phpBB on Ubuntu 24.04 on Azure User Guide

Overview

phpBB is the classic, most widely deployed free and open source flat forum bulletin board software, used to run community forums of every size around the world. Members register, start topics, reply and quote, send private messages and search the board, while administrators manage forums, users, permissions, styles and extensions from a full featured Admin Control Panel. The cloudimg image ships phpBB 3.3 served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. phpBB runs behind an nginx reverse proxy on port 80. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306) and keeps its data on a dedicated Azure data disk. A unique administrator password is generated on the first boot of every VM. Backed by 24/7 cloudimg support.

What is included:

• phpBB 3.3 served by nginx and PHP 8.3 FPM, managed by systemd
• A bundled MariaDB 10.11 server holding the phpBB database, already installed and ready
• A ready to use board served on :80, with a default forum and a welcome topic in place
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the founder admin is created with a unique per VM secret, and no known or blank credential authenticates
• phpBB's own recommended nginx hardening, denying direct access to config, cache, store, files, avatar uploads and internal paths
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• A dedicated Azure data disk carrying both the MariaDB database and phpBB's writable state
• nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for larger or busier communities. NSG inbound: allow 22/tcp from your management network and 80/tcp for the board. phpBB serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for phpBB by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name phpbb \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the board:

az vm open-port --resource-group <your-rg> --name phpbb --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm nginx, PHP FPM and MariaDB are all active. Note that MariaDB listens only on 127.0.0.1:3306 while nginx serves the board on port 80.

systemctl is-active nginx php8.3-fpm mariadb phpbb-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

Every VM generates its own phpBB administrator password on first boot and writes it, along with the login user, the board URL and the Admin Control Panel URL, to a root only credentials file. Read it with sudo:

sudo cat /root/phpbb-credentials.txt

You sign in to the board as user admin with the PHPBB_ADMIN_PASSWORD from this file. On the box itself you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the board

Browse to http://<vm-public-ip>/. You land on the board index, which already has a category, a forum and a welcome topic. Click Login in the top right and sign in with username admin and the password from Step 4.

Once signed in you are back on the board index, where you can browse forums, read topics and start posting.

Step 6 - The Admin Control Panel

Signed in as the founder admin, open the Administration Control Panel link in the board footer (you will be asked to re enter your password for security). The ACP dashboard summarises your board at a glance, including the phpBB, PHP and database versions and board statistics, and the tabs across the top (General, Forums, Posting, Users and Groups, Permissions, Customise, Maintenance, System) give you full control over every aspect of the board.

Step 7 - Read and post topics

From the board index, open a forum and then a topic to read and reply, or click New Topic to start one. The welcome topic below shows the topic view with the original post, the author panel and the Post Reply button. Members can quote, edit, attach files and subscribe to topics, and you can organise discussions into as many categories and forums as you need.

Step 8 - No known or default credentials

phpBB ships no default login. The cloudimg image goes further: the founder administrator account is created with a unique per VM secret on first boot, and no known or blank password authenticates. You can prove this with the built in round-trip check, which confirms the per VM administrator signs in through phpBB's own login form while a blank password and common weak guesses are all rejected:

mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(username,'  (founder admin account)') FROM phpbb.phpbb_users WHERE username_clean='admin'"

sudo bash /usr/local/sbin/phpbb-cred-roundtrip.sh

Step 9 - Verify the stack and where your data lives

Confirm the phpBB version, the health endpoint, the dedicated data disk and the installed board content. The MariaDB database lives on the data disk mounted at /data (bind mounted onto /var/lib/mysql), and phpBB's writable cache, store, attachments and avatar uploads live on the same disk, so all of your board's content is kept separate from the operating system disk and rides with the VM:

mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('phpBB ',config_value) FROM phpbb.phpbb_config WHERE config_name='version'"

curl -sI http://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data; findmnt -no SOURCE,TARGET /var/lib/mysql

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production you should set your own address: front phpBB with your domain and a TLS certificate, then update Server name (and enable Force server URL settings if needed) under General then Server settings in the Admin Control Panel. You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain.

Security notes

• phpBB serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through phpBB or over SSH.
• The administrator password is unique per VM and no known or blank credential authenticates. Keep /root/phpbb-credentials.txt protected and change the password from within phpBB if you share access.
• phpBB's own recommended nginx rules deny direct web access to config, cache, store, attachment files, avatar uploads and internal paths.
• Restrict inbound 80/tcp in your NSG to the networks that need the board.

Trademark

phpBB is a registered trademark of phpBB Limited. This image is an independent packaging of the open source phpBB software by cloudimg and is not affiliated with, sponsored by, or endorsed by phpBB Limited.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating phpBB on Azure, contact us at cloudimg.co.uk.