Froxlor 2.3 Hosting Control Panel on Ubuntu 24.04 on Azure User Guide

Overview

Froxlor is the open source server administration and web hosting control panel. It gives hosting providers, agencies and IT teams a single web interface for managing customers, domains and subdomains, web space, FTP accounts, email accounts and forwarders, MySQL databases, DNS records, per domain PHP settings, TLS certificates, traffic accounting and cron jobs, instead of hand editing configuration files across a server. The cloudimg image ships Froxlor 2.3 served by Apache 2.4 and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306).

Froxlor's biggest deployment risk in a shared image is its web setup wizard, because whoever reaches it first can claim the administrator account. This image removes that risk entirely: the captured image contains no Froxlor installation and no administrator account, and the web server is held closed by a systemd condition until first boot has finished installing the panel and generating a unique administrator password. Backed by 24/7 cloudimg support.

What is included:

• Froxlor 2.3 served by Apache 2.4 and PHP 8.3 FPM, managed by systemd
• A bundled MariaDB server holding the panel database, already installed
• No claimable setup wizard: the image ships uninstalled and the web server stays closed until first boot completes the installation
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the panel administrator, and both MariaDB accounts, are created only at first boot, each with a unique random password
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• The Froxlor master cron scheduled every five minutes so panel changes are applied to the system configuration
• Froxlor generated virtual hosts written to a dedicated directory, kept separate from the panel's own configuration
• apache2.service, php8.3-fpm.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is a sensible starting point for typical production use; a smaller size such as Standard_B2s works for a light workload. NSG inbound: allow 22/tcp from your management network, 80/tcp for the panel and hosted sites and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Froxlor by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), HTTP (80) and HTTPS (443). Then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name froxlor \
  --image <marketplace-image-urn> \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name froxlor --port 80,443

Step 3 - Confirm the services are running

SSH in as azureuser and confirm Apache, PHP FPM, MariaDB and the first boot service are all active. Note that MariaDB listens only on 127.0.0.1:3306 while Apache serves the panel on port 80.

systemctl is-active apache2 php8.3-fpm mariadb froxlor-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

Every VM performs its own Froxlor installation on first boot and writes the generated administrator password, the login user and the panel URL to a root only credentials file, along with the two MariaDB account passwords. Read it with sudo:

sudo cat /root/froxlor-credentials.txt

You sign in to the panel as user admin with the FROXLOR_ADMIN_PASSWORD from this file. On the box itself you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in

Browse to http://<vm-public-ip>/. You land on the Froxlor sign in page. Enter username admin and the password from Step 4.

After signing in you land on the Froxlor dashboard, which summarises the server and your hosting resources: customers, domains, web space and traffic totals, plus system details such as the hostname, web server, PHP version and MySQL server version.

Step 6 - Set your server name and default IP

Before creating customer domains, open System then Settings and confirm the panel's server name and default IP address. The image sets an internal server name and the VM's primary IP on first boot; change the server name to your real fully qualified domain name once DNS points at the VM, so the virtual hosts Froxlor generates use the correct address.

Step 7 - Create a customer

Open Resources then Customers and select Create customer to add your first hosting customer, with their own login, resource limits (domains, web space, MySQL databases, email and FTP accounts) and contact details. Each customer signs in to the same panel and sees only their own resources.

Step 8 - Manage domains, PHP, mail and databases

From the panel you administer the whole hosting stack. Open PHP then PHP-FPM versions to manage the per domain PHP configurations Froxlor applies to customer virtual hosts. Under Resources you assign domains and subdomains to customers, and each customer manages their own MySQL databases, email accounts and forwarders, and FTP accounts within the limits you set.

Step 9 - How panel changes reach the server

Froxlor records your panel changes in its database and applies them to the live Apache, PHP FPM and system configuration through its master cron, which this image runs every five minutes as a systemd timer. So when you add a domain or change a PHP setting, the corresponding virtual host and configuration files are written within a few minutes. Check the timer and its schedule, or apply pending changes immediately by hand (the master cron runs as root because it writes system configuration):

systemctl status froxlor-cron.timer --no-pager | head -5

sudo php /var/www/froxlor/bin/froxlor-cli froxlor:cron tasks

Froxlor writes its generated customer virtual hosts to a dedicated directory (/etc/apache2/froxlor-vhosts/), which the panel's own virtual host includes, so a cron run can never rewrite or remove the panel's own configuration and lock you out.

Step 10 - No known or default credentials, and no claimable wizard

The cloudimg image ships with no Froxlor installation at all: there is no administrator account and no database in the captured image, so there is no credential to leak, known or otherwise. The web server is held closed by a systemd condition until first boot has completed the installation, so the setup wizard is never claimable by a stranger. On the first boot of every VM, Froxlor's own unattended installer runs and generates a unique random administrator password, and the setup wizard closes itself the moment the panel is installed. The admin account is the only seeded login. You can prove all of this on the box:

mariadb -N -e "SELECT CONCAT(loginname,'  (Froxlor panel admin)') FROM froxlor.panel_admins"

sudo bash /usr/local/sbin/froxlor-cred-roundtrip.sh

Step 11 - Verify the stack

Confirm the installed Froxlor release, the health endpoint and that the setup wizard is closed. The wizard returns a redirect once the panel is installed, so it can never be used to create a second administrator:

sudo -u www-data php /var/www/froxlor/bin/froxlor-cli --version

curl -sI http://127.0.0.1/healthz | head -1

curl -s -o /dev/null -w 'install wizard: HTTP %{http_code} (redirect - already installed)\n' http://127.0.0.1/install/install.php

Adding your own domain and TLS

The panel serves plain HTTP on port 80. For production, point a DNS record at your VM and obtain a certificate with Let's Encrypt. Froxlor can manage per domain certificates for your customers, and you can secure the panel host itself with certbot:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d <your-domain>

Set the panel's server name to your real fully qualified domain name under System then Settings so the virtual hosts Froxlor generates match. Froxlor derives the panel URL from the request host, so once you reach the VM on your domain the panel renders correctly with no further change.

Where hosting data lives

Customer web space is served from /var/customers, and the panel database lives in the bundled MariaDB. For production hosting workloads, attach an Azure data disk and mount it at /var/customers so customer web space is kept on dedicated storage separate from the operating system disk:

lsblk
sudo mkfs.ext4 /dev/sdc
sudo mount /dev/sdc /var/customers

Add a matching /etc/fstab entry keyed by the disk UUID so the mount persists across reboots.

Backing up

Your hosting data is the Froxlor database plus the customer web space. Dump the database and archive the web space directory:

sudo mysqldump --protocol=socket -uroot froxlor > /tmp/froxlor-backup.sql
sudo tar czf /tmp/froxlor-customers-backup.tar.gz -C /var customers

Copy both files off the VM on your usual schedule. To restore, load the SQL dump into the froxlor database and unpack the archive back to /var/customers.

Security notes

• The panel serves plain HTTP on port 80 out of the box. For anything beyond a trusted network, add your own domain and TLS as above, or front the VM with Azure Application Gateway.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through the panel or over SSH with sudo mariadb.
• The administrator password is unique per VM and no known or blank credential authenticates. Keep /root/froxlor-credentials.txt protected. To rotate the password, sign in and change it under your account settings.
• The panel's lib/, vendor/ and bin/ trees and dotfiles are denied by Apache, so Froxlor's internals (including the file that holds its database password) are never web reachable.
• Apply operating system updates regularly with sudo apt update && sudo apt upgrade; unattended security updates are enabled by default.
• Restrict inbound 80/tcp and 443/tcp in your NSG to the networks that need access.

Trademark

Froxlor is an open source project distributed under the GNU General Public License version 2. This image is an independent packaging of the open source Froxlor software by cloudimg and is not affiliated with, sponsored by, or endorsed by the Froxlor project or its authors.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating Froxlor on Azure, contact us at cloudimg.co.uk.