Orthanc

Prerequisites

• An Azure subscription
• The Azure CLI, if you deploy from the command line
• An SSH key pair
• Standard_B2s (2 vCPU, 4 GB) suits evaluation and small archives. For production volumes, give Orthanc more vCPU and a larger data disk.

Step 1 - Deploy from the Azure Marketplace

Search the Azure Marketplace for Orthanc on Ubuntu 24.04 LTS by SecureAnyCloud. Select Create and work through the wizard. Choose SSH public key authentication with the username azureuser.

On the Networking tab, allow inbound SSH (22) and HTTP (80). You also need 4242 for DICOM. Read Step 9 before you open it to the internet.

Step 2 - Deploy from the Azure CLI

az group create --name orthanc-rg --location eastus
az vm create \
  --resource-group orthanc-rg \
  --name orthanc-vm \
  --image sac1647283583153:orthanc-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group orthanc-rg --name orthanc-vm --port 80 --priority 1001
# Accept the image terms once per subscription:
az vm image terms accept --urn sac1647283583153:orthanc-ubuntu-24-04:default:latest

Step 3 - Connect to your VM

ssh azureuser@<vm-ip>

Step 4 - Confirm the services are running

Three units make up this image. orthanc-firstboot.service generates your unique administrator password, orthanc.service is the DICOM server itself, and nginx.service is the front door on port 80. Run:

systemctl is-active orthanc orthanc-firstboot nginx

All three report active:

active active active

Orthanc's HTTP server listens on loopback only, and nginx serves port 80. The DICOM server listens on all interfaces, because that is the point of a DICOM server. Check the listeners:

sudo ss -ltnp | grep -E ':80 |:4242 |:8042 '

LISTEN 127.0.0.1:8042 users:(("Orthanc",pid=52879,fd=7)) LISTEN 0.0.0.0:80 users:(("nginx",pid=52886,fd=5)) LISTEN 0.0.0.0:4242 users:(("Orthanc",pid=52879,fd=6))

Step 5 - Retrieve your administrator password

Your password was generated on this VM at first boot and written to a root-only file. Read it with:

sudo cat /root/orthanc-credentials.txt

The file records your URL, username and password, plus your DICOM AE title and port:

ORTHANC_URL=http://<vm-ip>/ ORTHANC_ADMIN_USERNAME=admin ORTHANC_ADMIN_PASSWORD=<your unique password> ORTHANC_DICOM_AET=ORTHANC ORTHANC_DICOM_PORT=4242 ORTHANC_DICOM_HOST=<vm-ip>

You can rotate the password at any time, to a new random value or to one you choose:

sudo orthanc-passwd

Step 6 - Open Orthanc Explorer

Browse to http://<vm-ip>/ and sign in with admin and the password from Step 5. Orthanc Explorer opens on the patient list. A fresh server is empty until you send it something, which you do in Step 7.

Step 7 - Send your first study over DICOM

The image ships a small synthetic phantom study at /usr/share/orthanc/sample-dicom/ so you can prove your server works end to end immediately. It is procedurally generated geometry and contains no patient data of any kind.

First, check that the DICOM server answers a C-ECHO, the DICOM equivalent of a ping:

echoscu -aec ORTHANC localhost 4242 && echo "C-ECHO: association accepted"

C-ECHO: association accepted

Next, send the study with a real C-STORE, exactly as a modality would:

storescu -aec ORTHANC localhost 4242 /usr/share/orthanc/sample-dicom/*.dcm

Confirm the 12 instances arrived and were indexed:

PW=$(sudo sed -n 's/^ORTHANC_ADMIN_PASSWORD=//p' /root/orthanc-credentials.txt)
curl -s -u admin:$PW http://localhost/statistics | jq '{CountPatients,CountStudies,CountSeries,CountInstances}'

{ "CountPatients": 1, "CountStudies": 1, "CountSeries": 2, "CountInstances": 12 }

Refresh Orthanc Explorer to see the study. Select Patient, then Study, to see the two series that arrived.

Open a series to see every instance with its DICOM metadata. Select Preview this series to page through the decoded images.

When you are done with the phantom, delete it from Explorer with Delete this study, or delete it over the API.

Step 8 - Use the REST API

Everything Explorer does goes through the REST API, which uses the same credentials. Read the server identity:

PW=$(sudo sed -n 's/^ORTHANC_ADMIN_PASSWORD=//p' /root/orthanc-credentials.txt)
curl -s -u admin:$PW http://localhost/system | jq '{Name,Version,ApiVersion,IsHttpServerSecure,DicomAet,DicomPort}'

{ "Name": "sac Orthanc", "Version": "1.12.11", "ApiVersion": 30, "IsHttpServerSecure": true, "DicomAet": "ORTHANC", "DicomPort": 4242, "StorageCompression": false }

IsHttpServerSecure is Orthanc's own assessment of its configuration. It reports true here because authentication is explicitly enforced and no default credential exists. If it reported false, Orthanc Explorer would show a red Insecure setup banner on every page.

List what is stored:

curl -s -u admin:$PW "http://localhost/patients?expand" | jq -r '.[] | {PatientName:.MainDicomTags.PatientName, PatientID:.MainDicomTags.PatientID}'

{ "PatientName": "PHANTOM^SAC", "PatientID": "SAC-PHANTOM-001" }

The full API is documented in the Orthanc Book.

Step 9 - Confirm the security posture, and restrict the DICOM port

Everything on port 80 requires your password. An unauthenticated request is refused:

curl -s -o /dev/null -w 'unauthenticated: HTTP %{http_code}\n' http://localhost/system

unauthenticated: HTTP 401

The well-known default credential does not work either, because it does not exist on this image:

curl -s -o /dev/null -w 'default credential: HTTP %{http_code}\n' -u orthanc:orthanc http://localhost/system

default credential: HTTP 401

The DICOM port has no password. This is how the DICOM protocol works, not a choice this image made. DICOM identifies peers by AE title, not by password, so anyone who can reach port 4242 can send images to your server.

Treat network reachability as the access control. Restrict 4242 to your modalities:

az network nsg rule create \
  --resource-group orthanc-rg \
  --nsg-name orthanc-vmNSG \
  --name allow-dicom-from-modalities \
  --priority 1002 \
  --source-address-prefixes <modality-ip>/32 \
  --destination-port-ranges 4242 \
  --access Allow --protocol Tcp

Then register each modality with Orthanc so you can query and send to it. Open /etc/orthanc/orthanc.json in your editor and fill in the DicomModalities block, giving each modality a name, its AE title, its host and its port:

"DicomModalities" : { "ct-scanner" : [ "CT_AET", "192.168.1.50", 104 ] },

Restart Orthanc to apply it:

sudo systemctl restart orthanc

There is one deliberate exception to authentication. http://<vm-ip>/healthz is served by nginx itself and returns ok without credentials, so an Azure Load Balancer can probe the VM. It exposes no Orthanc data and stays available while Orthanc restarts.

curl -s http://localhost/healthz

ok

Step 10 - Put TLS in front of Orthanc

Orthanc uses HTTP Basic authentication, which sends your password on every request. Do not use it across an untrusted network without TLS. Point a DNS name at the VM, then install and run certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d orthanc.example.com

Certbot rewrites the nginx site in place and renews the certificate automatically. Your Orthanc configuration does not change.

Step 11 - Licence and corresponding source

Orthanc is free software under the GNU General Public License version 3 or later. The complete corresponding source for the binary in this image ships on the image, alongside the licence texts and a written offer. List them:

ls /usr/share/doc/orthanc/ /usr/share/orthanc/source/

/usr/share/doc/orthanc/: AUTHORS BUILD-INFO.txt COPYING COPYING.LGPL-framework NEWS WRITTEN-OFFER.txt cve-audit.txt /usr/share/orthanc/source/: Orthanc-1.12.11.tar.gz SHA256SUMS

BUILD-INFO.txt records the exact source, its checksum and the exact command used to compile it, so the build is reproducible. Print the header:

head -8 /usr/share/doc/orthanc/BUILD-INFO.txt

Orthanc 1.12.11 -- sac Azure Marketplace image Built: 2026-07-16T20:03:41Z Source: https://orthanc.uclouvain.be/downloads/sources/orthanc/Orthanc-1.12.11.tar.gz Source sha256: 1d1f8a9a71c831fa07155e9f88fdb22be8e5792e19fa6a27b9a62145fa822b66 Corresponding src: /usr/share/orthanc/source/Orthanc-1.12.11.tar.gz Patches applied: none (unmodified upstream release) Licence: GPL-3.0-or-later (core), LGPL-3.0 (OrthancFramework)

SecureAnyCloud applies no patches to Orthanc, so what you run is the unmodified upstream release. Nothing in this image or its support terms restricts the rights the GPL grants you over Orthanc itself.

Maintenance

Where your images live. The DICOM files and Orthanc's index are under /var/lib/orthanc/db. Back up that directory as a unit, with Orthanc stopped:

sudo systemctl stop orthanc
sudo tar czf /tmp/orthanc-backup.tar.gz -C /var/lib/orthanc db
sudo systemctl start orthanc

For anything beyond a small archive, attach an Azure data disk and point StorageDirectory and IndexDirectory in /etc/orthanc/orthanc.json at it, so your images are not on the OS disk.

Configuration. /etc/orthanc/orthanc.json holds the non-secret configuration. Your password lives separately in /etc/orthanc/credentials.json, so rotating it never touches the main file. Restart Orthanc after editing:

sudo systemctl restart orthanc

Logs. Read the most recent Orthanc log lines with:

sudo journalctl -u orthanc -n 50 --no-pager

Updates. The base OS takes Ubuntu security updates automatically through unattended-upgrades. That includes the OpenSSL, DCMTK, SQLite and boost libraries Orthanc links against, because this image links them from Ubuntu instead of bundling private copies.

Vulnerability report. The dependency scan performed when this image was built is recorded on the image. Read it with:

head -20 /usr/share/doc/orthanc/cve-audit.txt

Support

Commercial support is included with this image. Contact sales@secureanycloud.com.

• Orthanc Book
• Orthanc REST API reference
• SecureAnyCloud guides

Deploy on Azure

Launch Orthanc on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Architecture

• Reverse proxy: nginx on port 80, the only public web interface, with an unauthenticated /healthz endpoint
• DICOM server: Orthanc Type=simple systemd service running as user orthanc, HTTP bound to 127.0.0.1:8042
• DICOM SCP: listens on 0.0.0.0:4242 with AE title ORTHANC for C-ECHO / C-STORE from your modalities
• Index and storage: embedded SQLite database at /var/lib/orthanc/db, with no external database
• First boot: orthanc-firstboot.service creates the per-instance admin password before Orthanc starts

Orthanc's HTTP server binds to the loopback interface and is reverse-proxied by nginx, so only ports 22, 80 and 443 need an inbound rule in your security group. Port 4242 is deliberately left closed by default. You open it, scoped to your modality source IPs, as shown below.

Secure by default

Orthanc's packaged and Docker distributions are notorious for the well-known default credential orthanc/orthanc. This image ships with no credential at all. A unique administrator password is generated on the instance's first boot and written to a root-only file.

Until first boot completes, Orthanc is fail-closed. With authentication enabled and no registered user, every request is refused with HTTP 401.

HTTP authentication is set explicitly (AuthenticationEnabled: true), not left to Orthanc's insecure default behind a reverse proxy. The build proves the fail-closed posture before the image is captured.

Connecting to your instance

Connect over SSH on port 22 using the key pair you selected at launch. For the Ubuntu 24.04 variant, the SSH login user is ubuntu:

ssh -i /path/to/your-key.pem ubuntu@<public-ip>

Launching from the AWS Marketplace

• Subscribe to the product on AWS Marketplace and choose Launch through EC2.
• Pick an instance type. m5.large or larger is recommended.
• Select your key pair and a security group that allows inbound TCP 22 (SSH) and 80 (web UI) from your admin location. Add 443 if you plan to enable HTTPS.
• Launch the instance, then wait a minute for first boot to generate the per-instance credential.

You can also launch from the AWS CLI after you subscribe and accept the terms. Replace the AMI ID with the one shown on the Marketplace listing for your Region:

aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --region us-east-1

Retrieve the administrator password

The administrator password is generated on first boot and written to a root-only file. Read the file over SSH:

sudo cat /root/orthanc-credentials.txt

The file contains the admin username and the generated ORTHANC_ADMIN_PASSWORD. This value is unique to your instance and never leaves it.

Sign in to Orthanc Explorer

Browse to http://<public-ip>/ and sign in with username admin and the password from the credentials file. Orthanc Explorer is the built-in web UI. It is part of the GPL server core, not a separate plugin.

From the lookup page, search stored studies or select All studies to list everything. Select a study to open its series and individual DICOM instances. There you can preview images, send a study on to another modality, or anonymize it.

Verify the deployment

Run every command below over SSH on the instance itself. First, confirm the three services are active:

systemctl is-active orthanc.service orthanc-firstboot.service nginx.service

The nginx health endpoint is served without authentication so a load balancer can probe it while Orthanc restarts:

curl -s http://127.0.0.1/healthz

Confirm the fail-closed posture. An unauthenticated request to the REST API is refused with 401:

curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1/system

Now authenticate with the per-instance password and read the server identity. It reports Orthanc version 1.12.11. This snippet reads the password straight from the credentials file:

PW=$(sudo sed -n 's/^ORTHANC_ADMIN_PASSWORD=//p' /root/orthanc-credentials.txt | head -1)
curl -s -u admin:"$PW" http://127.0.0.1/system

Send images over the DICOM protocol

Orthanc listens for DICOM associations on port 4242 with AE title ORTHANC. Verify connectivity with a C-ECHO:

echoscu -aec ORTHANC 127.0.0.1 4242 && echo "C-ECHO OK"

The image ships a synthetic phantom study (pure geometry, no patient data). Push it with a C-STORE to prove the pipeline end to end:

storescu -aec ORTHANC 127.0.0.1 4242 /usr/share/orthanc/sample-dicom/phantom-01-001.dcm && echo "C-STORE OK"

The stored study is retrievable through the authenticated REST API and appears immediately in Orthanc Explorer:

PW=$(sudo sed -n 's/^ORTHANC_ADMIN_PASSWORD=//p' /root/orthanc-credentials.txt | head -1)
curl -s -u admin:"$PW" "http://127.0.0.1/patients?expand"

Restrict the DICOM port to your modalities

The DICOM protocol authenticates by calling AE title, not by password, so anyone who can reach port 4242 can send images. Port 4242 is closed in the default security group.

When you open it, scope it to your modality source IPs only, never 0.0.0.0/0:

aws ec2 authorize-security-group-ingress \
  --group-id sg-xxxxxxxx \
  --protocol tcp --port 4242 \
  --cidr <your-mgmt-cidr>

Enable HTTPS (optional)

TLS is not preconfigured. To terminate HTTPS at nginx with a free Let's Encrypt certificate, point a DNS name at the instance and open port 443. Then run certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

SecureAnyCloud support can assist with custom certificates or a load-balancer TLS setup.

Rotate the administrator password

You can rotate the admin password at any time. This updates the credential that Orthanc Explorer and the REST API accept:

sudo orthanc-passwd <new-password>

Open source and corresponding source

Orthanc's server core is licensed GPL-3.0-or-later and the Orthanc Framework it embeds is LGPL-3.0. SecureAnyCloud ships the exact unmodified upstream source it compiled, alongside the licences and a written offer, on the image itself. List the files:

ls -l /usr/share/doc/orthanc/

The WRITTEN-OFFER.txt file records the upstream origin and the build command. It also confirms that nothing in the SecureAnyCloud image or its support terms restricts the rights the GPL grants over Orthanc.

The compiled dependency CVE audit ships at /usr/share/doc/orthanc/cve-audit.txt.

Maintenance

• Operating system patches are delivered by Ubuntu's unattended-upgrades. They keep OpenSSL, DCMTK, boost and SQLite current because Orthanc links them dynamically.
• Data lives in the embedded SQLite index and storage tree under /var/lib/orthanc/db. Back it up with the Orthanc REST API or a filesystem snapshot of the volume.
• Service management uses systemctl for orthanc, orthanc-firstboot and nginx.
• Modalities are configured in /etc/orthanc/orthanc.json under DicomModalities. Restart orthanc.service after editing.

Support

SecureAnyCloud provides 24/7 technical support for this Orthanc AMI by email and live chat. Support covers deployment, upgrades, DICOM modality connectivity, REST API integration, restricting the DICOM port, TLS termination and nginx configuration.

Critical issues receive a one-hour average response time. Email sales@secureanycloud.com.

Deploy on AWS

Launch Orthanc DICOM Server on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com