure (Gen1 Hyper V / BIOS) Default user: root (key only; no password)

Security posture

This image ships with no known credential. There is no default password and no baked in SSH key:

• The root account keeps the NetBSD install image's locked password, and password authentication is disabled in OpenSSH (PasswordAuthentication no, PermitRootLogin prohibit-password), so every login is by key.
• The only key that works is the public key you supply when you create the virtual machine. NetBSD has no Azure agent, so cloudimg's first boot service reads that key from the Instance Metadata Service and installs it into /root/.ssh/authorized_keys. No two machines you launch ever share a secret.
• No SSH host keys are baked into the image. NetBSD's sshd startup regenerates them on first boot, so two machines built from this image never share a host identity.
• Only SSH (22) is opened. Your Azure Network Security Group is the outer boundary and should be scoped to your management address.

Prerequisites

Before deploying this image, ensure you have:

1. An active Microsoft Azure subscription
2. Access to the Azure Portal or Azure CLI
3. An SSH key pair for VM access
4. Familiarity with BSD or Unix system administration

Recommended VM Size: Standard_B2s (2 vCPU, 4 GB RAM) or larger.

Step 1: Deploy the Virtual Machine

Deploy from the Azure Marketplace listing, supplying your own SSH public key. The key is injected at first boot from the Instance Metadata Service.

az vm create \
  --resource-group my-rg \
  --name my-netbsd \
  --image <cloudimg-netbsd-marketplace-image> \
  --size Standard_B2s \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

Scope the Network Security Group so that inbound 22 is reachable only from your management address.

Step 2: Connect over SSH

NetBSD's administrative user on this image is root, key only. Connect with the private key that matches the public key you supplied:

ssh -i ~/.ssh/id_rsa root@<vm-public-ip>

There is no password prompt: password authentication is disabled, so only your key works.

Step 3: Verify the image on the VM

Once connected, confirm the release and that the cloudimg first boot service injected your key and reported provisioning to Azure:

uname -a
grep cloudimg-imds /var/log/messages | tail -2

The system log shows the cloudimg first-boot rc.d service injecting your SSH key from the Azure Instance Metadata Service and reporting provisioning Ready to the fabric — the agentless integration that replaces cloud-init and the Azure Linux Agent:

Confirm your SSH key is installed and password authentication is disabled (no baked credential):

cat /root/.ssh/authorized_keys
grep -E 'PermitRootLogin|PasswordAuthentication' /etc/ssh/sshd_config

Step 4: Verify networking and services

The Azure NIC (hvn0) is configured for DHCP so the VM takes its Azure address automatically. Confirm the SSH and DHCP services are running under rc.d, that the VM is listening on port 22, and that the cloudimg services are enabled in rc.conf:

/etc/rc.d/dhcpcd status
/etc/rc.d/sshd status
netstat -an | grep LISTEN | grep '\.22'
grep -E 'dhcpcd|sshd|cloudimgazure' /etc/rc.conf

You can also inspect the Azure interface directly (its address is assigned by DHCP):

ifconfig hvn0

Step 5: Installing packages with pkgin

NetBSD's binary package manager is pkgin, which installs pre built packages from the pkgsrc collection. Bootstrap it (once) by pointing it at the release's package repository, then install packages as you would on any Unix system:

export PKG_PATH="https://cdn.NetBSD.org/pub/pkgsrc/packages/NetBSD/amd64/10.1/All"
pkg_add pkgin
pkgin update
pkgin install <package>

You can also build from source with the full pkgsrc tree if you prefer. NetBSD's base system (compilers, editors, networking tools, OpenSSH) is already present and needs no package installation.

Step 6: Updating the image

NetBSD does not ship an unattended update daemon; this is by design for a base OS. You keep the system current in two honest ways:

• Base system: NetBSD security fixes are published as advisories for the stable branch and applied either by building the updated source branch or by deploying a newer cloudimg image. Subscribe to the NetBSD security advisories for the 10 branch.
• Packages: third party software installed with pkgin/pkgsrc is updated with pkgin update && pkgin upgrade.

Plan your update cadence to suit your risk posture, and re deploy from a newer cloudimg image when a new NetBSD point release is available.

Support

This image is supported 24/7 by cloudimg. For assistance, contact support through the Azure Marketplace listing.