EGroupware

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size for a team. Move up to Standard_D2s_v3 or larger for many concurrent users, large file stores or heavy calendar use.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the application and 443/tcp if you terminate TLS on the VM. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search for EGroupware 26 Collaboration Suite on Ubuntu 24.04 LTS by SecureAnyCloud, and select Create.

Pick your subscription, resource group and region, and choose the Standard_B2s size. Select SSH public key authentication with the username azureuser, and allow inbound ports 22, 80 and 443.

The image attaches its own 30 GiB data disk for your database and file store, so you do not need to add one.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:egroupware-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name egroupware \
  --image sac1647283583153:egroupware-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name egroupware --port 80,443

Step 3 - Confirm the services are running

SSH to the VM as azureuser and confirm that Apache and MariaDB are active. MariaDB is bound to 127.0.0.1:3306 only, while Apache serves on port 80.

systemctl is-active apache2 mariadb

The first-boot service is a one-shot job, not a long-running service. Ask for its result instead of whether it is active. It reports success once it has generated this VM's credentials:

systemctl show egroupware-firstboot --property=Result --value

It is normal and correct for systemctl is-active egroupware-firstboot to report inactive after the job has run, and especially after a reboot. A sentinel file guards the unit, so it generates your credentials exactly once and never overwrites them on a later boot. Result=success is the answer that matters.

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

The first-boot service generates an administrator password unique to your VM and writes it to a root-only file. Read it over SSH:

sudo cat /root/egroupware-credentials.txt

This image bakes no address into its configuration. EGroupware uses a relative web server URL, so it works unchanged on the VM's public IP, on its private address, on a DNS name, or behind a TLS-terminating proxy. There is nothing to reconfigure when your address changes.

Step 5 - Sign in

Browse to http://<vm-ip>/egroupware/. Sign in with the username admin and the password from the credentials file. Browsing http://<vm-ip>/ redirects you there.

After you sign in, the suite opens on the calendar, with the application bar and a search box across the top. EGroupware may offer to start a working time entry on your first sign-in. If you do not use the time sheet, answer No or Don't ask again!

Step 6 - Use the calendar

The calendar is EGroupware's centerpiece. It opens on the current day, with a month picker, your favorites and an open tasks panel alongside.

Switch between day, week, month and year views. Book resources and meeting rooms, invite other users and see their free or busy time, and set up recurring appointments.

Calendars are shared according to the access control you grant each group, and they synchronize to phones and desktop clients over CalDAV.

Step 7 - Manage contacts in the address book

Open Address Book to manage your shared and personal contacts, with business and home fields, organizations, distribution lists and categories. A fresh instance contains the administrator's own contact and EGroupware's internal SiteMgr record.

Contacts sync to phones and desktop clients over CardDAV. They link through to InfoLog entries, calendar events and projects.

Step 8 - Track tasks and tickets in InfoLog

Open InfoLog, EGroupware's tracker for tasks, notes, phone calls and tickets. A fresh instance starts empty.

Entries carry a type, status, priority, start and due dates, an owner and a responsible user. Link an entry to a contact, a calendar event or a project so everything about a piece of work stays together.

Use the filters down the page to build and save views, such as your own open tasks or everything due this week.

Step 9 - Connect your own mail server

EGroupware's mail app is a client, not a mail server. This image deliberately ships no SMTP or IMAP daemon, so nothing listens on a mail port and there is no relay to secure.

Sign in as the administrator and go to Admin > Mail accounts. Point the mail app at an IMAP and SMTP server you already run, or at a hosted provider.

The rest of the suite, including the calendar, address book, InfoLog, file manager and project manager, works fully without a mail server. The same Admin area connects EGroupware to LDAP or Active Directory, if you prefer to authenticate against your existing directory instead of the bundled database.

Step 10 - No known or default credentials

This image ships with no usable login. Every password set at build time (the administrator, the database and the setup console credentials) is rotated to a random value that is discarded and never recorded. The first-boot service sets fresh values unique to your VM before EGroupware serves a single request.

The check below confirms that the per-VM administrator authenticates through EGroupware's own authentication path, while a blank password and common weak guesses are all rejected.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(account_lid,' (',account_type,')') FROM egroupware.egw_accounts WHERE account_type='u'"

sudo bash /usr/local/sbin/egroupware-cred-roundtrip.sh

The listing above shows a second account named anonymous alongside admin. This account is not a login for you or your users. EGroupware creates it during installation and uses it internally to serve file manager share links to people who are not signed in.

EGroupware creates it with a random password of its own, and this image rotates that password to a fresh random value unique to your VM on first boot. The check above confirms that it rejects every guessable credential.

admin is the only account intended to sign in on a new instance. Create your real users under Admin > User accounts. After your first sign-in, change the administrator password to one of your own under Preferences > Password.

Step 11 - Verify the stack and where your data lives

Confirm the installed release, the health endpoint and the data disk layout. The MariaDB database and EGroupware's file store, which holds every file your users upload, both live on the dedicated data disk. The disk is bind-mounted into place, so your data stays off the operating system disk.

grep -oE "maintenance_release'\] = '[^']+'" /var/www/egroupware/api/setup/setup.inc.php | sed "s/.*'\(.*\)'/EGroupware \1/"

curl -sI http://127.0.0.1/healthz | sed -n 1p

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data;
findmnt -no SOURCE,TARGET /var/lib/mysql;
findmnt -no SOURCE,TARGET /var/www/egroupware/files

EGroupware reports two version numbers, and both are correct. The release above is the shipped maintenance release. The database records a separate internal schema version that changes only when the table layout does.

Adding your own domain and TLS

Point a DNS A record at the VM's public IP. Then install Certbot and request a certificate for your domain:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d groupware.your-domain.example --agree-tos -m you@your-domain.example --redirect

Certbot configures Apache for HTTPS and installs a renewal timer. EGroupware uses a relative web server URL, so nothing changes inside the application. It picks up your domain automatically.

Backing up

Everything worth keeping is on the data disk: the MariaDB database and the file store. For a full machine-level backup, take an Azure snapshot of the data disk. Alternatively, dump the database and archive the file store:

sudo mysqldump --protocol=socket -uroot --single-transaction egroupware > /var/tmp/egroupware-backup.sql
sudo tar -czf /var/tmp/egroupware-files.tar.gz -C /data/egroupware files

Store both off the VM. The simplest scheduled option is an Azure Backup policy on the VM and its data disk. EGroupware also has its own backup export under the setup console, which writes a portable dump of a domain.

Security notes

• The setup console is locked. The web server denies it, so the installer can never be reached or re-run against your instance. If you need it for a major version upgrade, re-enable it temporarily with sudo a2disconf sac-egroupware-lockdown && sudo systemctl reload apache2, then lock it again immediately afterwards.
• Configuration secrets stay private. header.inc.php holds the database password and the setup console credentials. The web server denies it, and on disk it is 0640 root:www-data, so neither HTTP nor an unprivileged user on the VM can read it.
• Uploaded files are protected. The web server denies direct access to EGroupware's file store. The file manager serves uploaded files and applies your access control, so they are never served as static files.
• Keep MariaDB private. The bundled MariaDB listens on 127.0.0.1:3306 only. Keep port 3306 closed in your NSG, because nothing outside the VM needs it.
• Protect the credentials file. The administrator, database and setup console passwords are unique to your VM and generated on first boot. They are written only to /root/egroupware-credentials.txt with 0600 root:root permissions.
• Sessions work by IP or DNS name. Session cookies are host-only, so sign-in behaves correctly whether you browse the instance by IP or through a DNS name.
• Encrypt web traffic. Serve the suite over HTTPS before you put real data in it, and restrict 22/tcp to your management network.
• Keep the VM patched. The base OS is fully patched at build time, and unattended security upgrades remain enabled on your VM.

Trademark

EGroupware is a trademark of its respective owner. SecureAnyCloud is not affiliated with, endorsed by, or sponsored by EGroupware GmbH or the EGroupware project. This image packages the open source EGroupware community software, which is distributed under the GNU General Public License version 2 or later, and all product and company names are the property of their respective holders.

Support

SecureAnyCloud provides 24/7 technical support for this image by email (sales@secureanycloud.com) and live chat. Support covers deployment, configuration, upgrades, performance tuning and MariaDB administration. Critical issues receive a one-hour average response time.

Deploy on Azure

Launch EGroupware 26 Collaboration Suite on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

Before you deploy this image, make sure you have:

• An Amazon Web Services account where you can launch EC2 instances
• IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
• An EC2 key pair in the target Region for SSH access to the instance
• A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and port 80 for the web interface
• The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Support

This image is published and supported by SecureAnyCloud. Support covers deployment, user, group and permission setup, connecting your own mail server, LDAP or Active Directory, CalDAV and CardDAV client synchronization, module configuration, version upgrades, performance tuning, the data volume, TLS and backups.

This image runs EGroupware natively on Apache, PHP and MariaDB rather than in the upstream container topology, so SecureAnyCloud supports this appliance directly. To reach SecureAnyCloud, use the support channel listed on the AWS Marketplace listing.

Deploy on AWS

Launch EGroupware on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com