Applications Azure

Open-AudIT Community on Ubuntu 24.04 on Azure User Guide

Last updated: 2026-08-10 | Product: Open-AudIT Community 6.0.2 on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and configuration of Open-AudIT Community on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Open-AudIT is an open source network discovery and IT asset management (ITAM/CMDB) application from FirstWave. Point it at a network and it finds what is there — servers, desktops and laptops, switches and routers, firewalls, printers, storage, virtual machines and cloud assets — and for each device it collects a detailed inventory of hardware, installed software, operating system, network configuration, services and users, tracking how all of that changes over time. Infrastructure, security and audit teams use it as a single, current picture of the estate with an audit trail of what changed and when.

The image installs Open-AudIT Community 6.0.2 from the official upstream source, Apache 2.4 and PHP 8.3 to serve it, MariaDB from Ubuntu 24.04 to hold the asset database, and the discovery toolchain (nmap, SNMP, SSH and Windows fingerprinting tools), and wires them all together. Unattended security upgrades are configured to keep the server patched on your running VM.

One appliance, ready to scan. apache2 with mod_php serves the application on port 80, mariadb holds every device, discovery and credential you record, and nmap, snmp, sshpass and smbclient are installed so you can run a discovery against your own network the moment you sign in. MariaDB is bound to 127.0.0.1:3306 and is never exposed to the network — port 80 is the only reachable surface.

A CodeIgniter deployment done properly. Open-AudIT is a CodeIgniter 4 application, and the web document root is the framework's public/ directory and nothing above it. The application source, its vendored dependencies, the SQL schema and above all app/Config/Database.json — which holds this VM's database password — live outside any URL the web server can address.

Security by design — no shared administrator credential ships in the image. Open-AudIT's schema normally seeds a documented default administrator (admin / password). Rather than shipping that live and hoping you change it, this image ships no database schema at all — so that default account does not exist anywhere in the image, and the configuration carries no working database password. On the very first boot of every VM a one shot service generates a unique database password and a unique administrator password, loads the schema, rotates the seeded administrator to your per instance password, and then proves the new password signs in through the real login form and that admin/password and other common guesses do not, before writing /root/open-audit-credentials.txt (mode 0600, root only).

The instance cannot serve an unprovisioned VM. apache2 is gated on a bootstrap marker that first boot writes only after every credential is in place and the seeded administrator has been rotated. Until that marker exists systemd skips the web server entirely, so there is no window in which a half provisioned instance — or the seeded default login, or any setup page — is reachable. The unit is still enabled, so the application comes straight back after a reboot.

What is included:

Open-AudIT Community 6.0.2 served by Apache 2.4 and PHP 8.3, with the CodeIgniter public/ directory as the only web root
MariaDB (mariadb.service) holding the asset database, bound to loopback only
The discovery toolchain — nmap, net-snmp, sshpass, smbclient and ipmitool — so agentless discovery (SNMP, SSH, WMI) works out of the box against your own network
Automated network discovery across IP ranges, detailed device inventory (hardware, software, operating system, network, services, users), change tracking, a queryable CMDB, scheduled recurring discovery, a REST API and a large library of built-in reports
Local accounts with roles, and optional LDAP or Active Directory authentication against your own directory
A per instance database password and administrator password generated on first boot and documented in /root/open-audit-credentials.txt (0600), with the seeded default administrator rotated and proven dead

Prerequisites

Active Azure subscription, SSH public key, VNet and subnet in the target region
Subscription to the Open-AudIT Community listing on Azure Marketplace
Network Security Group rules allowing TCP 22 (administration) and TCP 80 (the application) from the networks that need them
Network reachability from the VM to the subnets you want to discover, and device credentials (SNMP community strings, SSH or WMI accounts) for richer inventory
A registered domain if you want your team to reach the instance by name rather than by IP address, plus access to your DNS provider

Step 1: Deploy from the Azure Portal

Search Open-AudIT in Marketplace, select the cloudimg publisher, and click Create. Choose Standard_B2s or larger. Configure the Network Security Group to allow TCP 80 for the application from your own networks and TCP 22 for administration from your administrative networks only. The database stays on loopback and is never exposed.

Step 2: Deploy from the Azure CLI

RG="open-audit-prod"; LOCATION="eastus"; VM_NAME="open-audit"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/open-audit-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1002

Step 3: First boot and your credentials

On first boot the image generates this VM's database password and administrator password, loads the schema, rotates the seeded administrator to your per instance password, opens the bootstrap gate, starts the web server, verifies the new credentials work and the defaults are rejected, and writes /root/open-audit-credentials.txt. This completes within a minute or two. SSH in as azureuser and read the details:

sudo cat /root/open-audit-credentials.txt

The file is mode 0600 and owned by root, so only a privileged user can read it. It contains the instance URL, the administrator login and password, and the database name, user and password.

Step 4: Confirm the appliance is running

Both services should report active. ss confirms the application is on port 80 while MariaDB is bound to loopback only, and the response headers carry no server version banner.

systemctl is-active mariadb.service apache2.service
php -r 'echo "PHP ".PHP_VERSION."\n";'
mariadb --version
nmap --version | head -1
ss -tlnp | grep -E ':(80|3306) ' | sed 's/users:.*//' | sort
curl -sI http://127.0.0.1/logon | grep -iE '^HTTP|^server'

Both services report active, PHP 8.3 MariaDB and nmap report their versions, ss shows the application on port 80 while MariaDB is bound to 127.0.0.1 port 3306 only, and the response headers carry no version banner

Step 5: Sign in to your instance

Browse to http://<your-vm-public-ip>/ and you are redirected to the sign in page. Enter the username admin and the password from the credentials file.

The Open-AudIT sign in page with the username field, the password field and the sign in button

You can prove the same sign in from the command line. This uses the per instance password from the credentials file to complete a real login through the form, then checks that the seeded default and other common passwords are refused:

sudo /usr/local/sbin/open-audit-login-check.sh admin '<OPENAUDIT_ADMIN_PASSWORD>' && echo "per-VM password: ACCEPTED (correct)"
sudo /usr/local/sbin/open-audit-login-check.sh admin 'password' || echo "admin/password: REJECTED (correct)"
sudo /usr/local/sbin/open-audit-login-check.sh admin '' || echo "blank password: REJECTED (correct)"

The credentials file listing proving mode 600 owned by root root, and the real login form accepting the per instance password while rejecting admin/password and a blank password

Step 6: The dashboard

Once signed in you accept the GNU AGPL licence (Open-AudIT is free software) and land on the dashboard. Down the left is the whole application: Discover for running and scheduling discoveries, Manage for devices, credentials, locations and organisations, Report for the built-in reports, and Admin for users and settings. The main panel summarises your estate — device counts by type, operating system and location — all zero on a fresh instance and filling in as you discover.

The Open-AudIT dashboard showing the summary panels for devices by type and operating system, with the left navigation listing Discover, Manage, Report and Admin

Step 7: Change the administrator password

The first thing to do after signing in is set your own password. Open Admin → Users, edit the admin user, and set a new password. Open-AudIT stores passwords as bcrypt hashes, so the new password is never recoverable from the database. Once you have changed it, the copy in /root/open-audit-credentials.txt is stale — keep the file for the database password, or remove the administrator password line from it.

Step 8: Run your first discovery

This is what Open-AudIT is for. Open Discover → Discoveries → Create, give the discovery a name, and enter the subnet you want to scan in CIDR form (for example 10.0.0.0/24 — a range you own and are authorised to scan). Open-AudIT uses nmap to find live hosts, then fingerprints each one; add SNMP, SSH or Windows credentials under Manage → Credentials first for a richer inventory. Run the discovery and watch the device list populate.

The Open-AudIT discovery configuration screen with the discovery name, the network subnet field in CIDR form, and the run button

The discovery toolchain is already installed, so nothing else is needed on the server side:

command -v nmap snmpget sshpass smbclient
nmap -sn 127.0.0.1 | tail -3

Step 9: Browse the device inventory

Open Manage → Devices and every discovered device is listed with its name, type, IP address, operating system and more. Click a device to open its detail page — hardware, installed software, network interfaces, services, users and the full history of what has changed since it was first seen. This is the CMDB at the heart of Open-AudIT.

The Open-AudIT device inventory listing discovered devices with columns for the name, type, IP address and operating system

Step 10: Use the built-in reports

Under Report Open-AudIT ships a large library of reports built from the inventory — hardware, installed software, operating systems, warranty, network, and change. Reports can be filtered, exported and, with the REST API, pulled into your own tooling. As your discovery coverage grows, the reports become a live view of the estate.

Step 11: Schedule recurring discovery

A one off scan is a snapshot; scheduled discovery keeps the CMDB current. Open Discover → Discoveries, open a saved discovery, and set a schedule so Open-AudIT re-scans on a cadence you choose. Each run updates the inventory and records what changed, building the audit trail over time.

Step 12: Use your own domain and add TLS

Point an A record at the VM's public IP. Open-AudIT derives its links from the request host, so it answers correctly on whatever address you browse to. For TLS, the simplest path is a certificate from Let's Encrypt with the Apache plugin, which edits the shipped Apache site in place and reloads it. Replace <your-domain> with your fully qualified domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d <your-domain> --redirect --agree-tos -m admin@<your-domain> -n

Step 13: How the security model works

The image ships no database schema, so the seeded default administrator does not exist in it. apache2 is gated on a bootstrap marker that first boot writes only after your per instance secrets exist and the seeded administrator has been rotated. Until then, systemd skips the web server and nothing is reachable.

grep -E 'ConditionPathExists|After=' /etc/systemd/system/apache2.service.d/cloudimg-bootstrap-gate.conf
ls -l /var/lib/cloudimg/
systemctl is-enabled apache2.service open-audit-firstboot.service

The apache2 bootstrap gate drop-in showing ConditionPathExists on the bootstrap-ready marker, the marker file that first boot writes after every credential exists, and apache2 and the firstboot service both reported enabled so the appliance survives a reboot

The document root is the CodeIgniter public/ directory and nothing above it. You can confirm nothing above public/ is reachable over HTTP:

grep -E 'DocumentRoot' /etc/apache2/sites-available/cloudimg-open-audit.conf
for p in /app/Config/Database.json /other/open-audit.sql /composer.json /vendor/autoload.php; do
  printf '%-30s HTTP %s\n' "$p" "$(curl -sL -o /dev/null -w '%{http_code}' -m 10 http://127.0.0.1$p)"
done
curl -s -o /dev/null -w '/logon HTTP %{http_code}\n' http://127.0.0.1/logon

The Apache document root confirmed as the Open-AudIT public directory, and the database config, schema SQL, composer manifest and vendor autoloader all returning 403 or 404 over HTTP while the sign-in page returns 200

Step 14: Back up your instance

The whole state of your inventory is in the MariaDB database. Take a consistent dump on a schedule and copy it somewhere off the VM (Azure Blob Storage, for example):

TS="$(date +%F-%H%M)"
DB_PASS="$(sudo sed -n 's/^openaudit.db.password=//p' /root/open-audit-credentials.txt)"
sudo mysqldump --single-transaction -u openaudit -p"$DB_PASS" openaudit > "/tmp/open-audit-$TS.sql"
echo "wrote /tmp/open-audit-$TS.sql"

Step 15: Keeping Open-AudIT up to date

The operating system keeps itself patched through unattended upgrades. For Open-AudIT itself, cloudimg publishes refreshed images as upstream releases new versions; the supported upgrade path is to deploy the new image and restore your database into it, which keeps the appliance hardening intact. cloudimg support can help you plan and carry out an upgrade.

Troubleshooting

The site does not load. Check that first boot finished: systemctl is-active open-audit-firstboot.service should report active, and /var/lib/cloudimg/open-audit-firstboot.done should exist. If first boot is still running, wait a minute and retry. If it failed, sudo journalctl -u open-audit-firstboot.service shows why.

The web server is inactive. apache2 is gated on /var/lib/cloudimg/open-audit-bootstrap-ready. If that marker is missing, first boot has not completed — the web server is meant to stay inactive until it does.

I cannot sign in. Read the current password from /root/open-audit-credentials.txt. If you have already changed it and lost the new one, contact cloudimg support to reset the admin user's password hash.

A discovery finds nothing. Confirm the VM can reach the target subnet, that the NSG and any host firewalls permit the scan, and that you have added the right device credentials under Manage → Credentials. nmap -sn <subnet> from the VM is a quick reachability check.

Support

cloudimg provides 24/7 technical support for this Open-AudIT image by email (support@cloudimg.co.uk) and live chat, with a one hour average response time for critical issues. We help with first boot and credentials, rotating the administrator password, configuring discovery and device credentials (SNMP, SSH, WMI), scheduled scans, the reports and CMDB, LDAP and Active Directory authentication against your own directory, domain and TLS setup, the REST API, database backup and restore, performance tuning and version upgrades. For billing or subscription changes, contact support@cloudimg.co.uk.

Open-AudIT Community is free software licensed under the GNU Affero General Public License version 3. Professional and Enterprise editions are separate commercial products from FirstWave and are not included in or required by this image. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.