Froxlor

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is a sensible starting point for typical production use. A smaller size such as Standard_B2s works for a light workload.

On the network security group (NSG), allow inbound 22/tcp from your management network, 80/tcp for the panel and hosted sites and 443/tcp if you terminate TLS on the VM. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Froxlor by SecureAnyCloud, and select Create. On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443). Then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:froxlor-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name froxlor \
  --image sac1647283583153:froxlor-ubuntu-24-04:default:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name froxlor --port 80,443

Step 3 - Confirm the services are running

Connect over SSH as azureuser, and confirm that Apache, PHP FPM, MariaDB and the first-boot service are all active. MariaDB listens only on 127.0.0.1:3306, while Apache serves the panel on port 80.

systemctl is-active apache2 php8.3-fpm mariadb froxlor-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Every VM performs its own Froxlor installation on first boot. It writes the generated administrator password, the login user and the panel URL to a root-only credentials file, along with the two MariaDB account passwords. Read the file with sudo:

sudo cat /root/froxlor-credentials.txt

You sign in to the panel as user admin with the FROXLOR_ADMIN_PASSWORD from this file. On the VM itself, you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in

Browse to http://<vm-public-ip>/. You land on the Froxlor sign-in page. Enter username admin and the password from Step 4.

After signing in you land on the Froxlor dashboard, which summarises the server and your hosting resources: customers, domains, web space and traffic totals, plus system details such as the hostname, web server, PHP version and MySQL server version.

Step 6 - Set your server name and default IP

Before creating customer domains, open System, then Settings, and confirm the panel's server name and default IP address. The image sets an internal server name and the VM's primary IP on first boot. Change the server name to your real fully qualified domain name once DNS points at the VM, so that the virtual hosts Froxlor generates use the correct address.

Step 7 - Create a customer

Open Resources, then Customers, and select Create customer to add your first hosting customer, with their own login, resource limits (domains, web space, MySQL databases, email and FTP accounts) and contact details. Each customer signs in to the same panel and sees only their own resources.

Step 8 - Manage domains, PHP, mail and databases

From the panel you administer the whole hosting stack. Open PHP, then PHP-FPM versions, to manage the per-domain PHP configurations Froxlor applies to customer virtual hosts. Under Resources you assign domains and subdomains to customers, and each customer manages their own MySQL databases, email accounts and forwarders, and FTP accounts within the limits you set.

Step 9 - How panel changes reach the server

Froxlor records your panel changes in its database and applies them to the live Apache, PHP FPM and system configuration through its master cron, which this image runs every five minutes as a systemd timer. So when you add a domain or change a PHP setting, the corresponding virtual host and configuration files are written within a few minutes. Check the timer and its schedule, or apply pending changes immediately by hand. The master cron runs as root because it writes system configuration:

systemctl status froxlor-cron.timer --no-pager | head -5

sudo php /var/www/froxlor/bin/froxlor-cli froxlor:cron tasks

Froxlor writes its generated customer virtual hosts to a dedicated directory (/etc/apache2/froxlor-vhosts/), which the panel's own virtual host includes, so a cron run can never rewrite or remove the panel's own configuration and lock you out.

Step 10 - No known or default credentials, and no claimable wizard

The SecureAnyCloud image ships with no Froxlor installation at all: there is no administrator account and no database in the captured image, so there is no credential to leak, known or otherwise. The web server is held closed by a systemd condition until first boot has completed the installation, so the setup wizard is never claimable by a stranger. On the first boot of every VM, Froxlor's own unattended installer runs and generates a unique random administrator password, and the setup wizard closes itself the moment the panel is installed. The admin account is the only seeded login. You can verify all of this on the VM:

mariadb -N -e "SELECT CONCAT(loginname,' (Froxlor panel admin)') FROM froxlor.panel_admins"

sudo bash /usr/local/sbin/froxlor-cred-roundtrip.sh

Step 11 - Verify the stack

Confirm the installed Froxlor release, the health endpoint and that the setup wizard is closed. The wizard returns a redirect once the panel is installed, so it can never be used to create a second administrator:

sudo -u www-data php /var/www/froxlor/bin/froxlor-cli --version

curl -sI http://127.0.0.1/healthz | head -1

curl -s -o /dev/null -w 'install wizard: HTTP %{http_code} (redirect - already installed)\n' http://127.0.0.1/install/install.php

Adding your own domain and TLS

The panel serves plain HTTP on port 80. For production, point a DNS record at your VM and obtain a certificate with Let's Encrypt. Froxlor can manage per-domain certificates for your customers, and you can secure the panel host itself with certbot:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d <your-domain>

Set the panel's server name to your real fully qualified domain name under System, then Settings, so that the virtual hosts Froxlor generates match. Froxlor derives the panel URL from the request host, so once you reach the VM on your domain the panel renders correctly with no further change.

Where hosting data lives

Customer web space is served from /var/customers, and the panel database lives in the bundled MariaDB. For production hosting workloads, attach an Azure data disk and mount it at /var/customers so customer web space is kept on dedicated storage separate from the operating system disk:

lsblk
sudo mkfs.ext4 /dev/sdc
sudo mount /dev/sdc /var/customers

Add a matching /etc/fstab entry keyed by the disk UUID so the mount persists across reboots.

Backing up

Your hosting data is the Froxlor database plus the customer web space. Dump the database and archive the web space directory:

sudo mysqldump --protocol=socket -uroot froxlor > /tmp/froxlor-backup.sql
sudo tar czf /tmp/froxlor-customers-backup.tar.gz -C /var customers

Copy both files off the VM on your usual schedule. To restore, load the SQL dump into the froxlor database and unpack the archive back to /var/customers.

Security notes

• The panel serves plain HTTP on port 80 out of the box. For anything beyond a trusted network, add your own domain and TLS as above, or front the VM with Azure Application Gateway.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through the panel or over SSH with sudo mariadb.
• The administrator password is unique per VM and no known or blank credential authenticates. Keep /root/froxlor-credentials.txt protected. To rotate the password, sign in and change it under your account settings.
• The panel's lib/, vendor/ and bin/ trees and dotfiles are denied by Apache, so Froxlor's internals (including the file that holds its database password) are never web-reachable.
• Apply operating system updates regularly with sudo apt update && sudo apt upgrade. Unattended security updates are enabled by default.
• Restrict inbound 80/tcp and 443/tcp in your NSG to the networks that need access.

Trademark

Froxlor is an open-source project distributed under the GNU General Public License version 2. This image is an independent packaging of the open-source Froxlor software by SecureAnyCloud and is not affiliated with, sponsored by, or endorsed by the Froxlor project or its authors.

Support

This image is maintained by SecureAnyCloud with 24/7 support. If you need help deploying or operating Froxlor on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch Froxlor 2.3 Hosting Control Panel on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Architecture at a glance

Components and details:

Control panel Froxlor 2.3.10, served on port 80 over HTTP by Apache + PHP-FPM

Web server Apache (apache2), a dedicated panel virtual host plus per-domain virtual hosts

PHP PHP 8.3 under PHP-FPM, with every extension Froxlor requires; the panel runs on its own dedicated PHP-FPM pool

Database MariaDB on 127.0.0.1:3306 (panel database froxlor)

Master cron froxlor-cron.timer, every 5 minutes, applies panel changes to the server configuration

Panel URL http://<instance-public-ip>/

Health endpoint http://127.0.0.1/healthz (static, returns ok)

Credentials file /root/froxlor-credentials.txt (root-only, 0600)

The panel database is small and customer web space lives under /var/customers, so the image ships on a single root volume. For production hosting workloads, attach a dedicated EBS volume and mount it at /var/customers (see Storing customer web space on a data volume below).

Connecting to your instance

Connect over SSH on port 22. For Ubuntu 24.04 LTS, the SSH login user is ubuntu.

ssh ubuntu@<instance-public-ip>

Froxlor derives its base URL from the request host, so the panel renders on whatever address you reach it on. Open the panel in a browser at http://<instance-public-ip>/.

Retrieving your administrator password

A unique administrator password was generated for this instance on first boot and written to a root-only file. Read it over SSH:

sudo cat /root/froxlor-credentials.txt

The file looks like this. The values are unique to your instance:

FROXLOR_URL=http://<instance-public-ip>/ FROXLOR_ADMIN_USER=admin FROXLOR_ADMIN_PASSWORD=<FROXLOR_ADMIN_PASSWORD> FROXLOR_SERVERNAME=ip-172-31-0-0.sac.internal FROXLOR_DB_NAME=froxlor FROXLOR_DB_USER=froxlor

Sign in at http://<instance-public-ip>/ as user admin with the FROXLOR_ADMIN_PASSWORD value. Change the password from admin menu > Change password after your first sign-in.

The dashboard shows your customer, domain, web space, database, email and FTP resource counts, alongside the running Apache, PHP and MariaDB versions.

Creating your first hosting customer

In Froxlor you first create a customer (a hosting account), then add domains under that customer. From the panel, go to Resources > Customers > Create customer, fill in the account data and save. Froxlor can autogenerate the username and password for you.

You can also drive every panel operation from the command line with Froxlor's own API. The example below creates a customer, reads it back, then removes it again, all as the admin user:

FCLI="sudo -u www-data /usr/bin/php /var/www/froxlor/bin/froxlor-cli froxlor:api-call admin" CPW="$(openssl rand -base64 18 | tr -dc 'A-Za-z0-9' | cut -c1-16)" $FCLI Customers.add "{\"new_loginname\":\"demo01\",\"email\":\"demo@sac.internal\",\"name\":\"Demo\",\"firstname\":\"User\",\"new_customer_password\":\"${CPW}\",\"createstdsubdomain\":false}" >/dev/null echo "Customers after add:"; $FCLI Customers.listing | grep -E '"count"|"loginname"' $FCLI Customers.delete "{\"loginname\":\"demo01\"}" >/dev/null echo "Customers after delete:"; $FCLI Customers.listing | grep -E '"count"'

Once a customer exists, add their domains under Resources > Domains, and web space, FTP, email, databases and DNS records from the customer's own areas of the panel.

Storing customer web space on a data volume

For production hosting you will want customer web space on its own resizable disk rather than the root volume. Attach an EBS volume to the instance in the EC2 console, then format and mount it at /var/customers (replace the device name with the one your instance shows in lsblk):

sudo mkfs.ext4 -L customers /dev/nvme1n1 echo 'LABEL=customers /var/customers ext4 defaults,nofail 0 2' | sudo tee -a /etc/fstab
sudo mkdir -p /var/customers && sudo mount /var/customers
sudo chown www-data:www-data /var/customers

Do this before you create customers, so their home directories land on the dedicated disk.

Setting your server name and DNS

The appliance boots with a default internal server name. Once you have a real domain, point its DNS A record at the instance's public IP. Then set the server name in System > Settings > System settings > Hostname of the server to your FQDN. Froxlor's master cron applies the change to the server configuration on its next run.

# Your DNS provider: create an A record for panel.your-domain.com -> <instance-public-ip>

Serving the panel over HTTPS

The panel serves over HTTP by default. To serve it over HTTPS, issue a certificate for your server name. With DNS pointing at the instance you can obtain a free Let's Encrypt certificate:

sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d panel.your-domain.com

Froxlor can also manage Let's Encrypt certificates for your hosted domains from within the panel once the domains resolve to the instance.

Managing the services

The hosting stack is three systemd services. Check their state at any time:

systemctl is-active apache2 php8.3-fpm mariadb

All three should report active. Restart a service with sudo systemctl restart apache2 (or php8.3-fpm, mariadb).

Verify the panel is answering and confirm the installed version:

curl -s -o /dev/null -w 'panel HTTP %{http_code}\n' http://127.0.0.1/
sudo -u www-data /usr/bin/php /var/www/froxlor/bin/froxlor-cli --version

The panel returns 200 and the version banner reads froxlor-cli 2.3.10.

Security notes

• No default credentials ship in the image. The administrator account, the panel database and its MariaDB users are all created on first boot with per-instance random passwords.
• The setup wizard is closed once first boot has installed the panel. It can never be claimed by a stranger.
• The panel serves on port 80. Restrict inbound access to trusted source IPs in your EC2 security group if the panel does not need to be world-reachable, and serve it over HTTPS.
• MariaDB root is reachable only over the local Unix socket for on-box maintenance; it has no network-usable password.
• Keep /root/froxlor-credentials.txt private. It is 0600 root:root; delete it once you have changed the admin password if you prefer.

Support

SecureAnyCloud provides 24/7 technical support for this Froxlor Hosting Control Panel product by email (sales@secureanycloud.com) and live chat, with a one hour average response time for critical issues. We help with deployment and initial configuration, customer and domain provisioning, mail, FTP and DNS setup, Let's Encrypt certificate issuance, master cron and system configuration troubleshooting, version upgrades, MariaDB database administration and performance tuning. For billing, subscription changes or refund requests, contact sales@secureanycloud.com.

All product and company names are trademarks or registered trademarks of their respective holders. Their use does not imply any affiliation with or endorsement by them.

Deploy on AWS

Launch Froxlor with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com