SecureAnyCloud
Deployment guide

DNS Dhcp

Overview

This page is the entry point for the SecureAnyCloud Hardened Pi-hole, AdGuard Home & DNS Server AMIs AWS Marketplace listing. The listing is a single product that offers several products and releases as separate software versions.

Subscribe once, then choose the version you want from the Software version list at launch. Open its guide below for the full setup and connection walk-through.

Each AMI is a repackaged open-source DNS or NTP product, built, patched and ready to deploy on AWS. SecureAnyCloud applies security hardening, a secure-by-default configuration and per-instance credentials generated on first boot.

What SecureAnyCloud adds to every version:

  • Every image is built on a fully patched base with the latest security updates applied at build time.
  • Where a product has a login, API key or TLS key (web consoles, DNS-over-TLS, NTS, rndc), credentials are generated uniquely on the first boot of each instance and written to a root-only file. No default login exists and no two instances share a secret.
  • DNS, DNS-over-TLS and NTP ports stay closed in the security group until you open them to your own VPC or VPN ranges. Resolvers answer only loopback and private networks by default, so an instance is never an open resolver.

Pricing is metered hourly per EC2 instance type and is the same for every version in this listing. The recommended instance type is m5.large.

How to pick a version

  • Open the listing on AWS Marketplace and choose View purchase options, then Subscribe. One subscription covers every product and release in the listing, and the free trial starts with it.
  • When the subscription is active, choose Launch your software.
  • Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for full control). In Version, choose the product and release you want. Each is a separate software version, named <product> <release> on <operating system> - <date>, for example AdGuard Home 0.107.79 on Ubuntu 24.04 - YYYY-MM-DD. The date is when that version was added to the listing.
  • Choose your Region, an instance type (m5.large is recommended), your EC2 key pair, and a security group that opens the ports in the product's guide. Then choose Launch.
  • After launch, open the product's guide below for first login.

You can run several products from the same subscription: launch one instance per product, each from its own software version.

Versions in this listing, newest release first:

  • AdGuard Home: 0.107.79 with Unbound on Ubuntu 24.04, 0.107.79 on Ubuntu 24.04
  • BIND: 9.20.30 on Ubuntu 24.04
  • Chrony: 4.5 on Ubuntu 24.04
  • CoreDNS: 1.14.7 on Ubuntu 24.04
  • DDNS Updater: 2.10.0 on Ubuntu 24.04
  • ntpd-rs: 1.9.0 on Ubuntu 24.04
  • Pi-hole: 6.5 on Ubuntu 24.04
  • Poweradmin: 4.3.6 on Ubuntu 24.04
  • PowerDNS Recursor: 5.4.7 + dnsdist on Ubuntu 24.04
  • SmartDNS: 48.4 on Ubuntu 24.04
  • Unbound: 1.19.2 on Ubuntu 24.04
  • Zonemaster: 2026.1.2 on Ubuntu 24.04

Security model

Every version in this listing follows the same security model:

  • No default login. Administrator passwords, database passwords and application secrets are generated on the first boot of each instance and written to a root-only file. No two instances share a secret.
  • Only the documented ports. Each guide lists the ports the product needs. Open only those in your security group.
  • Internal services on localhost. Databases and caches listen on 127.0.0.1 only. Never open database ports (3306, 5432, 6379) to the internet.
  • Service ports closed until you open them. The listing's default security group does not open DNS (53 UDP and TCP), NTP (123/udp) or DHCP (67/udp). Open them only to your own networks or VPC CIDR, and never to 0.0.0.0/0. A resolver or time server open to the internet is abused for amplification attacks.
  • Patched base. The operating system is fully patched when the image is built.
  • HTTPS on first boot for AdGuard Home 0.107.79 on Ubuntu 24.04, AdGuard Home 0.107.79 with Unbound on Ubuntu 24.04, DDNS Updater 2.10.0 on Ubuntu 24.04, Pi-hole 6.5 on Ubuntu 24.04, Poweradmin 4.3.6 on Ubuntu 24.04 and Zonemaster 2026.1.2 on Ubuntu 24.04. These versions serve HTTPS with a per-instance certificate from first boot.
  • Web interface off the network for SmartDNS 48.4 on Ubuntu 24.04. The listing's security group opens SSH only, so reach the web interface through an SSH tunnel, as its guide shows.
  • HTTP with a certificate you add for PowerDNS Recursor 5.4.7 + dnsdist on Ubuntu 24.04. This version serves HTTP. Its guide shows how to add a certificate on the instance, or behind an Application Load Balancer with AWS Certificate Manager.
  • No web port for BIND 9.20.30 on Ubuntu 24.04, Chrony 4.5 on Ubuntu 24.04, CoreDNS 1.14.7 on Ubuntu 24.04, Unbound 1.19.2 on Ubuntu 24.04 and ntpd-rs 1.9.0 on Ubuntu 24.04. They open no web port (80 or 443) and are managed over SSH. Their guide lists the ports they use.

Choose your product

Each product has its own guide. Open the guide that matches the software version you launched. All versions run on Ubuntu 24.04:

  • AdGuard Home: AdGuard Home 0.107.79 on Ubuntu 24.04
  • AdGuard Home: AdGuard Home 0.107.79 with Unbound on Ubuntu 24.04
  • BIND: BIND 9.20.30 on Ubuntu 24.04
  • Chrony: Chrony 4.5 on Ubuntu 24.04
  • CoreDNS: CoreDNS 1.14.7 on Ubuntu 24.04
  • DDNS Updater: DDNS Updater 2.10.0 on Ubuntu 24.04
  • ntpd-rs: ntpd-rs 1.9.0 on Ubuntu 24.04
  • Pi-hole: Pi-hole 6.5 on Ubuntu 24.04
  • Poweradmin: Poweradmin 4.3.6 on Ubuntu 24.04
  • PowerDNS Recursor: PowerDNS Recursor 5.4.7 + dnsdist on Ubuntu 24.04
  • SmartDNS: SmartDNS 48.4 on Ubuntu 24.04
  • Unbound: Unbound 1.19.2 on Ubuntu 24.04
  • Zonemaster: Zonemaster 2026.1.2 on Ubuntu 24.04

How to tell which version you launched

The EC2 console shows the version you chose on the instance's launch record (AMI name and description), and your AWS Marketplace subscription shows it too.

On the instance itself, the login message after SSH names the product and its credentials file. Open the matching guide above for the rest of the walk-through.

Support

SecureAnyCloud provides 24/7 support for every version in this listing through the AWS Marketplace support channel. Raise a ticket through the Marketplace console or email sales@secureanycloud.com.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Hardened Pi-hole, AdGuard Home & DNS Server AMIs with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS