SamWaf

Prerequisites

• An active Azure subscription, an SSH key pair, and a VNet and subnet in the target region.
• Standard_B2s (2 vCPU / 4 GiB RAM) is ample. SamWaf is a single lightweight binary with an embedded database.
• NSG inbound rules that allow 22/tcp from your management network and 26666/tcp for the admin console.
• If you plan to protect sites on the standard web ports, also allow 80/tcp and 443/tcp.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for SamWaf by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and add a custom rule for 26666.

Review your choices, then choose Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:samwaf:default:latest
az vm create \
  --resource-group <your-rg> \
  --name samwaf \
  --image sac1647283583153:samwaf:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name samwaf --port 26666 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the service is running

systemctl is-active samwaf.service

This reports active. SamWaf runs as the unprivileged samwaf system user. Its database, configuration and logs are under /opt/samwaf.

Step 5 - Retrieve your administrator credential

The administrator account is generated uniquely on the first boot of your VM. SecureAnyCloud's first-boot automation has already completed the mandatory first-login password change. The final, ready-to-use credential is written to a root-only file:

sudo cat /root/samwaf-credentials.txt

The file shows the admin console URL, the username (admin) and the per-VM password. Keep this password safe, because it is the administrator password for your SamWaf instance.

Step 6 - Verify the credential round-trips end to end

The image ships a self-test. It proves that the per-VM admin login works, that an authenticated WAF-configuration API is reachable with the resulting session, and that a known legacy default password is rejected:

sudo /usr/local/sbin/samwaf-selftest.sh

The self-test logs in with the per-VM password from Step 5, calls the protected-host list API with the resulting session token, and confirms the legacy default password admin868 is refused.

Step 7 - Review the security posture

ps -o user= -p "$(systemctl show -p MainPID --value samwaf.service)"
sudo ss -lnt | grep -E ':26666|:80 |:443 '
sudo grep -c '^SAMWAF_ADMIN_PASSWORD=.\+$' /root/samwaf-credentials.txt

SamWaf runs as the unprivileged samwaf user, never as root. The admin console listens on 26666, and the credentials file holds a real generated password.

Step 8 - Sign in to the admin console

In your browser, go to http://<vm-public-ip>:26666/, then sign in as admin with the password from Step 5.

Step 9 - Define your first protected host

Once signed in, open Host Management and click Add Host. Give the protected host a domain name and point it at your backend (protocol, address and port), then save.

SamWaf immediately begins reverse-proxying and inspecting traffic for that host. The host appears in your host list on the dashboard.

From the same console you can define IP and URL allow and block lists, enable CC (rate-limit) protection, request an automatic ACME TLS certificate for the host, and review the attack log.

Step 10 - Review the attack log

Open Attack Log to see every request SamWaf has inspected and blocked for your protected hosts. Each entry shows the rule that matched, the source IP and a geo lookup.

Maintenance

Secure the admin console. By default, anyone who can route to the VM can reach the console on 26666. Restrict the NSG rule for 26666 to your management network's IP range rather than leaving it open to the internet. Consider also putting the console behind a VPN or bastion.

Back up your configuration. Everything SamWaf stores (protected hosts, rules, accounts and logs) lives in the embedded encrypted database under /opt/samwaf/data. Snapshot the OS disk from the Azure portal, or copy the directory while the service is stopped:

sudo systemctl stop samwaf.service
sudo tar czf /var/tmp/samwaf-data-backup.tgz -C /opt/samwaf data
sudo systemctl start samwaf.service

Reset your password if you lose it. SamWaf ships a CLI reset tool. It stops the service briefly, so run it during a maintenance window:

sudo systemctl stop samwaf.service
sudo -u samwaf /opt/samwaf/SamWafLinux64 resetpwd
sudo systemctl start samwaf.service

Update SamWaf. The admin console offers a one-click online upgrade under System. To upgrade from the command line instead, download the new release, verify its checksum and replace the binary:

sudo systemctl stop samwaf.service
# download + verify the new SamWafLinux64 release binary, then:
sudo install -m 0755 -o samwaf -g samwaf SamWafLinux64 /opt/samwaf/SamWafLinux64
sudo systemctl start samwaf.service

Review the upstream release notes before upgrading.

Support

SecureAnyCloud maintains this image with 24/7 support. If you need help deploying or operating SamWaf on Azure, contact SecureAnyCloud support through the Azure Marketplace listing.

SamWaf is an open source project (Apache-2.0). This image packages unmodified upstream SamWaf with SecureAnyCloud configuration and automation. It is not affiliated with or endorsed by the SamWaf project.

Deploy on Azure

Launch SamWaf Web Application Firewall on Ubuntu 24.04 LTS by SecureAnyCloud with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com