Seal Report on AWS User Guide

Overview

Seal Report is a popular open source framework for producing database reports and dashboards. It connects to your SQL and NoSQL data sources, lets you design reports and dynamic dashboards from a metadata model with LINQ and Razor templating, and publishes them through a Web Report Server with a browser interface. Reports can pivot, chart, drill down and render as HTML, PDF, Excel or CSV, and a task scheduler can run them on a schedule and distribute the results by email or to a folder.

The cloudimg image builds the Seal Report Web Report Server from the official MIT-licensed source (the vendor ships only a Windows installer, so this image compiles the Linux-runnable server itself) and runs it as a dedicated unprivileged system user under systemd on the Ubuntu-native .NET runtime. The server is bound to the loopback interface and fronted by nginx on port 80, and a unique administrator password is generated on each instance's first boot — so a working report server is operational within minutes of launch with no shared or default credential.

Seal Report is a trademark of its respective owner. This image is produced by cloudimg and is not affiliated with, endorsed by, or sponsored by the project. It ships the free and open source MIT-licensed software, built unmodified from the official source.

What is included:

• Seal Report 10.0 Web Report Server, built from the official MIT source at a pinned commit
• The Ubuntu-native ASP.NET Core 10 runtime, security-patched by the operating system (no third-party Microsoft apt feed)
• seal-report.service running as the unprivileged seal user, bound to 127.0.0.1:5000 (loopback only)
• nginx.service reverse proxy on port 80, the only public path, with an unauthenticated /healthz endpoint for load balancer probes
• A unique administrator password generated per instance on first boot and hashed into the configuration exactly the way Seal Report stores passwords, never baked into the image
• The shipped anonymous login, hardcoded backdoor and demo accounts removed — a single admin login in a full-rights group
• Ubuntu 24.04 LTS base with the latest security patches applied at build time
• 24/7 cloudimg support

Connecting to your instance

Connect over SSH on port 22 as the default login user for your OS variant, using the key pair you selected at launch:

ssh -i <your-key.pem> ubuntu@<instance-public-ip>

Prerequisites

An AWS account, an EC2 key pair in the target region, a VPC + subnet, and a security group. Seal Report serves its web interface on port 80, so allow inbound 22/tcp (SSH) and 80/tcp (HTTP) from your management network. m5.large (2 vCPU / 8 GiB RAM) is a good starting point. Add 443/tcp if you terminate TLS at the instance (see Adding TLS below).

Launching the instance

From the AWS Marketplace console

1. Open the Seal Report listing on AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration.
2. Select the region and the Seal Report on Ubuntu 24.04 delivery option, then Continue to Launch.
3. Choose an instance type (m5.large recommended), your key pair, a subnet, and a security group allowing 22/tcp and 80/tcp, then launch.

From the AWS CLI

aws ec2 run-instances \
  --image-id <seal-report-ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <sg-allowing-22-and-80> \
  --subnet-id <your-subnet> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=seal-report}]'

Find the AMI id for your region on the listing's launch page, or subscribe and copy it from EC2 → AMIs → Private images once the subscription is active.

Retrieving the administrator password

Each instance generates its own administrator password on first boot and writes it, with the web URL, to a root-only file. First boot takes a minute or two after the instance reaches running. Read the file over SSH:

sudo cat /root/seal-report-credentials.txt

You will see the per-instance values (the password is unique to your instance):

SEAL_REPORT_URL=http://<instance-public-ip>/
SEAL_REPORT_ADMIN_USER=admin
SEAL_REPORT_ADMIN_PASSWORD=<SEAL_REPORT_ADMIN_PASSWORD>

Verifying the services

Confirm the report server and the reverse proxy are both active:

systemctl is-active seal-report.service nginx.service

active
active

The report server is bound to loopback and nginx serves the public port 80:

sudo ss -tlnp | grep -E ':80|:5000' | sed -E 's/users:.*//'

LISTEN 0      512        127.0.0.1:5000      0.0.0.0:*
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*
LISTEN 0      511             [::]:80           [::]:*

The unauthenticated health endpoint served by nginx returns ok (use it for a load balancer probe — it never touches Seal Report and needs no credential):

curl -s http://127.0.0.1/healthz

ok

Signing in to the Web Report Server

Open http://<instance-public-ip>/ in your browser. The Seal Report login page appears. Sign in with the user name admin and the password from the credentials file.

After signing in you land on the report explorer: the folder tree of report categories on the left and the reports in the selected folder on the right. The image ships the standard Seal Report sample repository, so you have example reports to explore immediately under Reports → Samples.

Executing a report

Open a folder such as Reports → Samples → 02-LINQ and double-click a report — for example 201-LINQ Samples — to execute it. The Web Report Server runs the report against its data source and renders the result in the browser, with tabbed views and grouped result tables. You can then export the same result as HTML, PDF, Excel, CSV, JSON or XML from the report menu.

From here you can create your own data sources (SQL and NoSQL), design reports and dashboards with LINQ and Razor, and schedule report execution and distribution from the web interface.

Security model

This image is secure by default:

• No shared or default credential. A stock Seal Report demo repository ships a security script that lets a blank user name sign in anonymously, a hardcoded backdoor account, and a set of demo logins. This image removes all of them and defines a single administrator in a full-rights group.
• Unique per-instance password. The administrator password is generated on each instance's first boot and hashed into the configuration exactly the way Seal Report stores passwords (PBKDF2-HMAC-SHA256). Nothing usable is baked into the image, so no two deployments share a credential.
• Loopback-only report server. The Web Report Server binds 127.0.0.1:5000 and is never network-exposed directly; the only public path is the nginx reverse proxy on port 80, which first boot brings up last, only after the administrator password is set — there is no window in which an unauthenticated instance is exposed.

You can prove the login is genuinely enforced with the shipped self-test, which checks that anonymous and wrong-password logins are refused and the real password authenticates and lists the report folder tree:

sudo /usr/local/bin/seal-report-selftest

OK

An anonymous login attempt through the proxy is refused:

curl -s -X POST --data-urlencode "user=" --data-urlencode "password=" http://127.0.0.1/SWILogin

{"error":"Invalid user name or password","authenticated":false}

Adding TLS

Seal Report is served over plain HTTP on port 80 by default. For production, terminate HTTPS in front of it:

• At a load balancer — put an Application Load Balancer (or CloudFront) in front of the instance, attach an ACM certificate, and forward to port 80. Restrict the instance security group so only the load balancer can reach port 80.
• At the instance — add a TLS server block to the nginx configuration in /etc/nginx/sites-available/cloudimg-seal-report with your certificate, and open 443/tcp in the security group.

Support

cloudimg provides 24/7 technical support for this product by email and live chat, covering deployment, connecting data sources, designing reports and dashboards, scheduling, reverse proxy and TLS, sizing, and upgrades.

Email: support@cloudimg.co.uk