webERP 5 Accounting ERP on Ubuntu 24.04 on Azure User Guide

Overview

webERP is a long established open source, web based accounting and enterprise resource planning system. It provides a complete double entry general ledger with a full chart of accounts, accounts receivable and payable, sales and purchase orders, customer and supplier ledgers, inventory and multi location stock control, and manufacturing with bills of materials, all from one browser interface. The cloudimg image ships webERP 5 served by nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base, together with a bundled local MariaDB server so the appliance is complete and useful on its own. The image ships a clean company with the English (UK) chart of accounts and no sample financial records, so you begin from an empty, ready to use ledger, and the install wizard is disabled. The bundled MariaDB listens only on the loopback interface (127.0.0.1:3306). A unique administrator password is generated on the first boot of every VM, and the well known upstream default administrator login is never present. Backed by 24/7 cloudimg support.

What is included:

• webERP 5 served by nginx and PHP 8.3 FPM, managed by systemd
• A bundled MariaDB server holding the webERP database, already installed and ready
• A clean company with the English (UK) chart of accounts loaded and no sample financial data
• The install wizard disabled, so no setup wizard is ever exposed
• A per VM administrator password generated on first boot and recorded in a root only file
• No shipped default login: the well known upstream admin / weberp default is never present, and the real per VM administrator password is set on first boot
• MariaDB bound to 127.0.0.1 only, never exposed to the network
• nginx.service, php8.3-fpm.service and mariadb.service as enabled systemd units
• An unauthenticated /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a small team; step up to Standard_D2s_v3 or larger for heavier production use. NSG inbound: allow 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed: it listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for webERP by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22), HTTP (80) and HTTPS (443). Then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name weberp \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name weberp --port 80,443

Step 3 - Confirm the services are running

SSH in as azureuser and confirm nginx, PHP FPM, MariaDB and the first boot service are all active. Note that MariaDB listens only on 127.0.0.1:3306 while nginx serves webERP on port 80.

systemctl is-active nginx php8.3-fpm mariadb weberp-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

Every VM generates its own webERP administrator password on first boot and writes it, along with the login user, the company name and the application URL, to a root only credentials file. Read it with sudo:

sudo cat /root/weberp-credentials.txt

You sign in to webERP as user admin with the WEBERP_ADMIN_PASSWORD from this file, selecting the company weberp. On the box itself you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in

Browse to http://<vm-public-ip>/. You land on the webERP sign in page. Leave Company set to webERP Company, enter username admin and the password from Step 4.

After signing in you land on the webERP main menu, which organises the whole system into modules down the left: Sales, Receivables, Purchases, Payables, Inventory, Manufacturing, General Ledger, Asset Manager and Setup.

Step 6 - Review the chart of accounts

Open General Ledger then Maintenance then General Ledger Accounts to view the chart of accounts. The image ships the English (UK) chart pre loaded, ready for you to adjust to your business. Each account carries its code, name, account group and whether it appears on the profit and loss or the balance sheet.

The account groups that organise the chart into assets, liabilities, income and expenses are maintained under General Ledger then Maintenance then Account Groups.

Step 7 - Set up your company

Open Setup then Company then Company Preferences (also reachable as CompanyPreferences.php) to set your company name, address, base currency, tax authority and accounting preferences. Then work through Setup to add your bank accounts, tax rates, sales areas and item categories before you begin entering transactions.

Step 8 - Start transacting

webERP models the full accounting and trading cycle. Create customers and suppliers, raise sales and purchase orders, invoice them, and post receipts and payments; every transaction posts automatically to the general ledger. Use the Inquiries and Reports menu in each module for trial balances, aged debtors and creditors, and the balance sheet and profit and loss statements.

Step 9 - No known or default credentials

The cloudimg image never ships the well known upstream admin / weberp default, and the demo database that carries it is not installed. The real per VM administrator password is generated with a unique random secret on the first boot of every VM. You can prove this with the built in round trip check, which confirms the per VM administrator signs in through webERP's own login form while a blank password, the upstream admin / weberp default and common weak guesses are all rejected. The admin account is the webERP administrator:

sudo mariadb --protocol=socket -uroot -N weberp -e "SELECT CONCAT(userid,'  (webERP administrator)') FROM www_users"

sudo bash /usr/local/sbin/weberp-cred-roundtrip.sh

Step 10 - Verify the stack and the clean company

Confirm the health endpoint, that the chart of accounts is loaded, and that the company ships clean with a single administrator and no demo customers or invoices. The MariaDB database lives at /var/lib/mysql on the OS disk and webERP's code and company data live under /var/www/weberp:

curl -sI http://127.0.0.1/healthz | head -1

sudo mariadb -N -B weberp -e "SELECT CONCAT(COUNT(*),' GL accounts in the chart of accounts') FROM chartmaster"

sudo mariadb -N -B weberp -e "SELECT CONCAT(COUNT(*),' administrator; no demo customers or invoices') FROM www_users"

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, point a DNS record at your VM and obtain a certificate with Let's Encrypt:

sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

webERP derives its base URL from the request Host header, so once you reach the VM on your domain over HTTPS the pages render correctly with no further change.

Backing up

Your business data is the webERP database plus any documents and images stored under the company directory. Dump the database and archive the company directory:

sudo mariadb-dump --protocol=socket -uroot weberp > /tmp/weberp-backup.sql
sudo tar czf /tmp/weberp-companies-backup.tar.gz -C /var/www/weberp companies

Copy both files off the VM on your usual schedule. To restore, load the SQL dump into the weberp database and unpack the archive back to /var/www/weberp/companies.

Security notes

• webERP serves plain HTTP on port 80 out of the box. For anything beyond a trusted network, add your own domain and TLS as above, or front the VM with Azure Application Gateway.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through webERP or over SSH with sudo mariadb. The MariaDB root account uses socket authentication and has no password.
• The administrator password is unique per VM and no known or blank credential authenticates. Keep /root/weberp-credentials.txt protected. To rotate the password, sign in and change it under Setup then Maintenance then User Maintenance, or from the box set a new one directly:

NEW_HASH=$(php -r "echo password_hash('<new-password>', PASSWORD_DEFAULT);")
sudo mariadb weberp -e "UPDATE www_users SET password='$NEW_HASH', blocked=0 WHERE userid='admin'"

• config.php, the installer and the sql, companies and doc trees are denied by nginx, so configuration and data files are never web reachable.
• Apply operating system updates regularly with sudo apt update && sudo apt upgrade; unattended security updates are enabled by default.
• Restrict inbound 80/tcp and 443/tcp in your NSG to the networks that need access.

Trademark

webERP is an open source project distributed under the GNU General Public License version 2. This image is an independent packaging of the open source webERP software by cloudimg and is not affiliated with, sponsored by, or endorsed by the webERP project or its maintainers.

Support

This image is maintained by cloudimg with 24/7 support. If you need help deploying or operating webERP on Azure, contact us at cloudimg.co.uk.