SecureAnyCloud
Deployment guide

ArozOS

Overview

ArozOS is a self-hosted web desktop operating system and cloud file platform. In a browser it gives you a desktop with a start menu, a task bar and draggable windows, running over a virtual file system that you own. It is multi-user, so a family, a team or a small organisation can share one server while each person keeps a private file space.

This SecureAnyCloud image serves ArozOS 2.025 on a hardened Ubuntu 24.04 LTS base, patched at build time, with the web desktop on port 8080. It is secure by default: the image ships with no user account, so you create your own administrator with your own password on the first visit. There are no shared or default credentials anywhere in the image.

What you get:

  • ArozOS 2.025, a single self-contained Go binary, managed by systemd
  • The web desktop, file manager and all modules on :8080
  • No default account: you create the first administrator on the first visit
  • An embedded key-value store, so there is no external database to run
  • A drag-and-drop file manager with upload, download, zip, share and preview
  • A built-in text and code editor, media streaming and a per-user static web server for publishing pages straight from a folder
  • Multi-user accounts with permission groups and storage quotas
  • Optional built-in FTP, WebDAV, SFTP and TFTP file servers, all disabled by default
  • A per-instance file server host key generated on first boot and never shared between VMs
  • A dedicated Azure data disk at /opt/arozos for all files and state
  • arozos.service as an enabled systemd unit
  • 24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Choose a larger size for more concurrent users or heavier media streaming.

Configure the NSG to allow inbound 22/tcp from your management network and 8080/tcp for the web desktop.

The image deliberately ships with no account, so the create administrator form is open to whoever reaches port 8080 first. Scope the inbound rule for 8080/tcp to your own IP address before you boot the VM, and create your administrator immediately after first boot. Once your administrator exists, ArozOS restricts account creation to signed-in administrators.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ArozOS by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), then add a custom rule for 8080 scoped to your own IP.

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:arozos-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name arozos \
  --image sac1647283583153:arozos-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the web desktop port, restricted to your own address:

az network nsg rule create \
  --resource-group <your-rg> \
  --nsg-name arozosNSG \
  --name allow-arozos-ui \
  --priority 900 \
  --source-address-prefixes <your-ip>/32 \
  --destination-port-ranges 8080 \
  --access Allow --protocol Tcp

Step 3 - Confirm the service is running

SSH in as azureuser and confirm that ArozOS is active. The web desktop listens on port 8080. All state lives on the dedicated data disk mounted at /opt/arozos.

systemctl is-active arozos arozos-firstboot
sudo ss -tln | grep ':8080 ' | awk '{print $1, $4}'
findmnt -no SOURCE,TARGET,FSTYPE /opt/arozos

Step 4 - Read the first-visit info note

ArozOS ships with no user account. On the first boot of every VM, a one-shot service writes an instance info note that records the web desktop URL and the create administrator instruction. The note contains no password, because you set your own on the first visit. Read it with sudo:

sudo grep -v '^#' /root/arozos-credentials.txt | grep -v '^$'

You can also confirm from the command line that the server is healthy and that no account is baked into the image. The health endpoint returns 200. The group listing endpoint offers the administrator group only while zero accounts exist, which is exactly the create administrator state:

curl -s -o /dev/null -w 'GET /system/id/ping -> HTTP %{http_code}\n' http://127.0.0.1:8080/system/id/ping
curl -s http://127.0.0.1:8080/system/permission/listgroup; echo

Step 5 - Create your administrator on first visit

Browse to http://<vm-public-ip>:8080/. Because the image ships with no account, ArozOS opens on its New User form.

Choose a username and a strong password, and confirm the password. Leave the user group as administrator and select Create.

This one screen is where you secure the instance. There are no default credentials to change, because none ship.

Step 6 - Explore the web desktop

Sign in with the account you just created and ArozOS loads its web desktop. The task bar across the bottom carries the start menu and the clock. The desktop holds your File Manager, System Setting and Trash Bin shortcuts.

Every module opens as a window on the desktop, so you can work with several at once, as you would on a local machine.

Step 7 - Use the file manager

Open File Manager from the desktop. The left pane lists your storage pools. User (user:/) is your private file space and tmp (tmp:/) is scratch storage.

Use New Folder and New File on the toolbar to create items. Drag files from your machine onto the window to upload them. Use Download, Create Zip, Share and Delete to manage what is there.

The screenshot below shows a freshly created account after adding a couple of folders and a text file.

Step 8 - Open system settings and add users

Open System Setting from the desktop for the administration interface. The Overview tab shows the signed-in account, its permission group, storage usage and uptime. The tabs across the top cover host information, performance, runtime and power.

From the Users group in the settings menu, create additional accounts, assign them to permission groups and set per-user storage quotas. This is how you turn a single instance into a shared team or family server.

Step 9 - Confirm access control

ArozOS refuses unauthenticated access across the whole surface, not just on the login page. Requests for the desktop and for file operations are redirected to the login page, and the API endpoints reject the caller outright. Confirm it from the command line:

curl -s -o /dev/null -w 'GET /desktop.html -> HTTP %{http_code}\n' http://127.0.0.1:8080/desktop.html
curl -s -o /dev/null -w 'POST /system/file_system/newItem -> HTTP %{http_code}\n' -X POST --data-urlencode 'src=user:/' --data-urlencode 'type=file' --data-urlencode 'filename=probe.txt' http://127.0.0.1:8080/system/file_system/newItem
curl -s http://127.0.0.1:8080/system/users/list; echo

The image also fixes a defect in the upstream release archive. The archive ships a fixed 1024-bit private key that every ArozOS installation would otherwise reuse as the host key for its built-in SFTP server.

This image removes that key entirely and generates a fresh 4096-bit key on each VM's first boot, so no two deployments share a host identity:

sudo openssl rsa -in /opt/arozos/system/auth/id_rsa.key -noout -text | head -1

Step 10 - Verify the stack

Confirm that the unit is enabled at boot, then review what lives on the dedicated data disk and check its free space:

systemctl is-enabled arozos
sudo ls /opt/arozos
df -h /opt/arozos | tail -1

Step 11 - Where your data lives

Every user's files, the account store, the device identity, the file server host key and the ArozOS web resources live on a dedicated Azure data disk mounted at /opt/arozos, separate from the OS disk. The disk is captured into the image and re-provisioned on every VM. You can snapshot and resize it independently as your storage grows.

User files sit under files/, one directory per account.

sudo find /opt/arozos/files -maxdepth 2 2>/dev/null | head -10

Step 12 - Enable the built-in file servers (optional)

ArozOS can expose the same storage over FTP, WebDAV, SFTP and TFTP for desktop clients and legacy devices. All of them are disabled by default in this image.

Enable only the servers you need from the settings menu under Network. At the same time, open the matching port in the NSG, scoped to the networks that need it. The SFTP server uses the per-instance host key described in Step 9, so its host fingerprint is unique to your VM.

Security notes

  • Restrict the web desktop. It serves on port 8080. Limit 8080/tcp in the NSG to trusted networks and consider putting it behind your own VPN. ArozOS can also terminate TLS itself if you supply a certificate.
  • Create your administrator first. The image ships with no account, and the create administrator form stays open until you complete it. Scope the NSG rule to your own IP before first boot and create your administrator straight away. After that, only signed-in administrators can create accounts.
  • No shared host key. A fresh file server host key is generated per instance on first boot, so no cryptographic identity is shared across deployments. The fixed key shipped in the upstream release archive is not present in this image.
  • Reduced listening surface. LAN peer discovery over mDNS and SSDP is turned off, since it has no purpose on a cloud VM. Re-enable it in the unit file if you have a specific need.
  • Least privilege for accounts. ArozOS runs as root because its disk mount, power and hardware information modules need privileged access. Grant each account the narrowest permission group that meets its needs, and use storage quotas to bound usage.
  • Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. For questions about this ArozOS image or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch ArozOS on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure