Apache Karaf

SSH in as azureuser. Confirm that the service is active and the console is listening on 8101. Karaf takes about 30-60 seconds to fully start on first boot.

sudo systemctl status apache-karaf.service --no-pager -n 0
sudo ss -tln | grep 8101

Expected output:

● apache-karaf.service - Apache Karaf OSGi runtime (sac) Loaded: loaded (/etc/systemd/system/apache-karaf.service; enabled; preset: enabled) Active: active (running) since Sun 2026-07-19 08:05:15 UTC; 1min 20s ago Docs: https://secureanycloud.com/stacks/apache-karaf/ Main PID: 2155 (karaf) Tasks: 76 (limit: 4661) Memory: 266.6M (peak: 270.3M) LISTEN 0 50 *:8101 *:*

The karaf username and its randomly generated password are written to a root-only credentials file at first boot. Read the file:

sudo cat /root/karaf-credentials.txt

Expected output. Your password differs because it is unique to this VM:

# apache-karaf — Per-VM Credentials
# Apache Karaf OSGi runtime — administer over the SSH console on port 8101.
# From your workstation (open port 8101 in your Azure NSG first):
# ssh -p 8101 karaf@<your-vm-ip>
# then run e.g. feature:list system:version bundle:list
# KARAF_SSH_USER=karaf KARAF_SSH_PASSWORD=<set-at-first-boot> KARAF_SSH_HOST=<your-vm-ip> KARAF_SSH_PORT=8101

Use the generated credential to log in to the Karaf SSH console and confirm the runtime version. Run this on the VM itself:

PASS=$(sudo grep '^KARAF_SSH_PASSWORD=' /root/karaf-credentials.txt | cut -d= -f2-) sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
  -o PreferredAuthentications=password -o PubkeyAuthentication=no \
  -p 8101 karaf@127.0.0.1 'system:version'

Expected output:

4.4.11

To connect from a remote workstation, open TCP 8101 in your NSG first. Then replace 127.0.0.1 with the VM's IP, or use the bundled client: /opt/karaf/bin/client -a 8101 -h <vm-ip> -u karaf.

The Karaf console exposes the full provisioning and bundle model. List the installed features:

PASS=$(sudo grep '^KARAF_SSH_PASSWORD=' /root/karaf-credentials.txt | cut -d= -f2-) sshpass -p "$PASS" ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
  -o PreferredAuthentications=password -o PubkeyAuthentication=no \
  -p 8101 karaf@127.0.0.1 'feature:list -i'

Expected output (installed features):

Name | Version | Required | State | Repository | Description -------------+---------+----------+---------+-----------------+------------------------------------ feature | 4.4.11 | x | Started | standard-4.4.11 | Features Support shell | 4.4.11 | x | Started | standard-4.4.11 | Karaf Shell deployer | 4.4.11 | x | Started | standard-4.4.11 | Karaf Deployer bundle | 4.4.11 | x | Started | standard-4.4.11 | Provide Bundle support config | 4.4.11 | x | Started | standard-4.4.11 | Provide OSGi ConfigAdmin support jaas | 4.4.11 | x | Started | standard-4.4.11 | Provide JAAS support log | 4.4.11 | x | Started | standard-4.4.11 | Provide Log support system | 4.4.11 | x | Started | standard-4.4.11 | Provide System support management | 4.4.11 | x | Started | standard-4.4.11 | Provide a JMX MBeanServer ssh | 4.4.11 | x | Started | standard-4.4.11 | Provide a SSHd server on Karaf

The stock karaf/karaf credential is never shipped. Try to log in with it. The login fails:

if sshpass -p 'karaf' ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
  -o PreferredAuthentications=password -o PubkeyAuthentication=no \
  -o ConnectTimeout=10 -p 8101 karaf@127.0.0.1 'system:version' 2>/dev/null; then echo 'UNEXPECTED: default credential accepted' else echo 'default karaf/karaf credential correctly rejected' fi

Expected output:

default karaf/karaf credential correctly rejected

Component Path

Karaf home /opt/karaf (link to /opt/apache-karaf-4.4.11)

Users file /opt/karaf/etc/users.properties (mode 0600 karaf:karaf)

Users template /usr/local/share/sac/karaf-users.properties.template

systemd unit /etc/systemd/system/apache-karaf.service

First-boot unit /etc/systemd/system/apache-karaf-firstboot.service

Credentials /root/karaf-credentials.txt (mode 0600 root:root)

Service user karaf (unprivileged, nologin)

Java runtime OpenJDK 17 (/usr/lib/jvm/java-17-openjdk-amd64)

• Restrict the NSG so TCP 8101 only reaches your administrative subnets.
• Add more users by editing /opt/karaf/etc/users.properties (user = password,_g_:group lines), or from the console with jaas: commands. Then log in again.
• Deploy applications by dropping OSGi bundles or KAR files into /opt/karaf/deploy, or with bundle:install / feature:install from the console.
• Enable password encryption in /opt/karaf/etc/org.apache.karaf.jaas.cfg (encryption.enabled = true) so users.properties stores hashed passwords.
• Patch regularly: sudo apt-get update && sudo apt-get upgrade && sudo reboot.

SSH in. Confirm that the service is active and the console is listening on 8101. Karaf takes about 30-60 seconds to fully start on first boot.

sudo systemctl status apache-karaf.service --no-pager -n 0
sudo ss -tln | grep 8101

Expected output:

● apache-karaf.service - Apache Karaf OSGi runtime (sac) Loaded: loaded (/etc/systemd/system/apache-karaf.service; enabled; preset: enabled) Active: active (running) since Wed 2026-07-22 04:29:46 UTC; 3min 18s ago Docs: https://secureanycloud.com/stacks/apache-karaf/ Main PID: 2315 (karaf) Tasks: 76 (limit: 4520) Memory: 302.3M (peak: 302.3M) LISTEN 0 50 *:8101 *:*

The karaf username and its randomly generated password are written to a root-only credentials file at first boot. The file is mode 0600 and owned by root, so only root can read it. Check its permissions:

sudo ls -l /root/karaf-credentials.txt
sudo stat -c 'perms=%a owner=%U:%G' /root/karaf-credentials.txt

Expected output:

-rw------- 1 root root 623 Jul 22 04:29 /root/karaf-credentials.txt perms=600 owner=root:root

To read the generated password, run sudo cat /root/karaf-credentials.txt and keep the password private. The file records KARAF_SSH_USER, KARAF_SSH_PASSWORD, KARAF_SSH_HOST and KARAF_SSH_PORT. Your password is unique to this instance.

Use the generated credential to log in to the Karaf SSH console and confirm the runtime version. Run this on the instance itself:

PASS=$(sudo grep '^KARAF_SSH_PASSWORD=' /root/karaf-credentials.txt | cut -d= -f2-) sshpass -p "$PASS" ssh -n -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
  -o PreferredAuthentications=password -o PubkeyAuthentication=no \
  -p 8101 karaf@127.0.0.1 'system:version'

Expected output:

4.4.11

To connect from a remote workstation, open TCP 8101 in your security group to your operator CIDR first. Then replace 127.0.0.1 with the instance's IP, or use the bundled client: /opt/karaf/bin/client -a 8101 -h <public-ip> -u karaf.

The Karaf console exposes the full provisioning and bundle model. List the installed features:

PASS=$(sudo grep '^KARAF_SSH_PASSWORD=' /root/karaf-credentials.txt | cut -d= -f2-) sshpass -p "$PASS" ssh -n -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
  -o PreferredAuthentications=password -o PubkeyAuthentication=no \
  -p 8101 karaf@127.0.0.1 'feature:list -i'

Expected output (installed features, abbreviated):

Name | Version | Required | State | Repository | Description -------------+---------+----------+---------+-----------------+------------------------------------ feature | 4.4.11 | x | Started | standard-4.4.11 | Features Support shell | 4.4.11 | x | Started | standard-4.4.11 | Karaf Shell deployer | 4.4.11 | x | Started | standard-4.4.11 | Karaf Deployer bundle | 4.4.11 | x | Started | standard-4.4.11 | Provide Bundle support config | 4.4.11 | x | Started | standard-4.4.11 | Provide OSGi ConfigAdmin support jaas | 4.4.11 | x | Started | standard-4.4.11 | Provide JAAS support system | 4.4.11 | x | Started | standard-4.4.11 | Provide System support management | 4.4.11 | x | Started | standard-4.4.11 | Provide a JMX MBeanServer ssh | 4.4.11 | x | Started | standard-4.4.11 | Provide a SSHd server on Karaf

To add capability, run feature:install <name> (for example feature:install scr to add Declarative Services). Install OSGi bundles with bundle:install, or hot-deploy by dropping a bundle or KAR file into /opt/karaf/deploy.

The stock karaf/karaf credential is never shipped. Try to log in with the default password. The login fails:

if sshpass -p 'karaf' ssh -n -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null \
  -o PreferredAuthentications=password -o PubkeyAuthentication=no \
  -o ConnectTimeout=10 -p 8101 karaf@127.0.0.1 'system:version' 2>/dev/null; then echo 'UNEXPECTED: default credential accepted' else echo 'default karaf/karaf credential correctly rejected' fi

Expected output:

default karaf/karaf credential correctly rejected

Component Path

Karaf home /opt/karaf (link to /opt/apache-karaf-4.4.11)

Users file /opt/karaf/etc/users.properties (mode 0600 karaf:karaf)

Users template /usr/local/share/sac/karaf-users.properties.template

Deploy directory /opt/karaf/deploy (drop bundles or KAR files here to hot-deploy)

systemd unit /etc/systemd/system/apache-karaf.service

First-boot unit /etc/systemd/system/apache-karaf-firstboot.service

Credentials /root/karaf-credentials.txt (mode 0600 root:root)

Service user karaf (unprivileged, nologin)

Java runtime OpenJDK 17 (/usr/lib/jvm/java-17-openjdk-amd64)

• Restrict the security group so TCP 8101 only reaches your administrative CIDR. The recommended security group does not open it to the internet.
• Deploy in a private subnet and reach the console through a bastion or VPN where possible.
• Add more users by editing /opt/karaf/etc/users.properties (user = password,_g_:group lines), or from the console with jaas: commands. Then log in again.
• Deploy applications by dropping OSGi bundles or KAR files into /opt/karaf/deploy, or with bundle:install / feature:install from the console.
• Enable password encryption in /opt/karaf/etc/org.apache.karaf.jaas.cfg (encryption.enabled = true) so users.properties stores hashed passwords.
• Encrypt at rest by enabling EBS encryption on the instance's volumes.
• Patch regularly: sudo apt-get update && sudo apt-get upgrade && sudo reboot.