GestioIP on Ubuntu 24.04 on Azure User Guide

Overview

This guide covers the deployment and configuration of GestioIP on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. GestioIP is a free, open source, web-based IP address management (IPAM) platform for IPv4 and IPv6 networks, published at gestioip.net. It replaces a spreadsheet of subnets and hosts with a real inventory system: automated SNMP-based network discovery that walks your routers and switches to build a live picture of what is actually deployed, a searchable subnet and host database with locations, categories and custom columns, VLAN tracking, MAC address and ACL/port-usage visibility, and a scheduled-job engine that keeps the inventory current.

The image installs GestioIP 3.5 (build 3.5.13) from the official upstream release, served by Apache 2.4 with mod_perl, holding its inventory in MariaDB. All three run on a single VM.

One appliance, two services. apache2.service serves the application on port 80 (CGI/mod_perl), and mariadb.service holds every network, host, VLAN and audit record. MariaDB is bound to 127.0.0.1:3306 and is never exposed to the network. Port 80 is the only reachable surface.

Security by design — there is no administrator account in the image. Rather than shipping a default login and rotating it later, this image ships no usable web credential and no database schema at all. On the very first boot of every VM, a one-shot service builds the complete GestioIP schema by driving upstream's own installation wizard over the loopback interface (never exposed to the network while this happens), mints a unique database password and a unique administrator password, rotates both into place, and then proves the new administrator password signs in through the real login form and that gestioip, admin, password, changeme and admin123 are all rejected — before writing /root/gestioip-credentials.txt (mode 0600, root only).

The installation wizard is permanently closed after first boot. GestioIP's own multi-step database setup wizard (normally reached at /gestioip/install/) is what first boot uses internally to build the schema — over loopback only, with Apache's own bootstrap gate lifted just long enough and rebound to 127.0.0.1 for that one step — and is then deleted from the served application tree so it can never be reached by anyone, ever again, on that VM.

The site cannot serve an unprovisioned instance. apache2.service is gated on a bootstrap marker that first boot writes only after the schema is built and both credentials are rotated. Until that marker exists, systemd skips the unit entirely, so there is no window in which a half-provisioned site — or the installation wizard — is reachable from the network. The unit is still enabled, so the site comes straight back after a reboot.

What is included:

• GestioIP 3.5.13 served by Apache 2.4 + mod_perl, with MariaDB holding the inventory
• Automated SNMP network discovery for IPv4 and IPv6
• A searchable subnet, host and VLAN inventory with locations, categories, tags and custom columns
• MAC address tracking, free-range/usage reporting, scheduled discovery jobs and audit logging
• A per-instance database password and administrator password generated on first boot and documented in /root/gestioip-credentials.txt (0600)
• GestioIP's free GPL-3.0 core only — the optional commercial Configuration Management Module add-on is never installed
• Ubuntu 24.04 LTS base, fully patched
• 24/7 cloudimg support, 1 hour average response for critical issues

Prerequisites

• Active Azure subscription, SSH public key, VNet and subnet in the target region
• Subscription to the GestioIP listing on Azure Marketplace
• Network Security Group rules allowing TCP 22 (administration) and TCP 80 (the web UI) from the networks that need them
• If you plan to use automated SNMP discovery, network connectivity from this VM to the switches/routers you want to discover, and their SNMP community string (or SNMPv3 credentials)

Step 1: Deploy from the Azure Portal

Search GestioIP in Marketplace, select the cloudimg publisher, and click Create. Choose Standard_B2s or larger. Configure the Network Security Group to allow TCP 80 for the web UI from your administrative networks (or the internet, if you intend the IPAM console to be broadly reachable) and TCP 22 for administration. MariaDB stays on loopback and is never exposed.

Step 2: Deploy from the Azure CLI

RG="gestioip-prod"; LOCATION="eastus"; VM_NAME="gestioip-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/gestioip/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name gestioip-vnet --address-prefix 10.92.0.0/16 --subnet-name gestioip-subnet --subnet-prefix 10.92.1.0/24
az network nsg create -g "$RG" --name gestioip-nsg
az network nsg rule create -g "$RG" --nsg-name gestioip-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name gestioip-nsg --name allow-http --priority 110 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name gestioip-vnet --subnet gestioip-subnet --nsg gestioip-nsg --public-ip-sku Standard

Step 3: First boot and your credentials

On first boot the image builds the GestioIP database schema, generates this VM's database password and administrator password, rotates both into place, permanently removes the installation wizard, opens the bootstrap gate and starts Apache, then verifies the new administrator password works and that common defaults are rejected. This completes within well under a minute. SSH in as azureuser and read the details:

sudo cat /root/gestioip-credentials.txt

The file is mode 0600 and owned by root, so only a privileged user can read it. It contains the site URL, the administrator username and password, and the database name, user and password.

Step 4: Confirm the appliance is running

Both services should report active. ss confirms the site is on port 80 while MariaDB is bound to loopback only, and the GPL-3.0 licence text ships in the image.

systemctl is-active apache2.service mariadb.service
ss -tln 2>/dev/null | grep -E ':(80|3306) '
head -3 /usr/share/doc/gestioip/LICENCE

You can prove the same login from the command line. This performs a real login through the form with the per-VM password, confirms the authenticated network overview renders, then confirms every common default credential is rejected through the same flow:

sudo /usr/local/sbin/gestioip-roundtrip.sh

Step 5: Sign in to the web UI

Browse to http://<your-vm-public-ip>/gestioip/ and you will see the GestioIP sign-in page.

Sign in with the username gipadmin and the password from the credentials file. Once signed in you land on the network overview — a fresh instance shows no networks until you add or discover your first one.

Step 6: Add your first network

Click new in the top navigation to open the "create new networks" form. Enter the network address and prefix length, a description, and choose a Site and category (both required) — a fresh instance ships with the seeded values Default Site and LAN from setup, which you can rename or extend later under manage → sites and categories.

Click add. The network is now stored in the inventory and appears immediately in the authenticated network overview — the core of what GestioIP does, turning a form submission into a live, searchable IP address record.

You can confirm the same thing from the command line by counting the rows GestioIP's own schema now holds:

mysql -N -B -e "SELECT red, BM, descr FROM gestioip.net"

Step 7: Configure automated SNMP network discovery

GestioIP's signature feature is building your inventory automatically from your real network devices via SNMP, rather than typing every subnet in by hand. Open import/export → import networks via SNMP query to configure a discovery run.

Enter the IP address of a router or switch that has SNMP enabled and reachable from this VM, and its SNMP community string (SNMPv1/v2c) or SNMPv3 credentials, then start the query. GestioIP walks the device's routing/ARP tables and offers the networks and hosts it finds for import into your inventory. Repeat against your core routers to build a complete picture of your network, and use Jobs in the navigation to schedule discovery to run automatically so the inventory stays current without manual re-entry.

Step 8: Manage locations, categories and users

Under manage → sites and categories you can add locations beyond the seeded "Default Site" and categories beyond "LAN" — useful once you are organising networks by physical site, device role, or client. manage → Users lets you review the internal GestioIP user/role model (distinct from the single Apache-level login this guide covers) if you want finer-grained access control for a team. manage → manage GestioIP holds the global application settings, including enabling authentication features and DNS/dynamic-update integration.

Step 9: Back up your inventory

The entire inventory lives in the gestioip MariaDB database. Take a logical backup with mysqldump on a schedule appropriate for your change rate:

sudo mysqldump gestioip > "gestioip-backup-$(date +%Y%m%d).sql"

Store the dump off the VM (Azure Blob Storage, another host, or your existing backup pipeline). To restore, recreate an empty gestioip database and mysql gestioip < gestioip-backup-<date>.sql.

Step 10: Add a TLS certificate for your own domain

The image ships HTTP only. If you point a domain at this VM, add TLS with your own certificate (or Let's Encrypt via certbot --apache) and update GestioIP's Apache virtual host to redirect HTTP to HTTPS. Keep the existing AuthUserFile, AuthGroupFile and SessionCryptoPassphrase directives in /etc/apache2/conf-enabled/gestioip.conf unchanged when you edit the vhost — they are what the per-VM login depends on.

Step 11: Change the administrator password

From the GestioIP UI, open manage → manage GestioIP to review application-level settings, or rotate the Apache-level login password directly:

sudo htpasswd /usr/share/gestioip/etc/apache/users-gestioip gipadmin

You will be prompted for a new password interactively. The change takes effect immediately — no service restart required, since the AuthUserFile is read per request.

Troubleshooting

Cannot reach the web UI right after first boot. First boot completes in well under a minute, but if you connect immediately on VM creation, wait a few seconds and retry — apache2.service only starts once the bootstrap marker exists. Check progress with:

systemctl status gestioip-firstboot.service
journalctl -u gestioip-firstboot.service --no-pager

Forgot the administrator password. SSH in and read /root/gestioip-credentials.txt again, or rotate it directly with the htpasswd command in Step 11.

SNMP discovery finds nothing. Confirm the target device has SNMP enabled and reachable (snmpwalk -v2c -c <community> <device-ip> system from this VM), and that any network security group or firewall between this VM and the device permits outbound/inbound UDP 161.

Need to restore a captured secret. The database password is also visible in /root/gestioip-credentials.txt; GestioIP itself never displays it again after first boot.

Support

cloudimg provides 24/7 technical support for this GestioIP image by email (support@cloudimg.co.uk) and live chat, covering deployment and first-boot configuration, signing in and rotating the administrator password, SNMP discovery configuration, subnet/VLAN/host inventory management, DNS server integration, MariaDB backup and restore, GestioIP version upgrades, and troubleshooting. Critical issues receive a 1 hour average response time.

GestioIP is free software licensed under the GNU General Public License version 3. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.