OrientDB 3.2

Search the Azure Marketplace for OrientDB, select the SecureAnyCloud publisher entry, and select Create.

Configure the network security group to allow TCP 22 from your management IP and TCP 443 from your client IPs. No other port needs to be open, and no other port is listening.

RG="orientdb-prod"; LOCATION="eastus"; VM_NAME="orientdb-01" IMAGE_URN="sac1647283583153:orientdb-ubuntu-24-04:default:latest" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name odb-vnet \
  --address-prefix 10.90.0.0/16 --subnet-name odb-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name odb-nsg az network nsg rule create -g "$RG" --nsg-name odb-nsg --name allow-ssh \
  --priority 100 --destination-port-ranges 22 --access Allow --protocol Tcp \
  --source-address-prefixes "<your-ip>/32" az network nsg rule create -g "$RG" --nsg-name odb-nsg --name allow-https \
  --priority 110 --destination-port-ranges 443 --access Allow --protocol Tcp \
  --source-address-prefixes "<your-ip>/32"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:orientdb-ubuntu-24-04:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2ms --storage-sku StandardSSD_LRS \
  --admin-username azureuser --ssh-key-values ~/.ssh/id_rsa.pub \
  --vnet-name odb-vnet --subnet odb-subnet --nsg odb-nsg \
  --public-ip-sku Standard --location "$LOCATION"

ssh azureuser@<vm-ip>

First boot takes roughly 30 to 60 seconds after the VM reports running. Confirm that both units are active:

sudo systemctl is-active orientdb.service nginx.service

Expected output:

active active

To confirm that first boot ran on this VM, rather than inheriting state from the image, check its sentinel file and the log it writes:

test -f /var/lib/sac/data/orientdb-firstboot.done && echo "first boot completed on this VM"
sudo grep -E 'Generated per-VM|Per-VM TLS|Rotating the built-in|Password stripped' /var/log/sac/sac-firstboot.log

java -version 2>&1 | head -1

Expected output:

openjdk version "21.0.12" 2026-07-21

The OrientDB ports are bound to loopback, so only SSH and HTTPS are reachable from the network. List the listeners:

ss -lntH | awk '{for(i=1;i<=NF;i++) if($i ~ /:[0-9]+$/){print $i; break}}' | sort -u

Expected output:

0.0.0.0:22 0.0.0.0:443 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::ffff:127.0.0.1]:2424 [::ffff:127.0.0.1]:2480

Port 2424 is the OrientDB binary protocol and 2480 is its HTTP listener. Both show a loopback address. 127.0.0.53 and 127.0.0.54 belong to the systemd resolver, also on loopback. Only 22 and 443 are reachable from outside the VM.

Confirm that an unauthenticated request to the console is refused:

curl -sk -o /dev/null -w 'unauthenticated -> HTTP %{http_code}\n' https://127.0.0.1/listDatabases

Expected output:

unauthenticated -> HTTP 401

This image has no default password. The credential is generated on your VM at first boot and exists nowhere else. Read it with:

sudo cat /root/orientdb-credentials.txt

The file has mode 0600 and is owned by root. It contains ORIENTDB_ROOT_USER, ORIENTDB_ROOT_PASSWORD, the Studio URL and the name of the sample database. The same credential works in two places: the browser's HTTPS prompt and the OrientDB Studio login.

To keep the password out of your shell history and off process command lines, pass it to curl on standard input, as every example below does.

List the databases through the TLS gateway. The command needs -k because each VM uses its own self-signed certificate:

printf 'user = "root:<ORIENTDB_PASSWORD>"\n' | curl -sk -K - -w '\n' https://127.0.0.1/listDatabases

Expected output:

{"@type":"d","@version":0,"databases":["Demo"]}

The Demo database contains four Person vertices joined by four Knows edges. This query runs a two-hop graph traversal, not a join:

printf 'user = "root:<ORIENTDB_PASSWORD>"\n' | curl -s -K - -X POST --data-binary \
  "MATCH {class: Person, as: a, where: (name = 'Alice')}.out('Knows'){as: b}.out('Knows'){as: c} RETURN a.name, b.name, c.name" \
  http://127.0.0.1:2480/command/Demo/sql | python3 -m json.tool | head -9

Expected output:

{ "result": [ { "a.name": "Alice", "b.name": "Bob", "c.name": "Carol" } ],

The out() graph function follows edges directly:

printf 'user = "root:<ORIENTDB_PASSWORD>"\n' | curl -s -K - -X POST --data-binary \
  "SELECT name, out('Knows').name AS knows FROM Person ORDER BY name" \
  http://127.0.0.1:2480/command/Demo/sql \
  | python3 -c " import json, sys for r in json.load(sys.stdin).get('result', []): print(r['name'], '->', r['knows']) "

Expected output:

Alice -> ['Bob'] Bob -> ['Carol'] Carol -> ['Dave'] Dave -> ['Alice']

The same database also holds schema-less document records with nested embedded documents. No schema is declared for meta, yet you can query its fields directly:

printf 'user = "root:<ORIENTDB_PASSWORD>"\n' | curl -s -K - -X POST --data-binary \
  "SELECT title, meta.author AS author, meta.priority AS priority, tags FROM Note ORDER BY title" \
  http://127.0.0.1:2480/command/Demo/sql | python3 -m json.tool | head -12

Expected output:

{ "result": [ { "title": "Release plan", "author": "Alice", "priority": 1, "tags": [ "graph", "document" ] },

Browse to https://<vm-ip>/studio/index.html.

Your browser warns about the certificate because it is self-signed and generated on your VM. Accept it, or replace the certificate as described in Step 14. The browser then prompts for the HTTPS gateway credential. Enter user root and the password from Step 7.

On the Studio login form, choose database Demo, enter user root and the same password, and select CONNECT.

Open the SCHEMA tab to see the multi-model shape in one view. Person appears under Vertex Classes, Knows under Edge Classes, and Note, the schema-less document class, under Generic Classes.

On the BROWSE tab, paste the MATCH query from Step 9 and select RUN. The result table shows the traversal path.

On the GRAPH tab, enter SELECT FROM Person and select the play button. Studio renders the vertices and the Knows edges between them.

Guessable credentials are refused. The historic OrientDB defaults do not work on this image. The upstream distribution ships a sample database with live admin/admin, reader/reader and writer/writer accounts. The build removes it, so it never reaches the image. Upstream also creates the built-in guest account with a published fixed password, and the image rotates that password at first boot. Verify both:

printf 'user = "guest:!!!TheGuestPw123"\n' | curl -s -K - -o /dev/null \
  -w 'published guest default -> HTTP %{http_code}\n' \
  -X POST --data-binary 'SELECT 1' http://127.0.0.1:2480/command/Demo/sql printf 'user = "admin:admin"\n' | curl -s -K - -o /dev/null \
  -w 'admin/admin -> HTTP %{http_code}\n' \
  -X POST --data-binary 'SELECT 1' http://127.0.0.1:2480/command/Demo/sql

Expected output:

published guest default -> HTTP 401 admin/admin -> HTTP 401

The credential is not left in the service environment. First boot hands the password to the server as an environment variable. After the account is persisted into the OrientDB store, first boot removes the variable and restarts the server. Confirm that nothing remains:

if
sudo grep -q '^ORIENTDB_ROOT_PASSWORD=' /etc/default/orientdb; then echo "credential still present in the service environment" else echo "no credential in the service environment" fi

Expected output:

no credential in the service environment

SSH is hardened. Confirm the settings:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|clientaliveinterval) '

Expected output:

clientaliveinterval 120 permitrootlogin no passwordauthentication no

Kernel module mitigation. The image includes the Dirty Frag mitigation for CVE-2026-43284 and CVE-2026-43500:

sudo cat /etc/modprobe.d/dirtyfrag.conf

Expected output:

install esp4 /bin/false install esp6 /bin/false install ipcomp /bin/false install ipcomp4 /bin/false install ipcomp6 /bin/false install rxrpc /bin/false

If this VM must terminate IPsec, remove the esp4 and esp6 lines and run sudo update-initramfs -u. Leave the other lines in place.

Recommended hardening

• Restrict TCP 443 in the NSG to known client IP ranges, because Studio is a database administration console.
• Replace the self-signed certificate with one issued for a hostname you control. Put the certificate and key at /etc/ssl/sac-orientdb/server.crt and server.key, keep the key at mode 0600 and owned by root, and reload nginx.
• Create per-user OrientDB accounts for day-to-day work, and reserve root for administration.
• Take regular backups with /opt/orientdb/bin/backup.sh, and store them off the VM.

sudo systemctl status orientdb.service
sudo systemctl restart orientdb.service
sudo journalctl -u orientdb.service -n 100 --no-pager

The configuration lives in /etc/default/orientdb (JVM heap and paths) and /opt/orientdb/config/orientdb-server-config.xml (listeners). Databases are stored under /var/lib/orientdb/databases.

OrientDB Community Edition is distributed under the Apache License 2.0. The licence text shipped in the image is at /opt/orientdb/license.txt.

SecureAnyCloud packages and supports this image; SecureAnyCloud is not affiliated with, and this image is not endorsed by, the OrientDB project or its trademark holders. OrientDB is a trademark of its respective owner and is used here only to identify the software included.

For support, contact SecureAnyCloud through the Azure Marketplace listing. Response SLA is 24 hours, 24/7.

Deploy on Azure

Launch OrientDB 3.2 Multi-Model Database on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com