SecureAnyCloud
Deployment guide

Password Pusher

Overview

Password Pusher is an open source, self-hosted web application for sharing sensitive information securely and temporarily. A sender pushes a password, a block of text, a file or a URL and receives a one-time link. The link stops working automatically after a set number of views or a set number of days, whichever comes first, and every push is tracked with an audit trail.

It is a simpler, private alternative to emailing credentials or using a public paste service. This SecureAnyCloud image runs it on Ubuntu 24.04 on Azure, behind nginx with TLS.

The image builds the Password Pusher application reproducibly from source at build time. The exact version and source commit are recorded in /opt/passwordpusher/VERSION. The application is a Ruby on Rails app that runs under systemd on the puma web server as the unprivileged passwordpusher system user, bound to loopback only (127.0.0.1:5100).

What you get:

  • Password Pusher built from source and run under systemd on puma as the unprivileged passwordpusher system user
  • The application bound to loopback only (127.0.0.1:5100), never exposed directly to the network
  • nginx as the sole network-facing surface, terminating TLS on :443 and reverse proxying to Password Pusher, with HSTS and sensible security headers
  • Port :80 returning a 301 redirect to HTTPS for every path except an unauthenticated /healthz endpoint (HTTP 200) for load balancer probes
  • A self-signed TLS certificate regenerated per VM on first boot (SAN includes the VM public IP and hostname). Replace it with your own CA-signed certificate for production
  • A local SQLite database, with push payloads encrypted at rest using a per-VM key generated on first boot
  • A built-in one-time self-test at /opt/passwordpusher/passwordpusher-selftest.sh that proves the self-destruct behavior end to end over TLS
  • Ubuntu 24.04 LTS base with the latest security patches applied at build time
  • Azure Linux Agent for cloud integration and SSH key injection
  • 24/7 SecureAnyCloud support with a 24 hour response SLA

This appliance is anonymous by design. It ships with the login and signup system disabled, so there is no admin account and no credential of any kind is baked into the image. Pushing a secret needs no login.

The only per-instance secrets are generated on first boot for this specific VM and are never shared between instances:

  • The Rails session signing key (SECRET_KEY_BASE)
  • The database payload encryption key (PWPUSH_MASTER_KEY)
  • The self-signed TLS private key, whose Subject Alternative Names include the VM public IP, the hostname and 127.0.0.1

Prerequisites

  • An Azure subscription with permission to deploy virtual machines
  • An SSH key pair for administrative access to the VM as the azureuser account
  • A Network Security Group that allows inbound TCP 443 (HTTPS) and 80 (redirect) from the networks that should reach the service, and 22 (SSH) from your management network only
  • A VM size of Standard_B2s or larger (recommended)
1

Deploy from the Azure Portal

  • Find the Password Pusher on Ubuntu 24.04 LTS by SecureAnyCloud image in the Azure Marketplace and select Create.
  • Choose your subscription, resource group and region.
  • Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.
  • On the Networking tab, allow inbound 443 and 80 from your users, and restrict 22 to your management network.
  • Select Review + create. When the VM is running, browse to https://<your-public-ip>/.
2

Deploy from the Azure CLI

You can deploy the same image from the Azure CLI. Replace the resource group, location and image URN as needed:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:password-pusher-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-passwordpusher-rg \
  --name passwordpusher \
  --image sac1647283583153:password-pusher-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# then open the required ports
az vm open-port --resource-group my-passwordpusher-rg --name passwordpusher --port 443 --priority 1001
az vm open-port --resource-group my-passwordpusher-rg --name passwordpusher --port 80 --priority 1002
3

Verify the Password Pusher and nginx services

SSH in as azureuser. Confirm that both services are active, that Password Pusher is bound to loopback only, and that nginx is the only public listener:

sudo systemctl is-active passwordpusher nginx
sudo ss -tln | grep -E ':5100 |:80 |:443 '

You should see puma on 127.0.0.1:5100 (loopback only). nginx listens on 0.0.0.0:80 and 0.0.0.0:443.

4

Open the Password Pusher web interface

Browse to https://<your-public-ip>/. The certificate is self-signed and generated per VM, so your browser warns about it the first time. Accept the warning, or install your own certificate as described in Step 12.

The Push a Password form appears. Type or paste your secret, then set how long it lives with Expire After Days and Expire After Views.

5

Push a secret and get a one-time link

Select Push it!. Password Pusher stores the secret encrypted and shows a secret link that you can share with the recipient.

The page explains that the link expires after the configured number of views or days. Send the link to the recipient instead of opening it yourself.

6

Reveal the secret

When the recipient opens the link, Password Pusher displays the secret, with a note showing how many views remain before it expires. This opening counts as one view.

7

Confirm the secret expires

After the view limit is reached, open the same link again. The secret has been consumed, and Password Pusher reports that it has expired and is no longer available.

8

Verify the one-time behavior from the command line

The image ships a self-test that proves the self-destruct behavior end to end over TLS. It pushes a one-time secret through the JSON API, reads it once (returning the secret), then reads it again (returning expired, with no payload). Run it:

sudo /opt/passwordpusher/passwordpusher-selftest.sh

The expected output confirms the round trip: the first read returns the secret, and the second read reports that the push expired.

9

Confirm TLS and inspect the per-VM certificate

Confirm that plain HTTP redirects to HTTPS and that the web UI answers over TLS. Then inspect the per-VM self-signed certificate:

curl -s -o /dev/null -w '%{http_code} -> %{redirect_url}\n' http://127.0.0.1/
curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/
sudo openssl x509 -in /etc/nginx/tls/passwordpusher.crt -noout -subject -ext subjectAltName
10

Check the version and appliance info

The VM records the exact Password Pusher version and source commit built into the image, along with the per-VM appliance details. Read them with:

cat /opt/passwordpusher/VERSION
sudo cat /root/passwordpusher-info.txt
11

How the appliance is wired

  • Password Pusher: a Ruby on Rails application at /opt/passwordpusher/app, run by passwordpusher.service on the puma web server as the unprivileged passwordpusher user. It is bound to 127.0.0.1:5100 and serves both the web UI and the JSON API.
  • SQLite: a local database at /opt/passwordpusher/app/storage/db/production.sqlite3. Push payloads are encrypted at rest with a per-VM key. No external database is required.
  • nginx: nginx.service terminates TLS on :443 and reverse proxies to Password Pusher. It redirects :80 to HTTPS and serves an unauthenticated /healthz for load balancer probes.
  • First boot: passwordpusher-firstboot.service runs once on first boot. It generates the per-VM session and payload encryption keys, regenerates the per-VM self-signed TLS certificate, and starts the services. It then proves the one-time round trip and writes /root/passwordpusher-info.txt.
12

Use your own domain and a trusted certificate (production)

The image ships a self-signed certificate, so it is secure out of the box, but browsers warn about it. For production, point a DNS name at the VM and install a CA-signed certificate. If you have your own domain, you can obtain a free certificate from Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com

Certbot installs the certificate into nginx and sets up automatic renewal. Password Pusher builds share links from the host the browser used, so no application configuration change is needed when you move to your own domain.

13

Manage the Password Pusher service

Restart the service:

sudo systemctl restart passwordpusher

Read the most recent log lines:

sudo journalctl -u passwordpusher.service --no-pager | tail -20

To change application behavior, such as the default expiry or enabling accounts, edit the environment file /etc/passwordpusher/passwordpusher.env. Then run sudo systemctl restart passwordpusher. The Password Pusher documentation lists all PWP__ configuration variables.

14

Security recommendations

  • Restrict SSH. Allow inbound 22 only from your management network. Keep 443 (and 80 for the redirect) open to your users.
  • Install a trusted certificate. Replace the self-signed certificate with a CA-signed one (Step 12), so recipients are not trained to click through warnings.
  • Keep pushes short-lived. The shortest expiry that still works for your recipients gives the smallest window of exposure. Both a day limit and a view limit apply by default.
  • Keep the image updated. Unattended security upgrades remain enabled, so the OS keeps receiving patches.
  • Consider enabling accounts. The appliance ships anonymous by design. For per-user audit logs and dashboards, enable the login system in /etc/passwordpusher/passwordpusher.env, and choose a strong password when you create the first account.
15

Support and licensing

Password Pusher is open source software distributed under the Apache License 2.0. This image bundles the upstream Password Pusher release unmodified, and retains the licence file on the image under /opt/passwordpusher/. SecureAnyCloud provides the packaging, hardening and support.

Deploy on Azure

Find this image on the Azure Marketplace and deploy it in minutes. See secureanycloud.com for the full catalogue.

Need Help?

SecureAnyCloud provides 24/7 support with a 24 hour response SLA. Contact us through secureanycloud.com for deployment assistance, configuration help or any questions about this image.

Deploy on Azure

Launch Password Pusher on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure