MaxKey

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region
• Standard_B2s (2 vCPU / 4 GiB RAM) as a comfortable starting size for the full stack
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp from the clients and applications that will use MaxKey

The appliance serves plain HTTP. For production, put it behind your own domain and TLS.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for MaxKey by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22). Add port 80 after deployment.

Choose Review + create, followed by Create.

Step 2 - Deploy from the Azure CLI

Accept the Marketplace terms once per subscription, create the VM, then open port 80.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:maxkey-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name maxkey \
  --image sac1647283583153:maxkey-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name maxkey --port 80 --priority 1010

Step 3 - Connect to your VM

Connect over SSH as azureuser.

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the stack is running

MaxKey runs as a Docker Compose stack managed by a single systemd unit. On first boot, the stack rotates every secret, re-seeds a fresh identity database, seeds the per-VM admin account and points its URLs at your VM's address. The multi-container stack can take a couple of minutes to become fully healthy after the VM is first created.

Check the services and the containers.

systemctl is-active maxkey.service docker.service docker compose -f /var/lib/maxkey/docker-compose.yml ps --format '{{.Name}}\t{{.Status}}'

All six containers should report Up.

Step 5 - Retrieve your per-VM admin credentials

The first boot writes a unique administrator password to a root-only file. Read the file over SSH.

sudo cat /root/maxkey-credentials.txt

The file records the console URL, the admin username and the generated password. It is mode 0600, owned by root.

Step 6 - Verify the login and that no default credential survives

The first boot rotates the built-in admin password away from MaxKey's shipped default and neutralizes every seeded demo account, so no known credential is ever live. Prove this from the shell. The per-VM password authenticates and returns a Bearer token, while the shipped default admin / maxkey is rejected.

B=http://127.0.0.1/maxkey-mgt-api
STATE=$(curl -s $B/login/get | python3 -c 'import sys,json;print(json.load(sys.stdin)["data"]["state"])')
curl -s -X POST "$B/login/signin?_allow_anonymous=true" -H 'Content-Type: application/json' \
  -d "{\"username\":\"admin\",\"password\":\"<MAXKEY_ADMIN_PASSWORD>\",\"authType\":\"normal\",\"state\":\"$STATE\",\"code\":\"\",\"otpCaptcha\":\"\"}"

A response with "code":0 and a token means the per-VM admin authenticated.

Step 7 - Confirm the pinned images and exposed ports

Confirm the pinned images and the exposed ports. The stack images are pinned to 4.1.12, and only SSH and HTTP are exposed on the VM. MySQL listens on the internal Docker network only, never on the host.

docker compose -f /var/lib/maxkey/docker-compose.yml images --format '{{.Repository}}:{{.Tag}}' | sort -u sudo ss -tlnp '( sport = :80 or sport = :22 )'

Step 8 - Sign in to the management console

Browse to http://<vm-public-ip>/maxkey-mgt/ and sign in as admin with the password from Step 5.

About the CAPTCHA field: This image ships with console CAPTCHA validation disabled so the console is usable out of the box. The sign-in form still shows a CAPTCHA box, and you can type any characters into it. To enforce a real CAPTCHA in production, set LOGIN_CAPTCHA=true in the maxkey and maxkey-mgt service environments in /var/lib/maxkey/docker-compose.yml, then run sudo systemctl restart maxkey.service.

After you sign in, you land on the dashboard. It summarizes your directory (organizations, users and registered applications) and recent access activity.

Step 9 - Register a single sign-on application

Open the Applications section to connect the apps your users log in to. MaxKey supports OAuth 2.0 / OIDC, SAML 2.0, CAS, JWT and form-based sign-on. Choose Add, pick the protocol your application speaks, and fill in its redirect URI or metadata.

Your users then reach that application from the end-user portal without signing in again.

Step 10 - Manage identities

Open Identities to manage the organizations, users and groups that make up your directory. Create your own users here (the seeded demo accounts ship with their passwords disabled), organize them into departments and groups, and assign application access.

MaxKey can also synchronize identities from LDAP or Active Directory and over SCIM 2.0.

Step 11 - Production hardening

• TLS: The appliance serves plain HTTP on port 80. For production, place it behind your own domain and a TLS-terminating load balancer or reverse proxy. Update SERVER_DOMAIN in /var/lib/maxkey/.env to that host name, then run sudo systemctl restart maxkey.service so single sign-on redirect URLs use it.
• CAPTCHA: Re-enable console CAPTCHA validation as described in Step 8 for internet-facing deployments.
• SAML signing keystore: MaxKey ships a default SAML IdP keystore. Before you enable any SAML relying-party integrations, replace the keystore and its password with your own, so SAML assertions are signed with a key unique to you.
• Backups: The identity database lives in the maxkey_mysql_data Docker volume. Include it, and /var/lib/maxkey/.env (which holds your per-VM secrets), in your backup routine.

Managing the service

# Restart the whole stack
sudo systemctl restart maxkey.service
# Stop / start
sudo systemctl stop maxkey.service
sudo systemctl start maxkey.service
# Follow logs for a component docker compose -f /var/lib/maxkey/docker-compose.yml logs -f maxkey-mgt

Support

Every SecureAnyCloud image is backed by 24/7 support. If you have any questions about this MaxKey image, contact us at sales@secureanycloud.com.

Deploy on Azure

Launch MaxKey on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com