Troubleshoot virtual machine certification

Check to see whether your image supports VM extensions.

To enable VM extensions:

1. Select your Linux VM.

2. Go to Diagnostics settings.

3. Enable base matrices by updating the Storage account.

4. Select Save.

   

To verify that the VM extensions are properly activated:

1. In the VM, select the VM extensions tab, and then verify the status of the Linux Diagnostics Extension.

2. Check the provisioning status.

   • If the status is Provisioning Succeeded, the extensions test case has passed.
   • If the status is Provisioning Failed, the extensions test case has failed, and you need to set the Hardened flag.

   

   If the VM extension fails, see Use Linux Diagnostic Extension to monitor metrics and logs to enable it. If you don't want the VM extension to be enabled, contact the Support team, and ask them to disable it.

Check to ensure that you've followed the VM provisioning process rigorously before you submit your offer. To view the JSON format for provisioning the VM, see Test a virtual machine image.

Provisioning issues can include the following failure scenarios:

VHD specifications

Conectix cookie and other VHD specifications

The 'conectix' string is part of the VHD specification. It's defined as the 8-byte cookie in the VHD footer that identifies the file creator. All VHD files created by Azure have this cookie.

A VHD formatted blob should have a 512-byte footer in this format:

To ensure a smooth publishing experience, ensure that your VHD meets the following criteria:

• The cookie contains the string 'conectix'.
• The disk type is Fixed.
• The VHD's virtual size is at least 20 MB.
• The VHD is aligned. The virtual size must be a multiple of 1 MB.
• The VHD blob length is equal to the virtual size plus the VHD footer length (512).

Download the VHD specification.

If your Windows image request is rejected because of a software compliance issue, you might have created a Windows image with an installed SQL Server instance. Instead, you need to take the relevant SQL Server version base image from Azure Marketplace.

Don't create your own Windows image with SQL Server installed in it. Use the approved SQL Server base images (Enterprise/Standard/web) from Azure Marketplace.

If you're trying to install Visual Studio or any Office-licensed product, contact the Support team for prior approval.

For more information about selecting an approved base, see Create a virtual machine from an approved base.

The Microsoft Certification toolkit can help you run test cases and verify that your VHD or image is compatible with the Azure environment.

Download the Microsoft Certification toolkit.

Linux test cases

The following table lists the Linux test cases that the toolkit will run. Test validation is stated in the description.

Common test-case errors

Refer to the following table for the common errors you might see when running test cases:

Windows test cases

The following table lists the Windows test cases that the toolkit will run, along with a description of the test validation:

If you come across any failures with the preceding test cases, refer to the Description column in the table for the solution. For more information, contact the Support team.

Data disk requests with a size greater than 1023 gigabytes (GB) won't be approved. This rule applies to both Linux and Windows.

Resubmit the request with a size less than or equal to 1023 GB.

Refer to the following rules for limitations on OS disk size. When you submit any request, verify that the OS disk size is within the limitation for Linux or Windows.

Because VMs allow access to the underlying operating system, ensure that the VHD size is sufficiently large for the VHD. Disks aren't expandable without downtime. Use a disk size from 30 GB to 50 GB.

To prevent a potential attack related to the WannaCry virus, ensure that all Windows image requests are updated with the latest patch.

You can verify the image file version from C:\windows\system32\drivers\srv.sys or srv2.sys.

The following table shows the minimum patched version of Windows Server:

When you submit a Linux image, your request might be rejected because of kernel version issues.

Update the kernel with an approved version, and resubmit the request. You can find the approved kernel version in the following table. The version number should be equal to or greater than the number listed here.

If your image isn't installed with one of the following kernel versions, update it with the correct patches. Request the necessary approval from the Support team after the image is updated with these required patches:

• CVE-2019-11477
• CVE-2019-11478
• CVE-2019-11479

All VHDs on Azure must have a virtual size aligned to multiples of 1 megabyte (MB). If your VHD doesn't adhere to the recommended virtual size, your request might get rejected.

Follow guidelines when you convert from a raw disk to VHD. Ensure that the raw disk size is a multiple of 1 MB. For more information, see Information for non-endorsed distributions.

An access denied issue for running a test case on the VM might be caused by insufficient privileges.

Check that you've enabled proper access for the account on which the self-test cases are running. Enable access to run test cases if it's not enabled. If you don't want to enable access, you might share the self-test case results with the Support team.

To submit your request with SSH disabled image for certification process:

1. Run the latest Certification Test Tool for Azure VMs on your image.

2. Raise a support ticket. Make sure to attach the toolkit report and provide offer details:

   • Offer name
   • Publisher name
   • Plan ID/SKU and version

3. Resubmit your certification request.

Refer to the following table for any issues that arise when you download the VM image with a shared access signature (SAS) URL.

If you are publishing your image to Azure (with GPT partition), we highly recommend that you keep the first 2,048 sectors (1 MB) of the OS disk empty. This requirement is to allow Azure to add important metadata to the image (examples include metadata to improve boot time for customers, billing, and other details). Note that this is a recommendation for best practice if you are already using an approved base image and your image has a valid billing tag. However, if your image does not have a valid billing tag, your publishing might fail if the first 1 MB of the OS disk isn't empty.

If you are building your own image that does not have any valid billing tag, ensure the first 2,048 sectors (1 MB) of the OS disk are empty. Otherwise, your publishing will fail. This requirement is applicable to the OS disk only (not data disks). If you are building your image from an approved base, it will already have first 1 MB empty. Hence, you won't need to work on it separately.

To keep the first 1 MB free in your OS disk, complete the steps in the next section.

How to keep 1 MB of free space at the start on an empty VHD (2,048 sectors, each sector 512 bytes)

These steps apply only to Linux.

1. Create any kind of Linux VM, such as Ubuntu, CentOS, or other. Fill the required fields, and then select Next: Disks.

   

2. Create an unmanaged disk for your VM. Either use the default values or specify any value for fields like OS disk size, OS disk type, and Encryption type.

   

3. After you create the VM, in the left pane, select Disks.

   

4. Attach your VHD as data disk to your VM for creating a partition table.

   1. Select Attach existing disks:

      

      

   2. Find your VHD storage account.

   3. Select Container, and then select your VHD.

   4. Select OK.

      

      Your VHD will be added as data disk LUN 0.

5. Restart the VM.

6. After you restart the VM, log in to the VM using Putty or another client and run the sudo -i command to gain root access.

   

7. Create a partition on your VHD.

   1. Enter fdisk /dev/sdb command.

   2. To view the existing partition list from your VHD, enter p.

   3. Enter d to delete all existing partitions available in your VHD. You can skip this step, if it's not required.

      

   4. Enter n to create new partition and select p for (primary partition).

   5. Enter 2048 as first sector value. You can leave last sector as the default value.

      Important

      Any existing data will be erased until 2048 sectors (each sector of 512 bytes). Back up the VHD before you create a new partition.

      

   6. Type w to confirm the creation of partition.

      

   7. You can verify the partition table by running the command n fdisk /dev/sdb and typing p. You'll see that partition is created with 2048 offset value.

      

8. Detach the VHD from VM and delete the VM.

Never send default credentials with the submitted VHD. Adding default credentials makes the VHD more vulnerable to security threats. Instead, create your own credentials when you submit the VHD.

A mapping issue can occur when a request is submitted with multiple data disks that aren't in sequence. For example, the numbering order for three data disks must be 0, 1, 2. Any other order is treated as a mapping issue.

Resubmit the request with proper sequencing of data disks.

When an image is created, it might be mapped to or assigned the wrong OS label. For example, when you select Windows as a part of the OS name while you're creating the image, the OS disk should be installed only with Windows. The same requirement applies to Linux.

If all images that are taken from Azure Marketplace are to be reused, the operating system VHD must be generalized.

• For Linux, the following process generalizes a Linux VM and redeploys it as a separate VM.

  In the SSH window, enter the following command: sudo waagent -deprovision+user.

• For Windows, you generalize Windows images by using sysreptool.

  For more information about the sysreptool tool, see System preparation (Sysprep) overview.

For solutions to errors that are related to the data disk, use the following table:

You'll get this error if the Remote Desktop Protocol (RDP) option isn't enabled for the Windows image.

Enable RDP access for Windows images before you submit them.

You'll see this error if the size of the Bash history in your submitted image is more than 1 kilobyte (KB). The size is restricted to 1 KB to restrict the file from containing potentially sensitive information.

To delete the Bash history:

1. Deploy the VM and select the Run Command option on the Azure portal.

   

2. Select first option RunShellScript and then run the command: cat /dev/null > ~/.bash_history && history -c.

   

3. After the command runs successfully, restart the VM.

4. Generalize the VM, take the image VHD, and stop the VM.

5. Resubmit the generalized image.

During Marketplace image certification, a VM offer that is a Network Virtual Appliance (NVA) is validated using tests that are generic to any VM offer, as well as NVA testcases listed in the table below. The goal of these NVA specific validations is to verify how well the NVA image orchestrates with SDN stack.

For further information or questions, please open an Azure Support case.

Netcat overview:

Netcat is a command capable of establishing a TCP or UDP connection between two computers, meaning it can write and read through an open port. During NVA validations, we execute the Netcat command from a VM which is in the same virtual network as the NVA VM, to test if TCP port 22 is reachable. The command syntax is nc <destination_ip_address> <destination_port>, where

• destination_ip_address is the private IP address assigned to VM NIC,
• destination_port is the port number on the NVA. We use 22 in NVA test cases.

For example, nc 192.168.1.1 22

Publishers can request exceptions for a few tests performed during VM certification. Exceptions are provided in rare cases when a publisher provides evidence to support the request. The Certification team reserves the right to deny or approve exceptions at any time.

This section describes general scenarios in which publishers request an exception and how to request one.

Scenarios for exception

Publishers generally request exceptions in the following cases:

• Exception for one or more test cases. Contact Partner Center support to request exceptions for test cases.

• Locked-down VMs / No root access. A few publishers have scenarios where VMs need to be locked because they have software such as firewalls installed on the VM. In this case, download the Certified Test Tool and submit the report at Partner Center support.

• Custom templates. Some publishers publish VM images that require a custom Azure Resource Manager (ARM) template to deploy the VMs. In this case, submit the custom templates at Partner Center support so it can be used by the Certification team for validation.

Information to provide for exception scenarios

Contact Partner Center support to request an exception for one of the scenarios, and include the following information:

• Publisher ID. Type your Partner Central portal Publisher ID.

• Offer ID/name. Enter the Offer ID or name.

• SKU/Plan ID. Type the VM offer Plan ID or SKU.

• Version. Enter the VM offer version that requires an exception.

• Exception Type. Choose from tests, locked-down VM, or custom templates.

• Reason of request. Include the reason for the exception request, plus any information on test exemptions.

• Timeline. Enter the end date for your exception.

• Attachment. Attached important evidence documents:

  • For locked-down VMs, attach the test report.
  • For custom templates, provide the custom ARM template as attachment.

  If you fail to include these attachments, your request will be denied.

This section describes how to provide a new VM image when a vulnerability or exploit is discovered with one of your VM images. It only applies to Azure VM offers published to Azure Marketplace.

Do one of the following actions:

• If you have a new VM image to replace the vulnerable VM image, see Provide a fixed VM image.
• If you don't have a new VM image to replace the only VM image in a plan, or if you're done with the plan, stop distribution of the plan.
• If you don't plan to replace the only VM image in the offer, we recommend you stop distributing the offer.

Provide a fixed VM image

To provide a fixed VM image to replace a VM image that has a vulnerability or exploit:

1. Provide a new VM image to address the security vulnerability or exploit.
2. Remove the VM image with the security vulnerability or exploit.
3. Republish the offer.

Provide a new VM image to address the security vulnerability or exploit

To complete these steps, prepare the technical assets for the VM image you want to add. For more information, see Create a virtual machine using an approved base or Create a virtual machine using your own image and Generate a SAS URI for your VM image.

1. Sign in to Partner Center.

2. On the Home page, select the Marketplace offers tile.

3. In the Offer alias column, select the offer.

4. Select the Plan overview tab, and then select the appropriate plan.

5. On the Technical configuration tab, under VM Images, select + Add VM Image.

   Note

   You can add only one VM image to one plan at a time. To add multiple VM images, publish the first one before you add the next VM image.

6. In the boxes that appear, provide a new disk version and the virtual machine image.

7. Select Save draft.

Next, remove the VM image with the security vulnerability.

Remove the VM image with the security vulnerability or exploit

1. Sign in to Partner Center.
2. On the Home page, select the Marketplace offers tile.
3. In the Offer alias column, select the offer.
4. Select the Plan overview tab, and then select the appropriate plan.
5. On the Technical configuration tab, under VM Images, next to the VM image you want to remove, select Remove VM Image.
6. In the dialog box, select Continue.
7. Select Save draft.

Next, republish the offer.

Republish the offer

1. Select Review and publish.
2. If you need to provide any information to the certification team, add it to the Notes for certification box.
3. Select Publish.

To complete the publishing process, see Review and publish offers.

VM images with limited access or requiring custom templates

Locked down (or) SSH disabled offer

Images that are published with either SSH disabled(for Linux) or RDP disabled (for Windows) are treated as Locked down VMs. There are special business scenarios due to which Publishers only allow restricted access to no/a few users.

During validation checks, Locked down VMs might not allow execution of certain certification commands.

Custom templates

In general, all the images that are published under single VM offers will follow standard ARM template for deployment. However, there are scenarios where publisher might require customization while deploying VMs (for example, multiple NIC(s) to be configured).

Depending on the below scenarios (non-exhaustive), publishers will use custom templates for deploying the VM:

• VM requires additional network subnets.
• Additional metadata to be inserted in ARM template.
• Commands that are prerequisite to the execution of ARM template.

VM extensions

Azure virtual machine (VM) extensions are small applications that provide post-deployment configuration and automation tasks on Azure VMs. For example, if a virtual machine requires software installation, anti-virus protection, or to run a script inside of it, a VM extension can be used.

Linux VM extension validations require the following to be part of the image:

• Minimum supported version Azure Linux agent, or higher, must be installed.](https://learn.microsoft.com/troubleshoot/azure/virtual-machines/support-extensions-agent-version)
• Python version above 2.6+

For more information, please visit VM Extension.

Verification of integrity of image

If you are creating an image and creating disc out of the image to verify the integrity of the image, please note that first 1MB is reserved for optimized performance and last 512 bytes are reserved for VHD footer. So please ignore them while verifying the integrity of the image.

Next steps

• Configure VM offer properties
• If you have questions or feedback for improvement, contact Partner Center support