OrangeHRM on Ubuntu 24.04 on Azure User Guide

Overview

OrangeHRM Open Source Edition is a widely deployed free open source Human Resource Management system used by HR teams to manage employee information (PIM), leave, time and attendance, recruitment and performance, all with user and access control in one web console. The cloudimg image ships OrangeHRM 5.9 served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. OrangeHRM runs behind an nginx reverse proxy on port 80. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its database on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM, and no default or shipped OrangeHRM login authenticates. cloudimg is not affiliated with or endorsed by OrangeHRM, Inc. Backed by 24/7 cloudimg support.

What is included:

• OrangeHRM 5.9 Open Source Edition served by nginx and PHP 8.3 FPM, managed by systemd
• A bundled MariaDB server holding the OrangeHRM database, already installed and ready
• A ready to use HR console served on :80, with the full schema and modules in place
• A per VM administrator password generated on first boot and recorded in a root only file
• No default login: the Admin account is set to a unique per VM secret stored as a modern bcrypt hash, and the demo default Admin / admin123 and other known or blank credentials do not authenticate
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk carrying the MariaDB database and the OrangeHRM configuration
• All required PHP extensions and OrangeHRM's recommended PHP limits preconfigured
• The web installer removed after setup so it can never run again
• nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger or busier teams. NSG inbound: allow 22/tcp from your management network and 80/tcp (and 443/tcp once you add TLS) for the console. OrangeHRM serves plain HTTP on port 80 out of the box; for production, terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for OrangeHRM by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy with the Azure CLI (alternative)

Prefer the command line? Create the VM from the cloudimg OrangeHRM image with your resource group, image URN, size and SSH key. Open ports 22 and 80 on the network security group, then browse to the public IP.

az vm create \
  --resource-group my-rg \
  --name orangehrm \
  --image <cloudimg-orangehrm-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

az vm open-port --resource-group my-rg --name orangehrm --port 80 --priority 900

Step 3 - Confirm the services and retrieve the admin password

SSH in as azureuser. All three services plus the first boot unit are active, with nginx listening on port 80 and MariaDB bound to the loopback interface only.

systemctl is-active nginx php8.3-fpm mariadb orangehrm-firstboot
ss -tlnp | grep -E ':80 |:3306 '

On the first boot of every VM, OrangeHRM generates a unique administrator password and records it, together with the sign in URL, in a root only file. Read it with sudo:

sudo cat /root/orangehrm-credentials.txt

Step 4 - Sign in to OrangeHRM

Browse to http://<your-vm-ip>/ and sign in with the user Admin and the password from the credentials file. OrangeHRM presents its own sign in page and is reachable by the VM public IP or your own domain.

Step 5 - The HR dashboard

After you sign in, OrangeHRM opens the dashboard with the Time at Work widget, My Actions, Quick Launch and the module menu down the left: Admin, PIM, Leave, Time, Recruitment, My Info, Performance, Directory, Maintenance, Claim and Buzz.

Step 6 - Manage employees in PIM

Open the PIM module to manage the employee directory. Use Add Employee to add a person with their name and job details, then search and filter the employee list by name, employment status, job title and sub unit.

Step 7 - Administer users and modules

Open the Admin module to manage system users and roles, job titles, the organization structure, qualifications, nationalities and configuration. The single Admin account ships with the image; add HR and ESS users here as your team grows.

Security model - no default credentials

OrangeHRM's demo default Admin / admin123 is a well known credential. This image removes any known credential. The single Admin account is rotated to a unique per VM secret on every first boot, stored as a modern bcrypt hash, and common guesses (admin123, admin, password, blank and others) do not authenticate. The web installer is removed after setup so it can never run again, and nginx denies direct HTTP access to the configuration, source, library and other sensitive directories. Every build proves, before the image is captured, that the per VM admin authenticates through the real OrangeHRM login form while the default and weak guesses are rejected.

bash /usr/local/sbin/orangehrm-cred-roundtrip.sh

Where your data lives

The MariaDB database and the OrangeHRM configuration live on a dedicated Azure data disk, not on the OS disk. MariaDB's data directory is bind mounted from the data disk onto /var/lib/mysql, and OrangeHRM's lib/confs directory is bind mounted from the same disk, so your employees, leave, time records and configuration survive a VM resize or OS disk swap and stay on managed, snapshot friendly storage. OrangeHRM stores employee attachments and photos in the database, so they ride on the same disk.

curl -sI http://127.0.0.1/healthz | head -1
findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data
findmnt -no SOURCE,TARGET /var/lib/mysql

Production - add your own domain and TLS

OrangeHRM serves plain HTTP on port 80 out of the box so you can sign in immediately. Before you rely on it for day to day HR operations, put it behind your own domain and TLS so the console is served over HTTPS: point a DNS record at the VM, open 443/tcp on the NSG, and terminate TLS with a certificate from your own certificate authority (for example Let's Encrypt) in front of nginx. Keep MariaDB on the loopback interface, take regular snapshots of the data disk, and restrict SSH to your management network.

Support

This image is built and maintained by cloudimg with 24/7 support. OrangeHRM Open Source Edition is licensed under the GNU General Public License version 3. cloudimg is not affiliated with or endorsed by OrangeHRM, Inc., and this image ships only the free Open Source edition.