O2
Operating Systems Azure

openEuler 24.03 LTS on Azure User Guide

| Product: openEuler 24.03 LTS on Azure

Overview

This guide covers the deployment and configuration of openEuler 24.03 LTS on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

openEuler is a community operating system incubated and operated by the OpenAtom Foundation. It is an enterprise-grade server distribution in the RHEL/CentOS lineage — it uses RPM packages and the dnf package manager (DNF4) and a familiar Red Hat-style layout. 24.03 is a Long-Term Support (LTS) release; this image is built from the current 24.03 LTS maintenance level (SP4) and is fully patched to its capture date.

cloudimg is not affiliated with, endorsed by, or sponsored by the openEuler community or the OpenAtom Foundation. "openEuler" is used here only to identify the operating system this image contains.

What's included

  • openEuler 24.03 LTS (24.03-LTS-SP4 maintenance level), x86-64
  • A standard (non-LVM) ext4 root. The OS disk is GPT: partition 1 is a 1 MiB bios_grub partition holding the BIOS bootloader, partition 2 is the FAT /boot partition and partition 3 is the ext4 root
  • Every available 24.03-LTS-SP4 package applied at build time (fully patched to the capture date)
  • The official openEuler repositories, served from the official openEuler mirror at mirrors.ocf.berkeley.edu (with mirrors.xtom.de and repo.openeuler.org as fallbacks), so dnf refreshes in seconds on Azure (see Package mirror)
  • Azure Linux Agent (WALinuxAgent 2.10) injected and enabled for Azure provisioning
  • dnf-automatic armed so the machine keeps applying updates unattended
  • Serial console enabled (console=ttyS0) for Azure out-of-band recovery
  • Gen1 Hyper-V virtual machine support (BIOS boot)
  • 24/7 cloudimg support

Platform: Microsoft Azure (Gen1 Hyper-V) Default user: azureuser Open ports: TCP 22 (SSH) only

Security posture

This image ships with no known credential. There is no default password and no baked-in SSH key:

  • The root account password is locked, so no one can log in as root with a password.
  • SSH password login follows the authentication type you choose when you create the VM: choose SSH public key and only your key works; choose Password and the password you set works for that user. The image itself pins no PasswordAuthentication value that would override your choice.
  • PermitRootLogin is set to prohibit-password.
  • With key authentication, the only key that works is the public key you supply when you create the virtual machine. The Azure Linux Agent injects it into azureuser at first boot, so no two machines you launch ever share a secret.
  • The machine identity (/etc/machine-id) and the SSH host keys are regenerated uniquely on every instance, so two VMs launched from this image are cryptographically distinct.
  • The unused rpcbind listener on port 111 is disabled (re-enable with systemctl enable --now rpcbind.socket if you need NFSv3).
  • The only externally-bound listener is SSH on port 22.

Provisioning agent and SELinux — please note

  • Provisioning is handled by the Azure Linux Agent (WALinuxAgent), not cloud-init. openEuler's generic-cloud image does not ship cloud-init, so this image uses waagent to create azureuser, inject your SSH key, and regenerate a per-VM SSH host key on first boot. This is fully supported on Azure; it simply means custom-data / cloud-init user-data is not consumed.
  • SELinux is not enforced in this image. openEuler's generic-cloud image ships without a SELinux targeted policy installed, and cloudimg ships that upstream default rather than force-enabling SELinux on the imported image. If your workload requires SELinux, install the policy (dnf install selinux-policy-targeted policycoreutils), set SELINUX=enforcing in /etc/selinux/config, touch /.autorelabel, and reboot.

Licence

openEuler is free and open source. openEuler's own components are licensed under the Mulan Permissive Software License v2 (Mulan PSL v2), and the distribution is assembled from thousands of independently packaged upstream components each carrying its own terms (GPL, LGPL, MIT, BSD, Apache-2.0, MPL and more — readable per package with rpm -qi <pkg> and under /usr/share/licenses/). No paid subscription, licence key or support contract is required.

Prerequisites

Before deploying this image, ensure you have:

  1. An active Microsoft Azure subscription
  2. Access to the Azure Portal or Azure CLI
  3. An SSH key pair for Linux VM access
  4. Familiarity with Azure VM management

Deployment

Create the VM (Azure CLI)

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn cloudimg1647283583153:openeuler:default:latest

az vm create \
  --resource-group my-resource-group \
  --name my-openeuler-vm \
  --image cloudimg1647283583153:openeuler:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --public-ip-sku Standard

The image is a Gen1 (BIOS) image — choose a VM size that supports Gen1, such as the Standard_B, D_v5/Ds_v5 or F-series. Only your SSH public key is injected.

Connect over SSH

ssh azureuser@<public-ip>

You are azureuser, a member of the sudo/wheel group — use sudo for administrative tasks.

First steps after login

Confirm the release:

cat /etc/openEuler-release
# openEuler release 24.03 (LTS-SP4)

cat /etc/os-release | grep -E '^(NAME|VERSION|ID)='

Apply any updates published since the image was captured:

sudo dnf -y upgrade

dnf-automatic is already armed, so the machine also applies updates on a timer:

systemctl status dnf-automatic.timer
cat /etc/dnf/automatic.conf   # upgrade_type=default, apply_updates=yes

Package management

openEuler uses dnf (DNF4) with RPM packages. Confirm the enabled repositories and the release package:

dnf repolist
rpm -q openEuler-release
dnf --version

The enabled repositories (OS, everything, EPOL, update and others) are the official openEuler 24.03-LTS-SP4 repositories, fetched from a fast official mirror (see below). The EPOL (Extra Packages for openEuler) repository is enabled, giving access to a wider package set.

Day-to-day usage follows the usual dnf verbs: sudo dnf install <package> to install, sudo dnf remove <package> to remove, and dnf search <keyword> to search.

Package mirror

openEuler's main repository server, repo.openeuler.org, is in Hong Kong and is very slow to reach from most Azure regions: refreshing its metadata alone can take more than 15 minutes. This image therefore fetches packages from https://mirrors.ocf.berkeley.edu/openeuler. That is an official openEuler mirror, listed on openEuler's mirror list and kept in sync with repo.openeuler.org. Measured from Azure East US and North Europe, a full metadata refresh takes under a minute and a typical update run takes about two minutes.

The mirror is set in one place, the dnf variable file /etc/dnf/vars/oemirror. Every repository in /etc/yum.repos.d/openEuler.repo uses it as its first baseurl. mirrors.xtom.de and repo.openeuler.org follow as automatic fallbacks:

cat /etc/dnf/vars/oemirror
# https://mirrors.ocf.berkeley.edu/openeuler

grep -A3 '^\[update\]' /etc/yum.repos.d/openEuler.repo
# baseurl=$oemirror/openEuler-24.03-LTS-SP4/update/$basearch/
#         https://mirrors.xtom.de/openeuler/openEuler-24.03-LTS-SP4/update/$basearch/
#         https://repo.openeuler.org/openEuler-24.03-LTS-SP4/update/$basearch/

To switch to another mirror (for example one closer to your region from the official list at openeuler.org/en/mirror/list, or an internal mirror), write its base URL (the directory that contains openEuler-24.03-LTS-SP4/, with no trailing slash) into that file and refresh the cache:

echo 'https://mirror.accum.se/mirror/openeuler.org' | sudo tee /etc/dnf/vars/oemirror
sudo dnf clean all && sudo dnf makecache

To go back to openEuler's own server, use echo 'https://repo.openeuler.org' | sudo tee /etc/dnf/vars/oemirror.

Changing the mirror does not weaken package verification. gpgcheck=1 stays on for every repository, and each package is verified against the openEuler signing key shipped in the image at /etc/pki/rpm-gpg/RPM-GPG-KEY-openEuler (fingerprint 8AA1 6BF9 F2CA 5244 010D CA96 3B47 7C60 B675 600B), whichever server it came from. You can check the fingerprint yourself:

gpg --show-keys --with-fingerprint /etc/pki/rpm-gpg/RPM-GPG-KEY-openEuler

openEuler.repo is a protected configuration file. When the openEuler-repos package is updated, your copy is kept and the new upstream default is written alongside it as openEuler.repo.rpmnew, so a routine dnf upgrade never switches you back to the slow server.

Managing services

openEuler uses systemd. List the running services:

systemctl list-units --type=service --state=running --no-legend | head

To manage a specific unit, use sudo systemctl start <service>, sudo systemctl enable <service> (start at boot), sudo systemctl status <service>, and journalctl -u <service> to view its logs.

Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22. Confirm what is listening before you open anything:

ss -tlnp

The only externally reachable listener is sshd on port 22. The unadvertised rpcbind listener on port 111 is disabled (re-enable with sudo systemctl enable --now rpcbind.socket if you need NFSv3).

This image does not install a host firewall daemon (firewalld) by default — the openEuler generic-cloud image does not ship one, so port control is handled at the Azure NSG. If your policy also requires a host firewall, install and enable firewalld with sudo dnf install -y firewalld && sudo systemctl enable --now firewalld, then add the SSH service first (sudo firewall-cmd --permanent --add-service=ssh && sudo firewall-cmd --reload) so you do not lock yourself out.

The Azure serial console

The image enables the kernel serial console (console=ttyS0), so if you ever lose SSH you can use the Serial console blade in the Azure Portal for out-of-band recovery.

Support

cloudimg provides 24/7 support for this image. For help with deployment or configuration, contact support through the Azure Marketplace listing.

For openEuler documentation and community resources, see the openEuler community website and documentation.