O2
Operating Systems Azure

openEuler 24.03 LTS on Azure User Guide

| Product: openEuler 24.03 LTS on Azure

Overview

This guide covers the deployment and configuration of openEuler 24.03 LTS on Microsoft Azure using cloudimg's pre configured virtual machine image from the Azure Marketplace.

openEuler is a community operating system incubated and operated by the OpenAtom Foundation. It is an enterprise-grade server distribution in the RHEL/CentOS lineage — it uses RPM packages and the dnf package manager (DNF4) and a familiar Red Hat-style layout. 24.03 is a Long-Term Support (LTS) release; this image is built from the current 24.03 LTS maintenance level (SP4) and is fully patched to its capture date.

cloudimg is not affiliated with, endorsed by, or sponsored by the openEuler community or the OpenAtom Foundation. "openEuler" is used here only to identify the operating system this image contains.

What's included

  • openEuler 24.03 LTS (24.03-LTS-SP4 maintenance level), x86-64
  • A standard (non-LVM) single-partition ext4 root
  • Every available 24.03-LTS-SP4 package applied at build time (fully patched to the capture date)
  • The official openEuler repositories (repo.openeuler.org), so dnf keeps working out of the box
  • Azure Linux Agent (WALinuxAgent 2.10) injected and enabled for Azure provisioning
  • dnf-automatic armed so the machine keeps applying updates unattended
  • Serial console enabled (console=ttyS0) for Azure out-of-band recovery
  • Gen1 Hyper-V virtual machine support (BIOS boot)
  • 24/7 cloudimg support

Platform: Microsoft Azure (Gen1 Hyper-V) Default user: azureuser Open ports: TCP 22 (SSH) only

Security posture

This image ships with no known credential. There is no default password and no baked-in SSH key:

  • The root account password is locked, so no one can log in as root with a password.
  • PasswordAuthentication is disabled in the SSH daemon, so every login is by key. openEuler's OpenSSH honours the Include /etc/ssh/sshd_config.d/*.conf directive, so the hardening ships as a first-read 00-cloudimg-hardening.conf drop-in and is also applied in the main config.
  • PermitRootLogin is set to prohibit-password.
  • The only key that works is the public key you supply when you create the virtual machine. The Azure Linux Agent injects it into azureuser at first boot, so no two machines you launch ever share a secret.
  • The machine identity (/etc/machine-id) and the SSH host keys are regenerated uniquely on every instance, so two VMs launched from this image are cryptographically distinct.
  • The unused rpcbind listener on port 111 is disabled (re-enable with systemctl enable --now rpcbind.socket if you need NFSv3).
  • The only externally-bound listener is SSH on port 22.

Provisioning agent and SELinux — please note

  • Provisioning is handled by the Azure Linux Agent (WALinuxAgent), not cloud-init. openEuler's generic-cloud image does not ship cloud-init, so this image uses waagent to create azureuser, inject your SSH key, and regenerate a per-VM SSH host key on first boot. This is fully supported on Azure; it simply means custom-data / cloud-init user-data is not consumed.
  • SELinux is not enforced in this image. openEuler's generic-cloud image ships without a SELinux targeted policy installed, and cloudimg ships that upstream default rather than force-enabling SELinux on the imported image. If your workload requires SELinux, install the policy (dnf install selinux-policy-targeted policycoreutils), set SELINUX=enforcing in /etc/selinux/config, touch /.autorelabel, and reboot.

Licence

openEuler is free and open source. openEuler's own components are licensed under the Mulan Permissive Software License v2 (Mulan PSL v2), and the distribution is assembled from thousands of independently packaged upstream components each carrying its own terms (GPL, LGPL, MIT, BSD, Apache-2.0, MPL and more — readable per package with rpm -qi <pkg> and under /usr/share/licenses/). No paid subscription, licence key or support contract is required.

Prerequisites

Before deploying this image, ensure you have:

  1. An active Microsoft Azure subscription
  2. Access to the Azure Portal or Azure CLI
  3. An SSH key pair for Linux VM access
  4. Familiarity with Azure VM management

Deployment

Create the VM (Azure CLI)

az vm create \
  --resource-group my-resource-group \
  --name my-openeuler-vm \
  --image <the Marketplace image from this listing> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --public-ip-sku Standard

The image is a Gen1 (BIOS) image — choose a VM size that supports Gen1, such as the Standard_B, D_v5/Ds_v5 or F-series. Only your SSH public key is injected; there is no password login.

Connect over SSH

ssh azureuser@<public-ip>

You are azureuser, a member of the sudo/wheel group — use sudo for administrative tasks.

First steps after login

Confirm the release:

cat /etc/openEuler-release
# openEuler release 24.03 (LTS-SP4)

cat /etc/os-release | grep -E '^(NAME|VERSION|ID)='

Apply any updates published since the image was captured:

sudo dnf -y upgrade

dnf-automatic is already armed, so the machine also applies updates on a timer:

systemctl status dnf-automatic.timer
cat /etc/dnf/automatic.conf   # upgrade_type=default, apply_updates=yes

Package management

openEuler uses dnf (DNF4) with RPM packages. Confirm the enabled repositories and the release package:

dnf repolist
rpm -q openEuler-release
dnf --version

The enabled repositories point at the official repo.openeuler.org mirror (OS, everything, EPOL, update and others). The EPOL (Extra Packages for openEuler) repository is enabled, giving access to a wider package set.

Day-to-day usage follows the usual dnf verbs: sudo dnf install <package> to install, sudo dnf remove <package> to remove, and dnf search <keyword> to search.

Managing services

openEuler uses systemd. List the running services:

systemctl list-units --type=service --state=running --no-legend | head

To manage a specific unit, use sudo systemctl start <service>, sudo systemctl enable <service> (start at boot), sudo systemctl status <service>, and journalctl -u <service> to view its logs.

Networking and the firewall

The Azure Network Security Group is the control plane for inbound and outbound traffic, and it is the first and usually the only place you need to open a port. The image advertises a single inbound port, SSH on 22. Confirm what is listening before you open anything:

ss -tlnp

The only externally reachable listener is sshd on port 22. The unadvertised rpcbind listener on port 111 is disabled (re-enable with sudo systemctl enable --now rpcbind.socket if you need NFSv3).

This image does not install a host firewall daemon (firewalld) by default — the openEuler generic-cloud image does not ship one, so port control is handled at the Azure NSG. If your policy also requires a host firewall, install and enable firewalld with sudo dnf install -y firewalld && sudo systemctl enable --now firewalld, then add the SSH service first (sudo firewall-cmd --permanent --add-service=ssh && sudo firewall-cmd --reload) so you do not lock yourself out.

The Azure serial console

The image enables the kernel serial console (console=ttyS0), so if you ever lose SSH you can use the Serial console blade in the Azure Portal for out-of-band recovery.

Support

cloudimg provides 24/7 support for this image. For help with deployment or configuration, contact support through the Azure Marketplace listing.

For openEuler documentation and community resources, see the openEuler community website and documentation.