Orthanc DICOM Server on AWS User Guide

Overview

This image runs Orthanc, a lightweight, standalone DICOM server for medical imaging - a mini-PACS with a built-in REST API and the Orthanc Explorer web interface. It receives, stores, indexes and serves DICOM studies from imaging modalities (CT, MR, ultrasound, X-ray) and other PACS, all from a single self-contained appliance running on infrastructure you control.

Orthanc 1.12.11 is compiled from the official upstream source against the operating system's shared OpenSSL, DCMTK, boost and SQLite libraries, so those security-critical dependencies stay patched for the life of the image by unattended-upgrades. Single-node Orthanc uses its embedded SQLite index and storage, so no external database is required.

Architecture

Orthanc's HTTP server binds to the loopback interface and is reverse-proxied by nginx, so only ports 22, 80 and 443 need an inbound rule in your security group. Port 4242 is deliberately left closed by default - you open it, scoped to your modality source IPs, as shown below.

Secure by default

Unlike Orthanc's packaged and Docker distributions - notorious for the well-known default credential orthanc/orthanc - this image ships with no credential at all. A unique administrator password is generated on the instance's first boot and written to a root-only file. Until first boot completes Orthanc is fail-closed: with authentication enabled and no registered user, every request is refused with HTTP 401.

HTTP authentication is set explicitly (AuthenticationEnabled: true), not left to Orthanc's insecure default behind a reverse proxy, and the build proves the fail-closed posture before the image is captured.

Connecting to your instance

Connect over SSH on port 22 using the key pair you selected at launch. The login user depends on the operating system variant you launched:

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Launching from the AWS Marketplace

1. Subscribe to the product on AWS Marketplace and choose Launch through EC2.
2. Pick an instance type - m5.large or larger is recommended.
3. Select your key pair and a security group that allows inbound TCP 22 (SSH) and 80 (web UI) from your admin location; add 443 if you plan to enable HTTPS.
4. Launch, then wait a minute for first boot to generate the per-instance credential.

You can also launch from the AWS CLI once you have subscribed and accepted the terms (replace the AMI id with the one shown on the Marketplace listing for your Region):

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --region us-east-1

Retrieve the administrator password

The administrator password is generated on first boot and written to a root-only file. Read it over SSH:

sudo cat /root/orthanc-credentials.txt

The file contains the admin username and the generated ORTHANC_ADMIN_PASSWORD. This value is unique to your instance and never leaves it.

Sign in to Orthanc Explorer

Browse to http://<public-ip>/ and sign in with username admin and the password from the credentials file. Orthanc Explorer is the built-in web UI - it is part of the GPL server core, not a separate plugin. From the lookup page you can search stored studies or list everything with the All studies button.

Selecting a study drills into its series and individual DICOM instances, where you can preview images, send a study on to another modality, or anonymize it.

Verify the deployment

Everything below runs over SSH on the instance itself. First confirm the three services are active:

systemctl is-active orthanc.service orthanc-firstboot.service nginx.service

The nginx health endpoint is served without authentication so a load balancer can probe it while Orthanc restarts:

curl -s http://127.0.0.1/healthz

Confirm the fail-closed posture - an unauthenticated request to the REST API is refused with 401:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/system

Now authenticate with the per-instance password and read the server identity - it reports Orthanc version 1.12.11. This snippet reads the password straight from the credentials file:

PW=$(sudo sed -n 's/^ORTHANC_ADMIN_PASSWORD=//p' /root/orthanc-credentials.txt | head -1)
curl -s -u admin:"$PW" http://127.0.0.1/system

Send images over the DICOM protocol

Orthanc listens for DICOM associations on port 4242 with AE title ORTHANC. Verify connectivity with a C-ECHO:

echoscu -aec ORTHANC 127.0.0.1 4242 && echo "C-ECHO OK"

The image ships a synthetic phantom study (pure geometry, no patient data) you can push to prove the pipeline end to end with a C-STORE:

storescu -aec ORTHANC 127.0.0.1 4242 /usr/share/orthanc/sample-dicom/phantom-01-001.dcm && echo "C-STORE OK"

The stored study is then retrievable through the authenticated REST API and appears immediately in Orthanc Explorer:

PW=$(sudo sed -n 's/^ORTHANC_ADMIN_PASSWORD=//p' /root/orthanc-credentials.txt | head -1)
curl -s -u admin:"$PW" "http://127.0.0.1/patients?expand"

Restrict the DICOM port to your modalities

The DICOM protocol authenticates by calling AE title, not by password - so anyone who can reach port 4242 can send images. Port 4242 is closed in the default security group. When you open it, scope it to your modality source IPs only, never 0.0.0.0/0:

aws ec2 authorize-security-group-ingress \
  --group-id sg-xxxxxxxx \
  --protocol tcp --port 4242 \
  --cidr <your-mgmt-cidr>

Enable HTTPS (optional)

TLS is not preconfigured. To terminate HTTPS at nginx with a free Let's Encrypt certificate, point a DNS name at the instance, open port 443, and run certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

cloudimg support can assist with custom certificates or a load-balancer TLS setup.

Rotate the administrator password

Rotate the admin password at any time - this updates the credential Orthanc Explorer and the REST API accept:

sudo orthanc-passwd <new-password>

Open source and corresponding source

Orthanc's server core is licensed GPL-3.0-or-later and the Orthanc Framework it embeds is LGPL-3.0. cloudimg ships the exact unmodified upstream source it compiled, alongside the licences and a written offer, on the image itself:

ls -l /usr/share/doc/orthanc/

The WRITTEN-OFFER.txt file records the upstream origin, the build command, and confirms that nothing in the cloudimg image or its support terms restricts the rights the GPL grants over Orthanc. The compiled dependency CVE audit ships at /usr/share/doc/orthanc/cve-audit.txt.

Maintenance

• Operating system patches are delivered by Ubuntu's unattended-upgrades, keeping OpenSSL, DCMTK, boost and SQLite current because Orthanc links them dynamically.
• Data lives in the embedded SQLite index and storage tree under /var/lib/orthanc/db. Back it up with the Orthanc REST API or a filesystem snapshot of the volume.
• Service management uses systemctl for orthanc, orthanc-firstboot and nginx.
• Modalities are configured in /etc/orthanc/orthanc.json under DicomModalities; restart orthanc.service after editing.

Support

cloudimg provides 24/7 technical support for this Orthanc AMI by email and live chat, covering deployment, upgrades, DICOM modality connectivity, REST API integration, restricting the DICOM port, TLS termination and nginx configuration. Critical issues receive a one-hour average response time. Email support@cloudimg.co.uk.