phpBB

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Choose a larger size for bigger or busier communities.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the board. phpBB serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for phpBB by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:phpbb-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name phpbb \
  --image sac1647283583153:phpbb-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the board:

az vm open-port --resource-group <your-rg> --name phpbb --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx, PHP FPM and MariaDB are all active. MariaDB listens only on 127.0.0.1:3306, while nginx serves the board on port 80.

systemctl is-active nginx php8.3-fpm mariadb phpbb-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own phpBB administrator password on first boot. It writes the password, the login user, the board URL and the Admin Control Panel URL to a root-only credentials file. Read it with sudo:

sudo cat /root/phpbb-credentials.txt

Sign in to the board as user admin with the PHPBB_ADMIN_PASSWORD from this file. On the VM itself, run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the board

Browse to http://<vm-public-ip>/. The board index opens with a category, a forum and a welcome topic already in place. Click Login in the top right, and sign in with username admin and the password from Step 4.

After you sign in, you return to the board index, where you can browse forums, read topics and start posting.

Step 6 - The Admin Control Panel

Signed in as the founder admin, open the Administration Control Panel link in the board footer. phpBB asks you to re-enter your password for security.

The ACP dashboard summarises your board at a glance, including the phpBB, PHP and database versions and board statistics. The tabs across the top (General, Forums, Posting, Users and Groups, Permissions, Customise, Maintenance, System) give you full control over every aspect of the board.

Step 7 - Read and post topics

From the board index, open a forum and then a topic to read and reply, or click New Topic to start one. The topic view shows the original post, the author panel and the Post Reply button.

Members can quote, edit, attach files and subscribe to topics. You can organise discussions into as many categories and forums as you need.

Step 8 - No known or default credentials

phpBB ships no default login. The SecureAnyCloud image goes further: the founder administrator account is created with a unique per-VM secret on first boot, and no known or blank password authenticates.

Prove this with the built-in round-trip check. It confirms that the per-VM administrator signs in through phpBB's own login form, while a blank password and common weak guesses are all rejected. First, confirm the founder admin account exists, then run the check:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(username,' (founder admin account)') FROM phpbb.phpbb_users WHERE username_clean='admin'"

sudo bash /usr/local/sbin/phpbb-cred-roundtrip.sh

Step 9 - Verify the stack and where your data lives

Confirm the phpBB version, the health endpoint, the dedicated data disk and the installed board content.

The MariaDB database lives on the data disk mounted at /data and bind-mounted onto /var/lib/mysql. phpBB's writable cache, store, attachments and avatar uploads live on the same disk. All of your board's content is therefore kept separate from the operating system disk and rides with the VM:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('phpBB ',config_value) FROM phpbb.phpbb_config WHERE config_name='version'"

curl -sI http://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data;
findmnt -no SOURCE,TARGET /var/lib/mysql

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. For production, set your own address. Front phpBB with your domain and a TLS certificate, then update Server name under General, Server settings in the Admin Control Panel. Enable Force server URL settings if needed.

You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain.

Security notes

• Encrypt web traffic. phpBB serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS-terminating reverse proxy or Azure Application Gateway with a certificate for your domain.
• Keep MariaDB private. The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through phpBB or over SSH.
• Protect the administrator password. The password is unique per VM, and no known or blank credential authenticates. Keep /root/phpbb-credentials.txt protected, and change the password from within phpBB if you share access.
• Block direct access to internals. phpBB's own recommended nginx rules deny direct web access to config, cache, store, attachment files, avatar uploads and private application paths.
• Restrict the NSG. Limit inbound 80/tcp to the networks that need the board.

Trademark

phpBB is a registered trademark of phpBB Limited. This image is an independent packaging of the open-source phpBB software by SecureAnyCloud. It is not affiliated with, sponsored by, or endorsed by phpBB Limited.

Support

This image is maintained by SecureAnyCloud with 24/7 support. For help deploying or operating phpBB on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch phpBB on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com