Openfire

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a reasonable starting size. Choose a larger size for more concurrent users and rooms.

Configure the network security group (NSG) to allow these inbound ports:

• 22/tcp from your management network
• 80/tcp for the admin console, plus 443/tcp if you add TLS
• 5222/tcp for XMPP clients
• 5269/tcp for server-to-server federation

The admin console is served over plain HTTP by default. For production, put your own domain and a trusted certificate in front of it (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Openfire by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create. After the VM is created, add inbound rules for 5222 (XMPP clients) and 5269 (federation).

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:openfire-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name openfire \
  --image sac1647283583153:openfire-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name openfire --port 80 --priority 1010
az vm open-port --resource-group <your-rg> --name openfire --port 5222 --priority 1020
az vm open-port --resource-group <your-rg> --name openfire --port 5269 --priority 1030

Step 3 - Connect to your VM

Connect over SSH as azureuser:

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

Check that Openfire and nginx are active and that the expected ports are listening:

systemctl is-active openfire.service nginx.service ss -tlnp | grep -E '5222|5269|9090'

Both services report active. Openfire listens on port 5222 for XMPP clients and on port 5269 for federation. The admin console listens only on the loopback address 127.0.0.1:9090, and nginx fronts it on port 80.

Step 5 - Retrieve your admin password

Each VM generates its own Openfire admin password on first boot and writes it to a root-only file. Read it with sudo:

sudo cat /root/openfire-credentials.txt

The file contains OPENFIRE_USERNAME (admin), OPENFIRE_PASSWORD and the admin console URL. It has mode 0600 and is owned by root, so only an administrator can read it. Store the password somewhere safe.

The embedded database that holds your users and rooms lives on the dedicated Azure data disk mounted at /var/lib/openfire.

Step 6 - Confirm the health endpoints

nginx serves an unauthenticated health endpoint for load balancers and probes, and it fronts the admin console login page. Request both:

curl -s http://localhost/healthz
curl -s -o /dev/null -w 'healthz HTTP %{http_code}\n' http://localhost/healthz
curl -s -o /dev/null -w 'login HTTP %{http_code}\n' http://localhost/login.jsp

/healthz returns ok with HTTP 200 and never requires authentication, so it is safe to use as an Azure Load Balancer health probe. The login page at /login.jsp returns HTTP 200. This confirms that the setup wizard was pre-completed and the server is ready for sign-in.

Step 7 - Verify authentication from the command line

The admin console uses a CSRF-protected login form. The check below fetches the login page to obtain the CSRF cookie. It then signs in with the correct per-VM password, which returns an HTTP 302 redirect to the dashboard. For contrast, it also tries a wrong password, which is rejected and re-renders the login page as HTTP 200.

The command embeds your unique password, so run it interactively rather than from a script. Replace <OPENFIRE_PASSWORD> with the value of OPENFIRE_PASSWORD from Step 5.

login() {
J=$(mktemp); curl -s -c "$J" -o /dev/null http://localhost/login.jsp
C=$(awk '$6=="csrf"{print $7}' "$J")
curl -s -b "$J" -o /dev/null -w "%{http_code}\n" \
  --data-urlencode "username=admin" --data-urlencode "password=$1" \
  --data-urlencode "csrf=$C" --data-urlencode "login=true" \
  --data-urlencode "url=/index.jsp" http://localhost/login.jsp rm -f "$J" } echo "correct password -> HTTP $(login '<OPENFIRE_PASSWORD>')" echo "wrong password -> HTTP $(login 'wrong')"

The correct per-VM password prints HTTP 302 (signed in, redirected to the dashboard). A wrong password prints HTTP 200 (rejected, the login page is shown again).

Step 8 - Sign in to the admin console

Browse to http://<vm-public-ip>/. The setup wizard was pre-completed on first boot, so you land directly on the Openfire admin console login page, never the setup wizard.

Enter admin as the username and the password from Step 5, then select Login.

Step 9 - Explore the server dashboard

After you sign in, the console opens on Server Information. This dashboard shows the server version, the XMPP domain, uptime, the Java runtime and the listening ports.

Use the tabs across the top to manage users and groups, sessions, group chat, server settings and plugins.

Step 10 - Manage users and groups

Open the Users/Groups tab to list existing accounts and create new ones. Select Create New User and enter a username and password. This creates a JID such as alice@localhost, and that user can sign in from any XMPP client.

Use groups to build shared rosters, so members automatically see one another.

Step 11 - Sessions and group chat

The Sessions tab lists the connected clients, so you can see who is online in real time.

The Group Chat tab manages your Multi User Chat service and rooms. Create persistent rooms, set their access and moderation, and monitor active conversations on your server.

Step 12 - Connect an XMPP client

Point any XMPP client (for example Gajim, Conversations, Dino, Spark or Pidgin) at your server. Sign in with a JID you created, such as alice@localhost, and the password you set.

Set the connection server or host to the VM's public IP address and use port 5222. The appliance offers STARTTLS on client connections. To chat between servers, Openfire federates over port 5269 (server to server).

Create group chat rooms from a client that supports Multi User Chat, or manage them from the admin console.

Step 13 - Confirm data lives on the dedicated disk

Openfire stores its data under /var/lib/openfire on the dedicated Azure data disk. This is the embedded database that holds your registered users, rooms, rosters and offline messages. Because it is on a separate disk, it survives OS changes and can be resized independently. Confirm the mount:

findmnt /var/lib/openfire

The mount is backed by a separate Azure data disk that is captured into the image and re-provisioned on every VM.

Maintenance

• Password: the admin password is set on first boot. To change it, sign in to the admin console and open Users/Groups -> admin -> Edit Properties, or reset it there.
• Serve a real domain: the default XMPP domain is localhost. For production, sign in to the admin console and open Server -> Server Manager -> System Properties (or Server Settings). Set your public domain, then configure DNS SRV records (_xmpp-client._tcp and _xmpp-server._tcp) for clients and federation.
• TLS and certificates: the appliance serves the admin console over plain HTTP on port 80, and Openfire generates a self-signed certificate for client STARTTLS. For production, point a DNS name at the VM and obtain a trusted certificate (for example with certbot and Let's Encrypt). Import it under Server -> TLS/SSL Certificates in the admin console, and front the console with nginx TLS on port 443.
• Chat rooms (MUC): Multi User Chat is enabled. Create and administer rooms from the Group Chat tab or an XMPP client. Rooms and their archives are stored in the embedded database on the data disk.
• Federation: server-to-server federation is enabled on port 5269. Open the port in your NSG to chat with users on other XMPP servers.
• Plugins: Openfire has a rich plugin ecosystem (REST API, monitoring, push and more). Install and manage plugins from the Plugins tab in the admin console.
• Storage: all Openfire state lives under /var/lib/openfire on the data disk. Back up that volume to protect your users, rooms and history.
• Security patches: unattended-upgrades stays enabled, so the OS keeps receiving security updates automatically.

Support

SecureAnyCloud provides 24/7 expert support for this image. For questions or help with your deployment, contact sales@secureanycloud.com.

Deploy on Azure

Launch Openfire XMPP Server on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com