Vo
Databases Azure

Virtuoso Open Source Edition on Ubuntu 24.04 on Azure User Guide

| Product: Virtuoso Open Source Edition on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and configuration of Virtuoso Open Source Edition on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Virtuoso is a multi model data server: a single self contained daemon (virtuoso-t) that is at once an RDF / SPARQL triplestore, a relational SQL engine and a built in HTTP server, fronted by the Conductor web administration console. It is the same engine that powers DBpedia. Virtuoso Open Source Edition is licensed under the GNU General Public License, version 2.

The image runs Virtuoso as the unprivileged virtuoso system user. Both the SQL / ODBC server (127.0.0.1:1111) and the HTTP server that serves the Conductor and the SPARQL endpoint (127.0.0.1:8890) bind to loopback only and are never exposed directly to the network. nginx on port 80 reverse proxies the HTTP server, and at first boot virtuoso-opensource-firstboot.service rotates the default dba and dav accounts to unique per VM secrets using Virtuoso's supported offline password mechanism, seeds a small sample dataset, proves the whole gate, and writes the secrets to /root/virtuoso-opensource-credentials.txt (mode 0600, root only). There is no default dba/dba or dav/dav login reachable on any deployed VM.

What is included:

  • Virtuoso Open Source Edition 7.2.17 (the official OpenLink virtuoso-t server and isql client, with the Conductor administration console pre installed)

  • virtuoso.service systemd unit running the single virtuoso-t daemon with the SQL server (127.0.0.1:1111) and HTTP server (127.0.0.1:8890) bound to loopback inside a hardened service sandbox

  • virtuoso-opensource-firstboot.service systemd oneshot that generates the per VM dba and dav secrets, initialises a fresh per VM database, proves the authentication gate and a full SQL and SPARQL round trip, and writes /root/virtuoso-opensource-credentials.txt

  • nginx on port 80 reverse proxying to the loopback bound HTTP server, with an unauthenticated /healthz for load balancer probes

  • A small sample relational table (DBA.DEMO_CUSTOMERS) and RDF graph (http://cloudimg.example/catalog) so the Conductor schema browser and SPARQL editor have content to explore on first boot

  • Ubuntu 24.04 LTS base with the latest security patches

  • Azure Linux Agent for seamless cloud integration and SSH key injection

  • 24/7 cloudimg support with guaranteed 24 hour response SLA

Prerequisites

  • An active Azure subscription, an SSH public key, and a VNet plus subnet in the target region

  • A subscription to the Virtuoso Open Source Edition on Ubuntu 24.04 listing on Azure Marketplace

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) for evaluation, development and small workloads. For larger datasets raise NumberOfBuffers and MaxDirtyBuffers in /etc/virtuoso/virtuoso.ini and choose Standard_D2s_v5 or larger with more RAM.

Step 1: Deploy from the Azure Portal

Search Virtuoso in Marketplace, select the cloudimg publisher entry, then click Create.

NSG rules: allow TCP 22 from your management IP and TCP 80 from your client IPs. The Virtuoso SQL server and HTTP server are bound to loopback, so only nginx on port 80 is exposed. The Conductor authenticates with the dba account, but for any deployment beyond a private network put a TLS terminating reverse proxy in front of port 80 so credentials and query traffic are encrypted in transit.

Step 2: Deploy from the Azure CLI

RG="virtuoso-prod"; LOCATION="eastus"; VM_NAME="virtuoso-01"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/virtuoso-opensource/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az network vnet create -g "$RG" --name virtuoso-vnet --address-prefix 10.90.0.0/16 --subnet-name virtuoso-subnet --subnet-prefix 10.90.1.0/24
az network nsg create -g "$RG" --name virtuoso-nsg
az network nsg rule create -g "$RG" --nsg-name virtuoso-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp
az network nsg rule create -g "$RG" --nsg-name virtuoso-nsg --name allow-http --priority 110 \
  --source-address-prefixes "<your-client-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
az vm create -g "$RG" --name "$VM_NAME" --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name virtuoso-vnet --subnet virtuoso-subnet --nsg virtuoso-nsg --public-ip-sku Standard

Step 3: Connect via SSH

ssh azureuser@<vm-ip>

The default administrator account is azureuser, authenticated with the SSH key you supplied at deployment.

Step 4: Verify the Virtuoso Service

Confirm that Virtuoso and nginx are running:

systemctl is-active virtuoso nginx

Both units report active. virtuoso.service runs the single virtuoso-t daemon that hosts the SQL server and the HTTP server; nginx fronts the HTTP server on port 80.

Step 5: Inspect the Listeners

Confirm that nginx owns the public port while Virtuoso stays on loopback:

sudo ss -tlnp | grep -E ':80 |:1111 |:8890 '

nginx listens on 0.0.0.0:80, while the Virtuoso SQL server (1111) and HTTP server (8890) listen on 127.0.0.1 only. They are unreachable from the network except through the nginx front.

Terminal output on the VM showing systemctl is-active virtuoso nginx returning active for both units, and sudo ss -tlnp confirming nginx bound to 0.0.0.0:80 while the Virtuoso SQL server on 1111 and HTTP server on 8890 are bound to loopback 127.0.0.1 only

Step 6: Retrieve the Credentials

The per VM secrets are generated at first boot and stored in a root only file:

sudo cat /root/virtuoso-opensource-credentials.txt

You will see the Conductor URL, the dba administration password, the SPARQL endpoint URL, and the dav WebDAV password:

VIRTUOSO_CONDUCTOR_URL=http://<vm-ip>/conductor/
VIRTUOSO_SPARQL_URL=http://<vm-ip>/sparql
VIRTUOSO_ADMIN_USER=dba
VIRTUOSO_DBA_PASSWORD=<VIRTUOSO_DBA_PASSWORD>
VIRTUOSO_DAV_USER=dav
VIRTUOSO_DAV_PASSWORD=<VIRTUOSO_DAV_PASSWORD>

Confirm that the per VM dba secret authenticates and that the shipped default credentials no longer work. The isql client is at /opt/virtuoso/bin/isql. Run the positive check first: Virtuoso briefly locks the dba account after repeated bad logins, so always test the real password before the default one:

export LD_LIBRARY_PATH=/opt/virtuoso/lib
DBA=$(sudo grep '^VIRTUOSO_DBA_PASSWORD=' /root/virtuoso-opensource-credentials.txt | cut -d= -f2-)
/opt/virtuoso/bin/isql 127.0.0.1:1111 dba "$DBA" exec="SELECT now();"
/opt/virtuoso/bin/isql 127.0.0.1:1111 dba dba exec="SELECT 1;" 2>&1 | grep -m1 -o 'Bad login.*' || true

The per VM dba secret runs the query, while the default dba/dba login is rejected (Bad login).

Terminal output showing the per VM credentials file with the Conductor and SPARQL URLs and the dba and dav passwords redacted, the per VM dba secret authenticating over isql on 127.0.0.1:1111, and the default dba/dba login rejected with Error 28000 CL034 Bad login

You can also query the database directly from the command line with the bundled isql client and the per VM dba password. The sample DBA.DEMO_CUSTOMERS table returns three rows:

DBA=$(sudo grep '^VIRTUOSO_DBA_PASSWORD=' /root/virtuoso-opensource-credentials.txt | cut -d= -f2-)
/opt/virtuoso/bin/isql 127.0.0.1:1111 dba "$DBA" \
  exec="SELECT ID, NAME, CITY FROM DBA.DEMO_CUSTOMERS ORDER BY ID;"

Terminal output showing the isql client connected to the loopback Virtuoso SQL server running SELECT ID, NAME, CITY FROM DBA.DEMO_CUSTOMERS ORDER BY ID and returning three rows for Ada Lovelace in London, Alan Turing in Manchester and Grace Hopper in New York with a 3 Rows summary

Step 7: Open the Conductor

Open http://<vm-ip>/conductor/ from your workstation (assuming the NSG allows TCP 80). The Virtuoso Conductor login page appears. Sign in with the account dba and the VIRTUOSO_DBA_PASSWORD from the credentials file:

The Virtuoso Conductor login page served through nginx on port 80, with the Login into Database panel showing the Account and Password fields and the horizontal navigation bar for Home, System Admin, Database, Replication, Web Application Server, XML, Web Services, Linked Data and NNTP

Step 8: Browse the Database Schema

Once logged in, open the Database tab and the SQL Database Objects sub tab. The Schema Objects browser lists the SQL catalogs and lets you create tables, views and procedures without writing DDL by hand:

The Virtuoso Conductor Database tab showing the Schema Objects browser, logged in as dba, with the catalog tree listing ACME, DB, GRAPHQL, PKI and other catalogs and the Create Table, Create View, Create Procedure, Create User Defined Type and Export Schema actions

Step 9: Run a SQL Query

Open Database then Interactive SQL, type a statement into the editor and click Execute. The result grid appears below. Here the sample DBA.DEMO_CUSTOMERS table returns three rows:

The Virtuoso Conductor Interactive SQL editor running SELECT ID, NAME, EMAIL, CITY FROM DBA.DEMO_CUSTOMERS ORDER BY ID with a result grid showing three rows for Ada Lovelace in London, Alan Turing in Manchester and Grace Hopper in New York, and a rows in result summary of three

Step 10: Run a SPARQL Query

Virtuoso is also an RDF triplestore. Open the Linked Data tab and the SPARQL sub tab, set the Default Graph IRI to http://cloudimg.example/catalog, enter a SPARQL query and click Execute. The sample RDF graph returns its labelled resources:

The Virtuoso Conductor Linked Data SPARQL editor with the Default Graph IRI set to the cloudimg catalog graph and a SELECT query returning two RDF resources, product 1 labelled Virtuoso Open Source Edition described as a Multi model RDF SQL database, and product 2 labelled cloudimg Azure Marketplace image

The same endpoint is available programmatically at http://<vm-ip>/sparql and, for read only queries, is open without authentication in the DBpedia style; updates require the dba or a SPARQL update role.

Step 11: System Administration

The System Admin tab surfaces the server dashboard: uptime, the HTTP server request counters, database space allocation, the transaction log, connected clients, and the sub tabs for Security, User Accounts, the Scheduler, Parameters, the Registry, installed Packages and Backup:

The Virtuoso Conductor System Admin System Info dashboard showing the General panel with uptime and version 07.20.3243, the HTTP Server connection counters, the Database Server disk statistics, Space Allocation for the master and temp databases, the License panel and the connected Clients, with the Dashboard, Security, User Accounts, Scheduler, Parameters, Registry, Packages, Backup and Monitor sub tabs

Step 12: Connect over the SQL Port

The Virtuoso SQL / ODBC server is bound to loopback for safety. An application running on the same VM connects directly to 127.0.0.1:1111 with the dba user and the per VM password. To reach the server from your workstation, forward the port over SSH rather than exposing it:

ssh -L 1111:127.0.0.1:1111 azureuser@<vm-ip>

Then point a local isql, ODBC or JDBC client at 127.0.0.1:1111. For a production application tier, open TCP 1111 in the NSG restricted to your application subnets only, and prefer a TLS terminator in front of the Conductor on port 443.

Step 13: Server Components

  • virtuoso.service runs /opt/virtuoso/bin/virtuoso-t +configfile /etc/virtuoso/virtuoso.ini +foreground as the virtuoso user. virtuoso.ini binds ServerPort = 127.0.0.1:1111 (SQL) and HTTPServer ServerPort = 127.0.0.1:8890 (HTTP) so both accept only local connections.

  • virtuoso-opensource-firstboot.service is a oneshot that initialises a fresh per VM database from the Conductor seed, rotates dba and dav to per VM secrets with virtuoso-t +pwdold dba +pwddba ... +pwddav ..., seeds the sample content, and proves the gate before writing the sentinel /var/lib/cloudimg/virtuoso-opensource-firstboot.done.

  • nginx listens on port 80, serves an unauthenticated /healthz, and reverse proxies everything else to 127.0.0.1:8890.

  • The database files live in /var/lib/virtuoso/db.

Step 14: Managing the Service

systemctl status virtuoso
sudo systemctl restart virtuoso
sudo journalctl -u virtuoso -n 50 --no-pager

To tune memory for larger datasets, edit NumberOfBuffers and MaxDirtyBuffers in /etc/virtuoso/virtuoso.ini, then sudo systemctl restart virtuoso.

Step 15: Security Recommendations

  • Keep the listeners on loopback. Do not change ServerPort in /etc/virtuoso/virtuoso.ini to a public address. nginx on port 80 is the only front door; the SQL server on 1111 should be reached only from the VM or over an SSH tunnel.

  • Add TLS. Put a TLS terminating reverse proxy (or nginx with a certificate) in front of port 80 on 443 so the dba password and query traffic are encrypted in transit.

  • Restrict the NSG. Allow TCP 22 and TCP 80 only from the addresses that need them, and open TCP 1111 only to your application subnets if you must reach the SQL server off the VM.

  • Rotate secrets. The per VM passwords in /root/virtuoso-opensource-credentials.txt are unique to this VM. To rotate the dba password from isql, run DB.DBA.USER_SET_PASSWORD('dba', '<new>'); (and the same for dav), then update the credentials file.

  • Review the SPARQL endpoint. The /sparql endpoint answers read only queries anonymously by design. If your data is not public, restrict access at the NSG or nginx layer, or remove the anonymous SPARQL read grant.

Step 16: Support and Licensing

Virtuoso Open Source Edition is licensed under the GNU General Public License, version 2. This image bundles the unmodified official OpenLink Virtuoso 7.2.17 server and its Conductor console. The separate Virtuoso Enterprise Edition is a commercial product and is not included here. cloudimg provides the packaging, hardening and first boot automation, plus 24/7 support with a guaranteed 24 hour response SLA. This listing is not affiliated with or endorsed by OpenLink Software.

Deploy on Azure

Find Virtuoso Open Source Edition on Ubuntu 24.04 LTS on the Azure Marketplace by cloudimg, or visit www.cloudimg.co.uk for the full catalogue.

Need Help?

Email support@cloudimg.co.uk for deployment help, SPARQL and SQL integration questions, or anything else. cloudimg support responds within 24 hours.