Osclass on Ubuntu 24.04 on Azure User Guide

Overview

Osclass is an open source platform for running your own classified ads site or online marketplace. Visitors browse and search listings by category, location, keyword and price; members post ads with photos, edit them and reply to enquiries through a built in contact form; and an administration panel gives you full control over the category tree, listing moderation, member accounts, static pages, e-mail templates and the site theme. The cloudimg image ships Osclass 5.2.2, the community maintained release from Mindstellar, served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. Osclass runs behind an nginx reverse proxy on port 80. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• Osclass 5.2.2 served by nginx and PHP 8.3 FPM, managed by systemd
• A bundled MariaDB server holding the Osclass database, already installed and ready
• A fully installed Osclass with its complete category tree seeded and zero listings, waiting for your first ad
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the administrator account carries a unique per VM secret, and no known or blank credential authenticates
• The Osclass web installer bound to the loopback interface, so it can never be reached from the network
• Site and admin URLs derived from the address you browse to, so the image works on a bare IP or your own domain with nothing to reconfigure
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk carrying both the MariaDB database and every listing photo your users upload
• nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for busier marketplaces or larger photo libraries. NSG inbound: allow 22/tcp from your management network and 80/tcp for the public marketplace. Osclass serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Osclass by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name osclass \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the public marketplace:

az vm open-port --resource-group <your-rg> --name osclass --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm nginx, PHP FPM and MariaDB are all active. Note that MariaDB listens only on 127.0.0.1:3306 while nginx serves Osclass on port 80.

systemctl is-active nginx php8.3-fpm mariadb osclass-firstboot

sudo ss -tlnp | grep -E ':80 |:3306 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

Every VM generates its own Osclass administrator password on first boot and writes it, along with the login user, the public site URL and the admin panel URL, to a root only credentials file. Read it with sudo:

sudo cat /root/osclass-credentials.txt

You sign in to the administration panel as user admin with the OSCLASS_ADMIN_PASSWORD from this file. The address recorded in the file is the one the VM can see for itself; if you assigned a public IP or a DNS name, browse to that instead. On the box itself you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the administration panel

Browse to http://<vm-public-ip>/oc-admin/. You land on the Osclass administration sign in page. Enter username admin and the password from Step 4.

Once signed in you land on the dashboard, which summarises listings by category and site statistics, with the full admin menu down the left hand side.

Step 6 - Set up your marketplace

Before you take your first ad, work through Settings > General to set your site name, contact e-mail and time zone, then Settings > Categories to trim the seeded category tree down to the categories you actually want. Appearance lets you pick and configure the theme, and Pages holds the static pages (about, terms, contact) that appear in the footer. If you want ads to be reviewed before they go live, turn moderation on under Listings > Settings.

Step 7 - Publish and manage listings

Ads reach your site in two ways: visitors use Publish your ad for free on the public site, and you can post directly from Listings > Manage listings with the green plus button. Every listing carries a title, description, category, price, location and photos. The management grid below shows published ads with their status, category, location and expiry, and gives you edit, delete and bulk actions.

Published listings appear immediately on the public marketplace, where visitors browse and filter them by keyword, city, price range and whether they have photos.

Opening an ad shows the full listing with its price, location, description and a contact form that sends an enquiry to the seller.

Step 8 - No known or default credentials

The image ships exactly one Osclass account, the administrator, and it carries a unique per VM secret generated on first boot. No known or blank password authenticates, and the web installer is bound to the loopback interface so nobody can reach it from the network to re-run setup. You can prove the credential model with the built in round-trip check, which confirms the per VM administrator signs in through Osclass's own login form while a blank password and common weak guesses are all rejected:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(s_username,'  (administrator account, bcrypt hash)') FROM osclass.oc_t_admin"

sudo bash /usr/local/sbin/osclass-cred-roundtrip.sh

Step 9 - Verify the stack and where your data lives

Confirm the Osclass version, the health endpoint and the dedicated data disk. The MariaDB database lives on the data disk mounted at /data (bind mounted onto /var/lib/mysql), and every listing photo your users upload lives on the same disk, so all of your marketplace content is kept separate from the operating system disk and rides with the VM:

sed -nE "s/.*OSCLASS_VERSION', *'([^']+)'.*/Osclass \1/p" /var/www/osclass/oc-includes/osclass/default-constants.php; php -v | head -1

curl -sI http://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data; findmnt -no SOURCE,TARGET /var/lib/mysql

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production you should set your own address: front Osclass with your domain and a TLS certificate. Osclass builds its links from the request host, so once you reach it through your domain the public and admin URLs follow automatically with nothing to edit. You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain.

Security notes

• Osclass serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through Osclass or over SSH.
• The administrator password is unique per VM and no known or blank credential authenticates. Keep /root/osclass-credentials.txt protected and change the password from within Osclass if you share access.
• The Osclass web installer is restricted to the loopback interface, and Osclass itself refuses to re-run setup once the site is installed.
• nginx never executes PHP under the user upload directory, and denies web access to config.php, the SQL seed files and the internal content directories.
• Restrict inbound 80/tcp in your NSG to the networks that need the marketplace, and enable listing moderation if your site is open to the public.

Trademark

Osclass is maintained by the Mindstellar community. This image is an independent packaging of the free GPL-3.0 licensed Osclass distribution by cloudimg and is not affiliated with, sponsored by, or endorsed by the Osclass or Mindstellar projects.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating Osclass on Azure, contact us at cloudimg.co.uk.