Analytics Azure

Seal Report on Ubuntu 24.04 on Azure User Guide

| Product: Seal Report on Ubuntu 24.04 LTS on Azure

Overview

Seal Report is a free, open source framework for producing database reports and dashboards. It connects to your SQL and NoSQL data sources, lets you design reports and dynamic dashboards from a metadata model with LINQ and Razor templating, and publishes them through a Web Report Server with a browser interface. Reports can pivot, chart, drill down and render as HTML, PDF, Excel or CSV, and a task scheduler can run them on a schedule and distribute the results by email or to a folder. A repository of shared connections and elements lets report authors reuse data definitions across many reports.

This cloudimg image builds the Seal Report 10.0 Web Report Server from the official open source (MIT licensed) release and runs it under systemd as the unprivileged seal system user on Ubuntu's native .NET 10 runtime. Seal listens on the loopback address 127.0.0.1:5000 only, and an nginx reverse proxy fronts it on port 80, which is the only public entry point. A unique administrator password is generated on the first boot of every VM, hashed into Seal's own configuration exactly the way Seal stores passwords, and written to a root only file, so no shared credential ships in the image. Backed by 24/7 cloudimg support.

Secure by default. A stock Seal Report demo repository ships a security script that lets a blank user name sign in anonymously, a hardcoded backdoor account, and a set of demo logins. This image does not ship in that state. The security script is replaced with one that does nothing but authenticate a real login, every demo account is removed, and a single administrator is defined in a full rights group. Seal is bound to loopback behind nginx, and that public entry point is only brought up after a unique administrator password is generated on each virtual machine's first boot. The password is stored as a salted hash, so the plain value never remains in the configuration; the plain credentials are placed in a root only file for the administrator to read.

What is included:

  • Seal Report 10.0 Web Report Server, built from the official MIT licensed source and recorded in /opt/seal/VERSION
  • Run under systemd as the unprivileged seal system user with a hardened service sandbox (NoNewPrivileges, PrivateTmp, ProtectSystem=full, ProtectHome)
  • Seal bound to the loopback address 127.0.0.1:5000, with nginx on port 80 as the only public listener
  • A unique administrator password generated on first boot and recorded in a root only file, hashed into the configuration
  • The shipped anonymous login, backdoor account and demo logins all removed
  • An unauthenticated /healthz endpoint for Azure Load Balancer health probes
  • A built in self test at /usr/local/bin/seal-report-selftest that proves the credential path end to end
  • Ubuntu 24.04 LTS base with the latest security patches applied at build time and the Ubuntu native ASP.NET Core 10 runtime, both patched by unattended security upgrades
  • Azure Linux Agent for seamless cloud integration and SSH key injection
  • 24/7 cloudimg support with a guaranteed 24 hour response SLA

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point. NSG inbound rules: allow 22/tcp from your management network for SSH and 80/tcp for the Web Report Server. Seal reaches your databases over their own outbound ports, so no other inbound port is required. The Web UI is served over plain HTTP on port 80; for production, terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Seal Report by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Then Review + create -> Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name seal-report \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard

az vm open-port --resource-group <your-rg> --name seal-report --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active seal-report.service nginx.service

Both report active. Seal Report serves its Web Report Server on the loopback address 127.0.0.1:5000, and nginx fronts it on port 80. Because Seal is bound to loopback, it is never reachable directly from the network; the only public path is nginx.

active
active

seal-report.service and nginx.service reporting active, with Seal Report listening on 127.0.0.1:5000 and nginx on port 80

Step 5 - Retrieve your admin login

The Seal Report administrator password is generated uniquely on the first boot of your VM and written to a root only file:

sudo cat /root/seal-report-credentials.txt

This file contains SEAL_REPORT_URL, SEAL_REPORT_ADMIN_USER (which is admin) and SEAL_REPORT_ADMIN_PASSWORD. The administrator password signs you in to the Web Report Server. Store it somewhere safe.

The per VM Seal Report credentials file, showing the URL and administrator user with the password value redacted, alongside the baked Seal Report version

Step 6 - Confirm the login round trip from the command line

Before opening a browser you can prove the appliance end to end. The unauthenticated health endpoint answers without a credential, a blank (anonymous) login is refused, and the shipped self test signs in with the real per VM password:

curl -s http://127.0.0.1/healthz

ok

curl -s -X POST --data-urlencode "user=" --data-urlencode "password=" http://127.0.0.1/SWILogin

The anonymous login is rejected - authentication is enforced:

{"error":"Invalid user name or password","authenticated":false}

sudo /usr/local/bin/seal-report-selftest

OK

The unauthenticated health endpoint returning ok, an anonymous login being refused, and the self test proving the per VM administrator password authenticates end to end

Step 7 - Sign in to the Web Report Server

Open http://<vm-public-ip>/ in a browser. Seal Report presents a login prompt - there is no anonymous access. Enter admin and the password from your credentials file.

The Seal Report login prompt: a user name and password are required, generated per VM on first boot

After signing in you land on the report explorer, with the folder tree on the left and the reports of the selected folder on the right.

The Seal Report explorer after sign in, showing the Reports, Personal and repository folder tree

Step 8 - Explore the sample reports

Expand Reports -> Samples to see the bundled example reports - charts, cross tabs, gauges, cards, data tables and more. Select any report to open it, then use Execute to render it. These samples are a quick way to confirm the server renders reports and to learn the report model before you point Seal at your own databases.

The Samples folder expanded, listing the bundled example reports such as charts, gauges, cards and data tables

Step 9 - Review the data sources

Select the Sources node to see the data sources the repository ships with, including the bundled offline Northwind sample and connection templates for SQL Server, PostgreSQL, MySQL, Oracle, SQLite and MongoDB. From here you connect Seal to your own databases and build your metadata model. To add a new source and design new reports, use the Seal Report Server Manager and Report Designer (the Windows design tools) against this repository, or edit the repository files directly.

The Sources view listing the bundled Northwind sample data source and the SQL and NoSQL connection templates

Step 10 - Review the security posture

You can confirm the hardening at any time. Only the admin login exists (the shipped demo logins are gone), the server runs as the unprivileged seal user, and the runtime is the Ubuntu native ASP.NET Core 10 shared framework:

grep -oE "<Id>[a-z]+</Id>" /var/lib/seal/Repository/Security/Security.xml | sort -u

<Id>admin</Id>

ps -o user= -C dotnet | sort -u

seal

Confirming only the admin login exists, that Seal Report runs as the unprivileged seal user, and that the runtime is Ubuntu native ASP.NET Core 10

Maintenance

Change the administrator password. The password is stored as a salted hash in /var/lib/seal/Repository/Security/Security.xml. To rotate it, generate a new hash with the shipped helper and restart the service:

sudo /usr/local/sbin/seal-report-set-admin-password.py \
  /var/lib/seal/Repository/Security/Security.xml '<your-new-password>'
sudo chown seal:seal /var/lib/seal/Repository/Security/Security.xml
sudo systemctl restart seal-report.service

Update /root/seal-report-credentials.txt to match, then keep it safe.

Terminate TLS for production. The Web Report Server is served over plain HTTP on port 80. For production, place your own TLS certificate in front of it - for example with a certificate for <your-domain> from your CA or Let's Encrypt via certbot - and proxy HTTPS to http://127.0.0.1:5000, or add a server block for <your-domain> to the nginx site at /etc/nginx/sites-available/cloudimg-seal-report.

Operating system and runtime updates. The base image ships fully patched with unattended security upgrades enabled, and the ASP.NET Core 10 runtime is the Ubuntu native package, so it receives security updates from the OS. Reports, data sources and security settings live under /var/lib/seal/Repository; back that directory up.

Service management.

systemctl status seal-report.service --no-pager

sudo journalctl -u seal-report.service -n 50 --no-pager

Support

Every cloudimg image is backed by 24/7 support with a guaranteed 24 hour response SLA. Contact support@cloudimg.co.uk with the offer name and your VM details. Seal Report is open source software distributed under the MIT License; the cloudimg charge covers packaging, hardening, security patching, image maintenance and support.