Poweradmin

Search for Poweradmin in Marketplace, select the SecureAnyCloud publisher, and select Create. Configure the Network Security Group to allow TCP 80 for the control panel from your administrative networks, UDP 53 and TCP 53 for DNS from the clients and resolvers that will query the server, and TCP 22 for administration. DNS uses UDP 53 for most queries and falls back to TCP 53 for large responses and zone transfers, so open both. The PowerDNS REST API and the database stay on loopback and are never exposed.

RG="dns-prod"; LOCATION="eastus"; VM_NAME="ns1" IMAGE_URN="sac1647283583153:poweradmin-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:poweradmin-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 80 --priority 1001
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 53 --priority 1002
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1003

On first boot, the image generates every per-instance secret, creates the administrator account, provisions the demonstration zone, opens the bootstrap gate, starts the panel and the name server, checks that the new credentials work and the common defaults are rejected, and writes /root/poweradmin-credentials.txt. This completes within a minute or two. Connect over SSH as azureuser and read the details:

sudo cat /root/poweradmin-credentials.txt

The file has mode 0600 and is owned by root, so only a privileged user can read it. It contains the panel URL, the administrator user name and password, both database passwords and the PowerDNS API key.

All four services should report active. The ss output confirms that the control panel is on port 80 and DNS is on port 53 across all interfaces, while the PowerDNS API and MariaDB are bound to loopback only.

systemctl is-active mariadb.service pdns.service php8.3-fpm.service nginx.service pdns_server --version 2>&1 | grep -oE 'PowerDNS Authoritative Server [0-9.]+' | head -1 php -r 'echo "PHP ".PHP_VERSION."\n";' ss -tulnp | grep -E ':(80|53|8081|3306) ' | sed 's/users:.*//' | sort

Browse to http://<your-vm-public-ip>/ and sign in with the user name admin and the password from the credentials file. Poweradmin derives its own base URL from the address you reach it on, so the panel works on your VM's public IP, or behind a DNS name you point at it, without extra configuration.

After you sign in, the dashboard shows live counts of zones, records, users and groups, with tiles for zone management, zone operations and administration. The PowerDNS tile reports Online, which confirms that the panel is talking to the name server over the loopback REST API with the per-instance key.

You can check the same sign-in from the command line. The command uses the per-instance password from the credentials file to complete a real login through the form, then checks that the common default passwords are refused:

sudo /usr/local/sbin/poweradmin-login-check.sh admin '<POWERADMIN_ADMIN_PASSWORD>' && echo "per-VM password: ACCEPTED (correct)"
sudo /usr/local/sbin/poweradmin-login-check.sh admin 'admin' || echo "admin/admin: REJECTED (correct)"
sudo /usr/local/sbin/poweradmin-login-check.sh admin '' || echo "blank password: REJECTED (correct)"

After you sign in, set your own password. In the panel, open the Account menu in the top right and choose Password, or browse to /password/change. Enter the per-instance password from the credentials file as the current password and choose a new one.

Poweradmin stores passwords as bcrypt hashes at cost 12, so the new password cannot be recovered from the database. Once you have changed the password, the copy in /root/poweradmin-credentials.txt is out of date. Keep the file for the database passwords and API key, or remove the administrator password line from it.

Open Zones, then Forward zones. The image ships one demonstration zone, example.com, as a MASTER zone with five records, so the panel has real data to show from the moment you sign in.

Select the zone to open the record editor. The editor lists every record in the zone with its name, type, content, priority and TTL, each editable in place. An Add new record form sits above the list, and multi-record and bulk add modes handle larger changes.

The demonstration records use 203.0.113.10, an address reserved for documentation. Replace it with your own address.

Poweradmin writes directly into the same database that PowerDNS reads, and the image disables the PowerDNS zone cache refresh interval, so a change in the panel is served immediately. Query the name server directly to see the same records the panel showed you:

sudo mysql -t powerdns -e "SELECT name, type, content, ttl FROM records ORDER BY type" dig @127.0.0.1 example.com SOA +noall +answer dig @127.0.0.1 www.example.com A +noall +answer dig @127.0.0.1 example.com NS +short

To check from a client machine instead of the VM, query the public IP with dig @<your-vm-public-ip> www.example.com. The aa flag in the answer header confirms an authoritative answer.

In the panel, choose Zones, then Add master zone, and enter your domain. Poweradmin creates the zone with an SOA record and the name server records from its configured defaults. Add an A record for the apex and for www that points at your service address, then check the result with dig.

If you prefer to script the initial load, use the PowerDNS tooling directly from the command line. Both routes write to the same database, so a zone created either way appears in the panel:

sudo pdnsutil zone create <your-domain>
sudo pdnsutil rrset add <your-domain> @ A 3600 <your-service-ip>
sudo pdnsutil rrset add <your-domain> www A 3600 <your-service-ip>
sudo pdnsutil zone list <your-domain>

Substitute your own domain and service address for the example values. To inspect the existing demonstration zone instead, the same commands work against it:

sudo pdnsutil zone list example.com
sudo pdnsutil zone show example.com | head -12

Once your own zone is in place, you can delete the demonstration zone from the panel with the delete action in the forward zone list.

Poweradmin's permission templates let you hand out zone administration without handing over the whole server. Open Users, then Add user, and assign one of the shipped templates:

• Administrator: full rights over every zone, user and setting.
• Zone Manager: full management of their own zones, including creation, editing, deletion and templates.
• Editor: edits records in their own zones but cannot change SOA or NS records.
• Viewer: read-only access to their own zones, with search.
• Guest: no permissions, for accounts awaiting approval.

Group templates with the same names exist for Groups, so you can grant access to a team instead of to each person. Assign zone ownership per zone from the zone's Ownership button in the editor. Every user and zone change is written to the audit log, which you can review under the zone and user logs.

This appliance runs three services that all persist state, and all three are enabled so they survive a reboot. To make sure none of them can serve an instance whose credentials have not been generated, each carries a systemd condition on a bootstrap marker. First boot writes the marker only after every secret is in place:

grep -h ConditionPathExists /etc/systemd/system/{pdns,php8.3-fpm,nginx}.service.d/sac-bootstrap-gate.conf ls -l /var/lib/sac/data/ systemctl is-enabled pdns.service php8.3-fpm.service nginx.service

Ordering directives alone would not be enough. After= and Requires= control the order in which units start, but they still start a unit if the first boot service is slow or fails. The condition makes systemd skip the unit entirely instead. To take the appliance out of service deliberately, remove the marker and restart. The panel and the name server stay stopped until you put the marker back.

DNSSEC signing goes through the PowerDNS REST API, which the panel is already configured to use over loopback with the per-instance key. Open a zone in the panel and use the DNSSEC action to add a key and view the DS and DNSKEY records to give to your registrar.

The command-line equivalent is:

sudo pdnsutil zone show example.com | head -20

To sign a zone and read back the DS records for your registrar, run pdnsutil secure-zone and then pdnsutil show-zone on your own domain once it is in place.

To serve public DNS for your domain, set your registrar's name server records to point at this instance. You will normally want at least two name servers for redundancy. Use either a second instance of this image configured as a slave zone, or a third-party secondary DNS provider fed by zone transfer.

Set the name server names in the panel's zone records. Then, at your registrar, set the delegation to those names and provide glue records with this instance's public IP. Allow up to 48 hours for the change to propagate through the DNS hierarchy.

Change the administrator password immediately after your first sign-in, and enable multi-factor authentication for panel accounts under the Account menu.

Restrict TCP 80 to your administrative networks in the Network Security Group. The control panel is an administrative interface and does not need to be reachable from the internet, whereas port 53 does.

Put TLS in front of the panel before you expose it beyond a trusted network. Terminate HTTPS with a certificate for a name you control, either on this instance or on an Azure Application Gateway or Load Balancer in front of it, so panel credentials are never sent in clear text.

Keep the API and the database on loopback. The PowerDNS REST API (127.0.0.1:8081) and MariaDB (127.0.0.1:3306) are bound to loopback in the shipped configuration. Leave them that way on a single-instance appliance.

Use permission templates instead of shared administrator accounts, so each person's changes are attributable in the audit log.

Back up the database. It holds both your zone data and the panel's users and permissions, and a mysqldump of the powerdns database captures everything.

Keep unattended security upgrades enabled. The image configures them by default.

Poweradmin is distributed under the GNU General Public License version 3. PowerDNS Authoritative Server is distributed under the GNU General Public License version 2 with an OpenSSL linking exception, and MariaDB under the GNU General Public License version 2. This image bundles all three unmodified. The licence text for Poweradmin is at /var/www/poweradmin/LICENSE on the instance.

SecureAnyCloud provides 24/7 technical support for this image by email at sales@secureanycloud.com and by live chat, with a one-hour average response time for critical issues. Support covers deployment and first boot configuration, migrating existing zones into the panel, managing forward and reverse zones and records, user accounts and permission templates for delegated administration, multi-factor authentication, DNSSEC signing, zone transfers to secondary name servers, delegating your domain at your registrar, REST API automation, Poweradmin and PowerDNS version upgrades, and MariaDB administration.

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch Poweradmin 4.3.4 DNS Control Panel on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com