Seal Report

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a comfortable starting point.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network for SSH and 80/tcp for the Web Report Server. Seal reaches your databases over their own outbound ports, so no other inbound port is required.

The web interface is served over plain HTTP on port 80. For production, terminate TLS in front of it with your own domain (see Maintenance).

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure portal, choose Create a resource, search the Marketplace for Seal Report by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Choose Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:seal-report-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name seal-report \
  --image sac1647283583153:seal-report-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_ed25519.pub \
  --vnet-name <your-vnet> --subnet <your-subnet> \
  --public-ip-sku Standard
az vm open-port --resource-group <your-rg> --name seal-report --port 80 --priority 1010

Step 3 - Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4 - Confirm the services are running

systemctl is-active seal-report.service nginx.service

Both report active. Seal Report serves its Web Report Server on the loopback address 127.0.0.1:5000, and nginx fronts it on port 80. Because Seal is bound to loopback, it is never reachable directly from the network. The only public path is nginx.

active active

Step 5 - Retrieve your admin login

Your VM generates a unique Seal Report administrator password on first boot and writes it to a root-only file. Read the file:

sudo cat /root/seal-report-credentials.txt

This file contains SEAL_REPORT_URL, SEAL_REPORT_ADMIN_USER (which is admin) and SEAL_REPORT_ADMIN_PASSWORD. The administrator password signs you in to the Web Report Server. Store it somewhere safe.

Step 6 - Confirm the login round trip from the command line

Before you open a browser, you can verify the appliance end to end. The unauthenticated health endpoint answers without a credential, a blank (anonymous) login is refused, and the shipped self-test signs in with the real per-VM password:

curl -s http://127.0.0.1/healthz

ok

curl -s -X POST --data-urlencode "user=" --data-urlencode "password=" http://127.0.0.1/SWILogin

The anonymous login is rejected, which shows that authentication is enforced:

{"error":"Invalid user name or password","authenticated":false}

sudo /usr/local/bin/seal-report-selftest

OK

Step 7 - Sign in to the Web Report Server

Open http://<vm-public-ip>/ in a browser. Seal Report presents a login prompt, and there is no anonymous access. Enter admin and the password from your credentials file.

After you sign in, the report explorer opens. The folder tree is on the left and the reports of the selected folder are on the right.

Step 8 - Explore the sample reports

Expand Reports, then Samples, to see the bundled example reports: charts, cross tabs, gauges, cards, data tables and more. Select a report to open it, then choose Execute to render it.

The samples are a quick way to confirm that the server renders reports and to learn the report model before you point Seal at your own databases.

Step 9 - Review the data sources

Select the Sources node to see the data sources the repository ships with, including the bundled offline Northwind sample and connection templates for SQL Server, PostgreSQL, MySQL, Oracle, SQLite and MongoDB. From here you connect Seal to your own databases and build your metadata model.

To add a new source and design new reports, use the Seal Report Server Manager and Report Designer (the Windows design tools) against this repository, or edit the repository files directly.

Step 10 - Review the security posture

You can confirm the hardening at any time. Only the admin login exists (the shipped demo logins are gone), the server runs as the unprivileged seal user, and the runtime is the Ubuntu-native ASP.NET Core 10 shared framework:

grep -oE "<Id>[a-z]+</Id>" /var/lib/seal/Repository/Security/Security.xml | sort -u

<Id>admin</Id>

ps -o user= -C dotnet | sort -u

seal

Maintenance

Change the administrator password. The password is stored as a salted hash in /var/lib/seal/Repository/Security/Security.xml. To rotate it, generate a new hash with the shipped helper, then restart the service:

sudo /usr/local/sbin/seal-report-set-admin-password.py \
  /var/lib/seal/Repository/Security/Security.xml '<your-new-password>'
sudo chown seal:seal /var/lib/seal/Repository/Security/Security.xml
sudo systemctl restart seal-report.service

Update /root/seal-report-credentials.txt to match, and keep it safe.

Terminate TLS for production. The Web Report Server is served over plain HTTP on port 80. For production, place your own TLS certificate in front of it. For example, get a certificate for <your-domain> from your CA or from Let's Encrypt via certbot, and proxy HTTPS to http://127.0.0.1:5000. Alternatively, add a server block for <your-domain> to the nginx site at /etc/nginx/sites-available/sac-seal-report.

Operating system and runtime updates. The base image is patched at build time and ships with unattended security upgrades enabled. The ASP.NET Core 10 runtime is the Ubuntu-native package, so it receives security updates from the OS.

Reports, data sources and security settings live under /var/lib/seal/Repository. Back up that directory.

Service management. Use these commands:

systemctl status seal-report.service --no-pager

sudo journalctl -u seal-report.service -n 50 --no-pager

Support

SecureAnyCloud backs every image with 24/7 support and a guaranteed 24 hour response SLA. Contact sales@secureanycloud.com with the offer name and your VM details.

Seal Report is open source software distributed under the MIT License. The SecureAnyCloud charge covers packaging, hardening, security patching, image maintenance and support.

Deploy on Azure

Launch Seal Report on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Connecting to your instance

Connect over SSH on port 22 with the key pair you selected at launch. On Ubuntu 24.04, the login user is ubuntu:

ssh -i <your-key.pem> ubuntu@<instance-public-ip>

Prerequisites

You need an AWS account, an EC2 key pair in the target Region, a VPC with a subnet, and a security group. m5.large (2 vCPU / 8 GiB RAM) is a good starting point.

Seal Report serves its web interface on port 80, so allow inbound 22/tcp (SSH) and 80/tcp (HTTP) from your management network. Add 443/tcp if you terminate TLS at the instance (see Adding TLS below).

Launching the instance

From the AWS Marketplace console

• Open the Seal Report listing on AWS Marketplace and choose Continue to Subscribe, then Continue to Configuration.
• Select the Region and the Seal Report on Ubuntu 24.04 delivery option, then choose Continue to Launch.
• Choose an instance type (m5.large recommended), your key pair, a subnet, and a security group that allows 22/tcp and 80/tcp. Then launch.

From the AWS CLI

aws ec2 run-instances \
  --image-id <seal-report-ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <sg-allowing-22-and-80> \
  --subnet-id <your-subnet> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=seal-report}]'

Find the AMI id for your Region on the listing's launch page. Alternatively, subscribe and copy it from EC2, then AMIs, then Private images once the subscription is active.

Retrieving the administrator password

Each instance generates its own administrator password on first boot and writes it, with the web URL, to a root-only file. First boot takes a minute or two after the instance reaches the running state. Read the file over SSH:

sudo cat /root/seal-report-credentials.txt

The file shows the per-instance values. The password is unique to your instance:

SEAL_REPORT_URL=http://<instance-public-ip>/ SEAL_REPORT_ADMIN_USER=admin SEAL_REPORT_ADMIN_PASSWORD=<SEAL_REPORT_ADMIN_PASSWORD>

Verifying the services

Confirm that the report server and the reverse proxy are both active:

systemctl is-active seal-report.service nginx.service

active active

The report server is bound to loopback and nginx serves the public port 80:

sudo ss -tlnp | grep -E ':80|:5000' | sed -E 's/users:.*//'

LISTEN 0 512 127.0.0.1:5000 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 511 [::]:80 [::]:*

The unauthenticated health endpoint served by nginx returns ok. Use it for a load balancer probe. It never touches Seal Report and needs no credential:

curl -s http://127.0.0.1/healthz

ok

Signing in to the Web Report Server

Open http://<instance-public-ip>/ in your browser. The Seal Report login page appears. Sign in with the user name admin and the password from the credentials file.

After you sign in, the report explorer opens. The folder tree of report categories is on the left and the reports in the selected folder are on the right.

The image ships the standard Seal Report sample repository, so you can explore example reports right away under Reports, then Samples.

Executing a report

Open a folder such as Reports, then Samples, then 02-LINQ. Double-click a report, for example 201-LINQ Samples, to execute it.

The Web Report Server runs the report against its data source and renders the result in the browser, with tabbed views and grouped result tables. You can then export the same result as HTML, PDF, Excel, CSV, JSON or XML from the report menu.

From here you can create your own data sources (SQL and NoSQL), design reports and dashboards with LINQ and Razor, and schedule report execution and distribution from the web interface.

Security model

This image is secure by default:

• No shared or default credential. A stock Seal Report demo repository ships a security script that lets a blank user name sign in anonymously, a hardcoded backdoor account, and a set of demo logins. This image removes all of them and defines a single administrator in a full-rights group.
• Unique per-instance password. The administrator password is generated on each instance's first boot and hashed into the configuration exactly the way Seal Report stores passwords (PBKDF2-HMAC-SHA256). Nothing usable is baked into the image, so no two deployments share a credential.
• Loopback-only report server. The Web Report Server binds 127.0.0.1:5000 and is never network-exposed directly. The only public path is the nginx reverse proxy on port 80, which first boot brings up last, only after the administrator password is set. No unauthenticated instance is ever exposed.

You can verify that the login is enforced with the shipped self-test. It checks that anonymous and wrong-password logins are refused, and that the real password authenticates and lists the report folder tree:

sudo /usr/local/bin/seal-report-selftest

OK

An anonymous login attempt through the proxy is refused:

curl -s -X POST --data-urlencode "user=" --data-urlencode "password=" http://127.0.0.1/SWILogin

{"error":"Invalid user name or password","authenticated":false}

Adding TLS

Seal Report is served over plain HTTP on port 80 by default. For production, terminate HTTPS in front of it using one of these options:

• At a load balancer. Put an Application Load Balancer (or CloudFront) in front of the instance, attach an ACM certificate, and forward to port 80. Restrict the instance security group so that only the load balancer can reach port 80.
• At the instance. Add a TLS server block to the nginx configuration in /etc/nginx/sites-available/sac-seal-report with your certificate, and open 443/tcp in the security group.

Support

SecureAnyCloud provides 24/7 technical support for this product by email and live chat, covering deployment, connecting data sources, designing reports and dashboards, scheduling, reverse proxy and TLS, sizing, and upgrades.

Email: sales@secureanycloud.com

Deploy on AWS

Launch Seal Report with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com