Osclass

Prerequisites

Before you deploy, make sure you have:

• An active Azure subscription
• An SSH key pair
• A VNet and subnet in the target region
• A VM size to start with. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Size up for busier marketplaces or larger photo libraries.
• NSG inbound rules that allow 22/tcp from your management network and 80/tcp for the public marketplace

Osclass serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Osclass by SecureAnyCloud, and select Create.

• On Basics, pick your subscription, resource group, region and size.
• Under Administrator account, choose SSH public key and paste your key.
• Under Inbound port rules, allow SSH (22) and HTTP (80).
• On the Disks tab, review the dedicated data disk.
• Select Review + create, then select Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:osclass-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name osclass \
  --image sac1647283583153:osclass-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the public marketplace:

az vm open-port --resource-group <your-rg> --name osclass --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx, PHP FPM and MariaDB are all active. MariaDB listens only on 127.0.0.1:3306, while nginx serves Osclass on port 80.

systemctl is-active nginx php8.3-fpm mariadb osclass-firstboot

sudo ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own Osclass administrator password on first boot. It writes the password, along with the login user, the public site URL and the admin panel URL, to a root-only credentials file. Read the file with sudo:

sudo cat /root/osclass-credentials.txt

You sign in to the administration panel as user admin, with the OSCLASS_ADMIN_PASSWORD from this file. The address recorded in the file is the one the VM can see for itself. If you assigned a public IP address or a DNS name, browse to that instead.

On the VM itself, you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the administration panel

Browse to http://<vm-public-ip>/oc-admin/. You land on the Osclass administration sign-in page. Enter username admin and the password from Step 4.

After you sign in, you land on the dashboard. It summarizes listings by category and site statistics, with the full admin menu down the left-hand side.

Step 6 - Set up your marketplace

Before you take your first ad, set up the basics:

• Open Settings > General to set your site name, contact e-mail and time zone.
• Open Settings > Categories to trim the seeded category tree down to the categories you actually want.
• Open Appearance to pick and configure the theme.
• Open Pages to edit the static pages (about, terms, contact) that appear in the footer.
• To review ads before they go live, turn moderation on under Listings > Settings.

Step 7 - Publish and manage listings

Ads reach your site in two ways. Visitors use Publish your ad for free on the public site, and you can post directly from Listings > Manage listings with the green plus button. Every listing carries a title, description, category, price, location and photos. The management grid shows published ads with their status, category, location and expiry, and gives you edit, delete and bulk actions.

Published listings appear immediately on the public marketplace, where visitors browse and filter them by keyword, city, price range and whether they have photos.

Opening an ad shows the full listing with its price, location, description and a contact form that sends an enquiry to the seller.

Step 8 - No known or default credentials

The image ships exactly one Osclass account, the administrator, and it carries a unique per-VM secret generated on first boot. No known or blank password authenticates. The web installer is bound to the loopback interface, so nobody can reach it from the network to re-run setup.

You can prove the credential model with the built-in round-trip check. It confirms that the per-VM administrator signs in through Osclass's own login form, while a blank password and common weak guesses are all rejected:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(s_username,' (administrator account, bcrypt hash)') FROM osclass.oc_t_admin"

sudo bash /usr/local/sbin/osclass-cred-roundtrip.sh

Step 9 - Verify the stack and where your data lives

Confirm the Osclass version, the health endpoint and the dedicated data disk. The MariaDB database lives on the data disk mounted at /data (bind-mounted onto /var/lib/mysql). Every listing photo your users upload lives on the same disk. All of your marketplace content is therefore kept separate from the operating system disk and moves with the VM:

sed -nE "s/.*OSCLASS_VERSION', *'([^']+)'.*/Osclass \1/p" /var/www/osclass/oc-includes/osclass/default-constants.php; php -v | head -1

curl -sI http://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data;
findmnt -no SOURCE,TARGET /var/lib/mysql

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, set your own address by fronting Osclass with your domain and a TLS certificate. Osclass builds its links from the request host, so when you reach it through your domain, the public and admin URLs follow automatically with nothing to edit. You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain.

Security notes

• Osclass serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS-terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through Osclass or over SSH.
• The administrator password is unique per VM, and no known or blank credential authenticates. Keep /root/osclass-credentials.txt protected and change the password from within Osclass if you share access.
• The Osclass web installer is restricted to the loopback interface, and Osclass itself refuses to re-run setup once the site is installed.
• nginx never executes PHP under the user upload directory, and denies web access to config.php, the SQL seed files and the private content directories.
• Restrict inbound 80/tcp in your NSG to the networks that need the marketplace, and enable listing moderation if your site is open to the public.

Trademark

Osclass is maintained by the Mindstellar community. SecureAnyCloud provides this image as an independent packaging of the free, GPL-3.0-licensed Osclass distribution. It is not affiliated with, sponsored by, or endorsed by the Osclass or Mindstellar projects.

Support

This image is maintained by SecureAnyCloud with 24/7 support. If you need help deploying or operating Osclass on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch Osclass on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com