Cloud Commander

• Find the Cloud Commander on Ubuntu 24.04 LTS image in the Azure Marketplace and select Create.
• Choose your subscription, resource group and region.
• Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.
• On the Networking tab, allow inbound 443 and 80 from your users, and restrict 22 to your management network.
• Select Review + create, then create the VM.
• When the VM is running, browse to https://<your-public-ip>/.

Deploy the image from the command line, restricting SSH to your management network. Replace the example values with your own before you run the command.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:cloudcmd-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name cloudcmd \
  --image sac1647283583153:cloudcmd-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard
# Allow the web UI from your users and SSH from your management network only
az vm open-port --resource-group my-resource-group --name cloudcmd --port 443 --priority 1001
az network nsg rule create --resource-group my-resource-group --nsg-name cloudcmdNSG \
  --name allow-ssh --priority 1002 --destination-port-ranges 22 \
  --source-address-prefixes <your-mgmt-cidr> --access Allow --protocol Tcp

When the VM is running, browse to https://<public-ip>/.

Authentication is on by default. Each VM generates its own admin username and password on first boot, written to a root-only file. Read it over SSH.

ssh azureuser@<vm-ip> 'sudo cat /root/cloudcmd-credentials.txt'

The file contains the CLOUDCMD_USER, CLOUDCMD_PASS and CLOUDCMD_URL for this specific VM. Keep it secret. The server configuration only ever stores a one-way hash of the password, never the plain text.

Browse to https://<vm-ip>/. Because the certificate is self-signed per VM, your browser shows a certificate warning the first time. Accept it to proceed, or install the per-VM certificate, or place a CA-signed certificate in front (see Step 9).

Sign in with the username and password from Step 3.

Cloud Commander presents its classic two-panel file manager, with the function key bar along the bottom for common operations. The left and right panels can each browse a different directory, which makes copying and moving files between locations straightforward.

Double-click a folder to open it in the active panel. Here the left panel has navigated into the documents folder while the right panel stays at the workspace root, ready to copy files between the two.

Select a text file and press F4 (or double-click it) to open the built-in editor. Edits are saved straight back to the server. This is convenient for tweaking configuration files or notes without opening an SSH session.

Click a file to select it, then use the function key bar or the on-screen buttons to act on it.

• F3: view
• F4: edit
• F5: copy
• F6: move or rename
• F7: new folder
• F8: delete

Upload files by dragging and dropping them into the panel. Download files from the file menu. All operations run as the unprivileged cloudcmd user within the managed workspace.

SSH to the VM as azureuser and confirm that the services are running and Cloud Commander is bound to loopback only.

systemctl is-active cloudcmd nginx
sudo ss -tlnp | grep 8000

Both services report active, and Cloud Commander listens on 127.0.0.1:8000 only. nginx is the only component exposed on :80 and :443.

Run the built-in self-test. It reads this VM's credential and proves the full authenticated round trip over TLS.

• An unauthenticated request is refused.
• An authenticated directory listing succeeds.
• A test file is uploaded, then downloaded back byte for byte.

sudo /usr/local/bin/cloudcmd-selftest

nginx terminates TLS on port 443 and redirects plain HTTP on port 80 to HTTPS. Confirm the redirect and the unauthenticated health probe from the VM.

curl -s -o /dev/null -w 'port 80 -> HTTP %{http_code}\n' http://127.0.0.1/
curl -sk -o /dev/null -w 'healthz over TLS -> HTTP %{http_code}\n' https://127.0.0.1/healthz

Port 80 returns 301 and the health endpoint returns 200. An unauthenticated request to the file API is refused with 401, while a request carrying this VM's credential succeeds with 200.

The self-signed certificate is regenerated per VM on first boot, with the VM IP and hostname in its Subject Alternative Names.

The per-VM certificate is self-signed, so browsers warn on first use. For a public deployment, put a real certificate in front. The simplest approach is to point a DNS name at the VM and obtain a free certificate with Certbot.

# Point https://<your-domain> at this VM first, then:
sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Alternatively, terminate TLS at an Azure Application Gateway or a load balancer in front of the VM and forward to port 443.

By default the file manager is rooted at /srv/cloudcmd, and the built-in terminal and console are disabled for security. Both are controlled by /opt/cloudcmd/.cloudcmd.json.

To point the manager at a different directory, or to enable the terminal behind the existing login, edit that file and restart the service. Afterward, browse back to https://<vm-ip>/.

# Edit the root ("root": "/srv/cloudcmd") or enable the terminal ("terminal": true),
# then apply the change. Browse to https://<vm-ip>/ afterwards.
sudo nano /opt/cloudcmd/.cloudcmd.json
sudo systemctl restart cloudcmd

The baked version and this VM's credential summary are recorded on the VM. The password line is redacted below. Read the full value from the root-only file in Step 3.