Pandora FMS Community

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2ms (2 vCPU / 8 GiB RAM) is a sensible starting size. It gives Apache, PHP, MariaDB and the Perl monitoring server room to run comfortably. Step up to a larger size as you add monitored hosts.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the console. Also allow 443/tcp if you terminate TLS on the VM.

The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network. The Tentacle agent port 41121 is closed by default. Open it only when you want external agents to report in (see Step 7).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Pandora FMS by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:pandora-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name pandora \
  --image sac1647283583153:pandora-ubuntu-24-04:default:latest \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the console:

az vm open-port --resource-group <your-rg> --name pandora --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that Apache, PHP FPM, MariaDB, the monitoring server, the Tentacle server and the local agent are all active.

MariaDB listens only on 127.0.0.1:3306. Apache serves the console on port 80, and the Tentacle server listens on 41121. The /healthz endpoint answers 200 for load balancer probes.

systemctl is-active apache2 php8.3-fpm mariadb pandora_server tentacle_serverd pandora_agent_daemon curl -s -o /dev/null -w 'console -> %{http_code}\n' http://127.0.0.1/pandora_console/ curl -s -o /dev/null -w 'healthz -> %{http_code}\n' http://127.0.0.1/healthz ss -tln | grep -E ':(80|3306|41121) '

Step 4 - Retrieve the per-VM administrator password

On the first boot of every VM, a one-shot service generates a unique password for the Pandora admin administrator. It writes the password, together with the console URL, to a root-only file. The username is admin, and the password is unique to this instance. Read the file as root:

sudo cat /root/pandora-credentials.txt

Step 5 - Sign in to the console

Browse to http://<your-instance-ip>/pandora_console/ and sign in as admin with the password from Step 4.

The console home opens with live data from the appliance's own self-monitoring: server and database status, recent events and activity charts.

Step 6 - Check the monitoring server and self-monitoring

Open Management > Servers > Manage servers. The Pandora monitoring server threads (Data, Network, Discovery, Plugin, Inventory and Web servers) each report as running.

Open Operation > Monitoring > Views > Agent detail to see the appliance's own host being monitored. The self-monitoring agent reports dozens of modules (CPU, memory, disk, processes and more) with a recent last contact time. This confirms the full monitoring pipeline is live end to end.

Step 7 - Onboard external agents (optional)

The appliance monitors itself out of the box. To monitor other hosts, install a Pandora FMS agent on each host and point it at this server's IP on port 41121. Then open that port so agents can reach it, in the NSG and in the host firewall:

az vm open-port --resource-group <your-rg> --name pandora --port 41121 --priority 1010

sudo ufw allow 41121/tcp

Agentless checks (ICMP, SNMP, TCP) against network devices need no inbound port. Configure them entirely from the console under Management > Discovery and the agent and module wizards.

Security model

Pandora FMS ships a well-known default admin administrator credential (admin / pandora). This image never ships it. The build seeds a random per-build password, and the cleanup step rotates the shipped administrator password and API token to discarded random values. On the first boot of every VM, a fresh unique administrator password is generated and written to the root-only credentials file.

The check below confirms that the per-VM administrator authenticates through the real web login form, while the default, blank and common weak passwords are all rejected.

sudo bash /usr/local/sbin/pandora-cred-roundtrip.sh

The bundled MariaDB is bound to 127.0.0.1 only. The application-to-database password is generated per VM. The host firewall denies inbound traffic by default, apart from SSH and the console.

Versions

php -v | head -1 mariadb --version apache2 -v | head -1 systemctl is-active pandora-firstboot

Enabling HTTPS

For production, put the console behind TLS. The simplest approach is to add a DNS name for the instance and obtain a certificate with Certbot. Alternatively, terminate TLS at an Azure Application Gateway or Load Balancer in front of the VM.

If you terminate TLS on the VM, allow 443/tcp in the NSG and run sudo ufw allow 443/tcp. Then enable the Apache SSL site.

Support

This image is backed by 24/7 SecureAnyCloud support. For help with deployment, agent onboarding, SNMP and network monitoring, alerting and reporting, upgrades, performance tuning or MariaDB administration, contact sales@secureanycloud.com.

Deploy on Azure

Launch Pandora FMS Community on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com