Lutece 7.1

• Open the SecureAnyCloud Lutece 7.1 on Ubuntu 24.04 LTS offer in the Azure Marketplace and select Create.
• Choose your subscription, resource group and region.
• Set the VM size to Standard_B2s (or larger for heavier content loads).
• Provide your SSH public key for the admin user.
• Allow inbound SSH (22) and HTTP (80).
• Select Review + create. The VM is ready to serve within a couple of minutes of first boot.

az group create --name lutece-rg --location eastus
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:lutece-ubuntu-24-04:default:latest
az vm create \
  --resource-group lutece-rg \
  --name lutece-vm \
  --image sac1647283583153:lutece-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group lutece-rg --name lutece-vm --port 80 --priority 900

ssh azureuser@<your-vm-ip>

First boot runs lutece-firstboot.service, which provisions the database and credentials before Tomcat and nginx start. Confirm everything is active:

systemctl is-active lutece-firstboot.service mysql.service tomcat.service nginx.service

Expected output:

active active active active

The lutece-firstboot.service is a one-shot unit that reports active once it has finished provisioning.

Tomcat and nginx carry a ConditionPathExists gate on a bootstrap marker. The first-boot service writes the marker only after the per-instance credential is in place, so the application is never reachable with the upstream default login.

Every instance generates its own administrator password and database password on first boot. It writes them to /root/lutece-credentials.txt, readable only by root. Read the file:

sudo cat /root/lutece-credentials.txt

# Lutece 7.1 - Per-VM Credentials LUTECE_URL=http://<your-vm-ip>/ LUTECE_ADMIN_URL=http://<your-vm-ip>/jsp/admin/AdminLogin.jsp LUTECE_ADMIN_USER=admin LUTECE_ADMIN_PASSWORD=<unique-per-instance-password> LUTECE_DB_NAME=lutece LUTECE_DB_USER=lutece LUTECE_DB_PASSWORD=<unique-per-instance-password>

The upstream admin / adminadmin default and the lutece, redac and valid demo accounts do not exist on your instance. First boot deletes the demo accounts and replaces the administrator password with the unique value above, stored as a PBKDF2 (HMAC SHA512) hash.

Browse to http://<your-vm-ip>/. The Lutece portal renders its home page from the core and its shipped theme.

Browse to http://<your-vm-ip>/jsp/admin/AdminLogin.jsp and sign in with the admin username and the password from /root/lutece-credentials.txt.

After you sign in, you land on the site administration dashboard. From there you manage pages, users, roles, page templates and the system configuration. The dashboard shows a single administrator account, because the demo accounts have been removed.

Lutece protects the login form against brute force. After three failed attempts from an address, it requires a captcha, so keep your per-instance password to hand.

Lutece stores its content and configuration in MySQL, which listens on the loopback interface only. Connect as the OS root user over the local socket and list the administrator accounts:

sudo mysql lutece -e "SELECT COUNT(*) AS admin_accounts FROM core_admin_user;"

+----------------+ | admin_accounts | +----------------+ | 1 | +----------------+

Exactly one administrator account exists, and it carries your unique per-instance credential. The MySQL root account uses the auth_socket plugin and has no password, so it is reachable only as the OS root user on the machine itself.

From the back office you can:

• Create and organise pages under Site, and edit their content and layout.
• Manage administrators, roles and workgroups, so that editorial teams share one authoritative site while each user sees only what they are entitled to.
• Install and configure plugins to add forms, document management, directories, search and other features from the Lutece ecosystem.
• Manage page templates and the overall site configuration under System.

# Status systemctl status tomcat.service
# Restart the application
sudo systemctl restart tomcat.service
# Restart the reverse proxy
sudo systemctl restart nginx.service
# Application logs
sudo tail -f /opt/tomcat/webapps/ROOT/WEB-INF/logs/error.log

The default JVM heap is sized for Standard_B2s (-Xmx1536m), leaving MySQL and the OS comfortable in 4 GB with no swap. For heavier content, a larger catalogue or many concurrent editors, move to a larger VM and raise the heap in /opt/tomcat/bin/setenv.sh.

sudo sed -i 's/-Xmx1536m/-Xmx3072m/' /opt/tomcat/bin/setenv.sh
sudo systemctl restart tomcat.service

Back up the MySQL database and the per-instance configuration:

DBPASS=$(sudo awk -F= '/^LUTECE_DB_PASSWORD=/{print $2}' /root/lutece-credentials.txt) mysqldump -h 127.0.0.1 -u lutece -p"$DBPASS" lutece > lutece-backup-$(date +%F).sql
sudo cp /opt/tomcat/webapps/ROOT/WEB-INF/conf/db.properties db.properties.bak

• No default login. The upstream admin / adminadmin credential and the lutece, redac and valid demo accounts never exist on your instance. First boot deletes the demo accounts and rotates the administrator to a unique PBKDF2-hashed password. The string adminadmin is not present anywhere in the image except the front-end weak-password denylist, where it is used to reject that value as a password.
• No credential in the image. The captured image ships no database, no application database account and no connection password. Each is created on first boot and written to a root-only file.
• Loopback-only data tier. MySQL and Tomcat both bind 127.0.0.1. nginx is the sole public listener on port 80. Tomcat's shutdown port is disabled, and there is no manager or host manager application.
• Nothing sensitive is web-reachable. nginx returns 404 for any /WEB-INF/ path and for dotfiles, so db.properties and the configuration files cannot be fetched over HTTP. Neither the reverse proxy nor the servlet container discloses a version banner.
• Patched base. Ubuntu 24.04 LTS, fully patched at build time, with unattended security upgrades enabled for the running instance.

• Put the site behind HTTPS with a TLS certificate (for example a load balancer or a reverse proxy in front) before you serve real traffic.
• Restrict inbound access to the administration paths to trusted addresses.
• Rotate the administrator password after first login, and add a named administrator account for each editor rather than sharing one.
• Configure an outbound mail relay if you use Lutece features that send email.

• The site does not answer yet. First-boot provisioning runs before Tomcat starts. Check systemctl status lutece-firstboot.service. Tomcat starts once provisioning completes.
• Locked out of the admin login. After repeated failed attempts, Lutece requires a captcha for a short window. Wait, then sign in with the correct per-instance password.
• Application errors. Check /opt/tomcat/webapps/ROOT/WEB-INF/logs/error.log and the Tomcat log at /opt/tomcat/logs/catalina.out.

Lutece is distributed under the BSD 3-Clause License (Copyright (c) 2017, Mairie de Paris). Apache Tomcat is under the Apache License 2.0. The licence artifacts are shipped on the image under /usr/share/lutece/ and /usr/share/doc/apache-tomcat/.

SecureAnyCloud provides and supports this image, with 24/7 support and a 24-hour response SLA. For assistance, contact SecureAnyCloud support through the marketplace listing.

Deploy on Azure

Launch Lutece 7.1 on Ubuntu 24.04 LTS with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com