SimpleRisk GRC on Ubuntu 24.04 on Azure User Guide

Overview

SimpleRisk is the widely used open source governance, risk and compliance (GRC) platform. It lets you capture and score risks using the CLASSIC, CVSS, DREAD or OWASP methodologies, plan and track mitigations and management reviews, run compliance audits against frameworks and controls, manage assets, and report on your whole organisation's risk posture from one shared risk register. The cloudimg image installs SimpleRisk from the official release bundle, fronted by nginx with PHP 8.3 and backed by a local MariaDB, all from the Ubuntu 24.04 noble archive with no third party APT repositories. The database schema is already loaded and the initial setup wizard is already completed and closed, so you land on the sign in page rather than an exposed first run wizard.

Because a GRC tool holds sensitive risk data, this image is hardened for that role: there is no default administrator login, a unique administrator password and a unique database password are generated on the first boot of every instance, and the MariaDB database is bound to the loopback interface only.

What is included:

• SimpleRisk 20260519-001 from the official release, served from /var/www/simplerisk
• nginx with the SimpleRisk vhost at /etc/nginx/sites-available/cloudimg-simplerisk
• PHP 8.3 with the pdo_mysql, xml, mbstring, ldap, curl, gd, zip, intl, bcmath, apcu and opcache extensions
• MariaDB with the simplerisk database and simplerisk app user on loopback only
• simplerisk-firstboot.service rotating the MariaDB password and the administrator password per instance, before nginx serves
• The includes/config.php database password reset at capture and set per instance on first boot
• nginx, php8.3-fpm and mariadb enabled and auto starting on boot
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key, and a VNet with a subnet. Standard_B2s (2 vCPU, 4 GB RAM) suits a small risk programme; move up to a larger burstable or a D series size for busier deployments. On the network security group open port 80 (and 443 once you add TLS) and 22 for SSH, and restrict the source ranges to trusted addresses — a risk register should never be exposed to the whole internet.

Step 1 to 3: Deploy and connect

Deploy the image from the Azure Marketplace, then connect over SSH as azureuser:

ssh azureuser@<vm-ip>

Step 4: Verify the services

SimpleRisk runs as three services: nginx on port 80, php8.3-fpm behind it, and MariaDB on loopback.

sudo systemctl is-active nginx php8.3-fpm mariadb
nginx -v
php -r 'echo PHP_VERSION, "\n";'
sudo ss -tlnp | grep ':80 '

All three services report active, and nginx is listening on port 80.

Step 5: Retrieve your per instance credentials

On the first boot of your instance, simplerisk-firstboot.service generated a unique administrator password and a unique MariaDB password and wrote them to a root only file. Read it:

sudo cat /root/simplerisk-credentials.txt

The file lists the sign in URL, the administrator username (admin), the per instance administrator password, and the internal database credentials. Store the administrator password somewhere safe.

Step 6: Sign in to SimpleRisk

Browse to http://<vm-ip>/ and sign in with the username admin and the password from the credentials file.

There is no default admin/admin login on this image — the shipped administrator credential is discarded at capture and replaced with your unique per instance password on first boot. We recommend changing the administrator password to one of your own choosing after your first sign in, from the My Profile menu.

Step 7: Capture and score a risk

The core of SimpleRisk is the risk register. From the Risk Management menu choose Submit Risk, give the risk a subject, pick a scoring method and set the likelihood and impact, then submit.

Each risk is scored into an inherent and a residual risk level so you can prioritise. Open any risk to see its full detail, scoring, mitigation plan and management review history.

Step 8: Governance, compliance and assets

Beyond the risk register, SimpleRisk covers the wider GRC programme: define control frameworks and controls under Governance, run audits under Compliance, and track assets under Asset Management.

To unlock the framework catalog and the report catalog, register your instance for free from the Configure menu; SimpleRisk then downloads the Secure Controls Framework and the report templates from the SimpleRisk service.

Security posture

This image is built so no shared or default secret ships. There is no default administrator login: the shipped administrator credential is rotated to a discarded random value at capture, and your unique password is set on first boot. You can confirm the default admin/admin login is refused on your own instance:

CJ=$(mktemp)
TOKEN=$(curl -s -c "$CJ" http://127.0.0.1/index.php | grep -oE 'name="csrf_token" value="[^"]+"' | head -1 | sed 's/.*value="//;s/"//')
curl -s -o /dev/null -b "$CJ" -c "$CJ" \
  --data-urlencode "csrf_token=$TOKEN" \
  --data-urlencode "user=admin" --data-urlencode "pass=admin" \
  --data-urlencode "submit=submit" http://127.0.0.1/index.php
curl -s -b "$CJ" -o /dev/null -w 'admin/admin -> HTTP %{http_code} (302 = refused)\n' \
  http://127.0.0.1/management/index.php
rm -f "$CJ"

A 302 means the default login was refused and bounced back to the sign in page.

The MariaDB database, where your risk register lives, is bound to loopback only and is never exposed to the network, and the includes/config.php file that holds the database password is not web readable:

sudo ss -tlnp | grep ':3306'
curl -s -o /dev/null -w 'GET /includes/config.php -> HTTP %{http_code} (403 = not web readable)\n' http://127.0.0.1/includes/config.php

MariaDB shows only 127.0.0.1:3306, and the config file returns 403.

Enabling HTTPS

A risk register should be served over TLS. Point a DNS name at the instance, open port 443 on the network security group, and install a Let's Encrypt certificate with certbot:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

certbot obtains the certificate, updates the nginx vhost to serve HTTPS, and sets up automatic renewal. Keep the network security group source ranges restricted to trusted addresses even with TLS enabled.

On box database maintenance

MariaDB keeps root@localhost as socket authentication, so on box maintenance needs no password:

sudo mariadb simplerisk -e "SELECT username FROM user WHERE admin=1;"

Support

This SimpleRisk image is supported 24/7 by cloudimg. Contact support@cloudimg.co.uk for deployment guidance, TLS and reverse proxy setup, network access hardening, LDAP or SAML integration, version upgrades, and MariaDB database administration.