Termix 26.10.6

Option A: AWS Marketplace console

• Open the SecureAnyCloud Hardened WireGuard VPN & VPN, Proxy and Remote Access AMIs listing on AWS Marketplace. Choose View purchase options, then Subscribe. One subscription covers every version in the listing.
• Once the subscription is active, choose Launch your software.
• Choose One-click launch from AWS Marketplace (or Launch from EC2 Console for the full launch wizard). In Version, choose Termix 26.10.6 on Ubuntu 24.04, then choose your Region.
• Pick an instance type (m5.large is recommended) and your key pair.
• Configure the security group. The listing's default group allows SSH (22), HTTP (80) and HTTPS (443). Restrict SSH, and preferably 443, to your own addresses.
• Choose your VPC and a subnet with a route to the servers you will manage, and with a public IP if you browse to Termix over the internet. Leave the metadata defaults, because the image already requires IMDSv2. Then choose Launch.

Option B: AWS CLI

Run these commands on your own workstation. They create a security group that allows SSH and HTTPS from your management address, then launch the instance. Replace the AMI ID with the one shown for your Region on the Marketplace launch page. Replace the VPC, subnet, key pair and CIDR range with your own.

SG=$(aws ec2 create-security-group --group-name termix \
  --description "Termix" --vpc-id vpc-0123456789abcdef0 \
  --query GroupId --output text)
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 22 --cidr <your-mgmt-cidr>
aws ec2 authorize-security-group-ingress --group-id "$SG" --protocol tcp --port 443 --cidr <your-mgmt-cidr>
aws ec2 run-instances \
  --image-id ami-0123456789abcdef0 \
  --instance-type m5.large \
  --key-name my-key-pair \
  --security-group-ids "$SG" \
  --subnet-id subnet-0123456789abcdef0 \
  --associate-public-ip-address \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=termix}]'

You do not need --metadata-options, because the AMI already requires IMDSv2. First boot takes about a minute after the instance is running.

Connect as ubuntu with the key pair you chose:

ssh -i ~/.ssh/my-key-pair.pem ubuntu@<public-ip>

systemctl is-active termix nginx
sudo test -f /var/lib/sac/data/termix-firstboot.done && echo FIRSTBOOT_DONE

active active FIRSTBOOT_DONE

termix-firstboot ran once on the first boot. termix is the Termix backend, and nginx serves the web interface. Only SSH and nginx listen on network ports. Termix listens on the loopback address:

sudo ss -lntp | awk 'NR>1 {print $4}' | grep -v '127.0.0.5' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:30001 [::]:22 [::]:443 [::]:80

The URL and the administrator password are in a root-only file. Read it:

sudo cat /root/termix-credentials.txt

# Termix 26.10.6 - generated on first boot by termix-firstboot.service.
# Every value below is unique to this instance; nothing was baked into the image. Keep this file private.
# Web interface (HTTPS, self-signed certificate unique to this instance): sign in as admin with the password below,
# then change it (User profile -> Security). Self-registration is OFF; add users under Settings -> Users. TERMIX_URL=https://203.0.113.10/ TERMIX_ADMIN_USERNAME=admin TERMIX_ADMIN_PASSWORD=<your-password> TERMIX_HOST=203.0.113.10
# The certificate served on 443 (/etc/nginx/sac/tls/termix.crt), to compare with your browser's warning: TLS_CERT_SHA256=15:83:3A:...:4C # Self-test:
sudo termix-selftest Serve Termix under your own DNS name:
sudo termix-set-host <dns-name>
# Guide: https://secureanycloud.com/stacks/termix-26-10-6/

The URL uses the instance's public IPv4 address (its private address when it has no public one). Termix also answers on the instance's public DNS name.

Open TERMIX_URL in your browser. The certificate is self-signed, so the browser warns you once. Compare the fingerprint that the browser shows with TLS_CERT_SHA256 from the credentials file, then continue. Sign in as admin with TERMIX_ADMIN_PASSWORD.

On your first sign-in, Termix walks you through a four-step Set up your workspace wizard. The steps cover which plugins to keep on, the layout, the text size and language, and optionally a passkey or security key for two-factor sign-in. The recommended plugin set is pre-selected. Plugins that you turn off stay installed, and you can turn them on later from the plugin manager. You can change every wizard setting later.

Then change the password. Open User Profile (the avatar at the bottom left, or User Profile under Quick Actions on the dashboard). Consider adding two-factor authentication (TOTP or a passkey) there too.

• In the Hosts panel choose + Add Host.
• Enter a name, the server's address and SSH port, the user name, and either a password or a private key. Termix encrypts what you save with your own data key, which unlocks only while you are signed in.
• Save, then choose the terminal icon (>_) on the host's card. On the first connection, Termix shows the server's SSH host key fingerprint. Compare it with the server's own fingerprint (run ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub on that server) before you choose Accept & Continue. The file manager (SFTP) and host metrics are the other icons on the card and at the foot of the terminal.

Termix connects from this instance, so the servers you add must be reachable from its subnet and security group. Remote desktop (RDP, VNC and Telnet) uses Termix's built-in engine, so you need no separate guacd service.

Self-registration is off on this image in two places: the Allow registration setting is off, and the systemd drop-in /etc/systemd/system/termix.service.d/60-sac-registration.conf pins it off (ALLOW_REGISTRATION=false). Add users yourself under Admin Settings (Quick Actions on the dashboard), which manages users and roles. To check the setting, run this from the instance:

H=$(sudo sed -n 's/^TERMIX_HOST=//p' /root/termix-credentials.txt)
sudo curl -s --cacert /etc/nginx/sac/tls/termix.crt --resolve "$H:443:127.0.0.1" "https://$H/users/registration-allowed"; echo

{"allowed":false}

If you want open sign-up, remove the drop-in (sudo rm it, then run sudo systemctl daemon-reload and sudo systemctl restart termix) and turn the setting on in Termix. Anyone who can reach port 443 can then create an account, so restrict the security group first.

The Tunnels plugin runs SSH port forwards from this instance. A forward listens on 127.0.0.1 unless you choose another bind address. A forward bound to another address is reachable only after you open its port in the instance's security group. The default group opens 22, 80 and 443 only.

Point a DNS A record at the instance, then run the helper with your name:

sudo termix-set-host termix.example.com

This issues a new self-signed certificate for that name, updates nginx and the credentials file, and prints the new fingerprint. sudo termix-set-host with no name returns to the instance's own address.

To use a CA-issued certificate instead, put the certificate chain and key in /etc/nginx/sac/tls/termix.crt and /etc/nginx/sac/tls/termix.key (key mode 0600, owned by root), then run sudo nginx -t && sudo systemctl reload nginx. Do not add the self-signed certificate to your computer's trust store. Compare its fingerprint, or replace it.

Run the built-in self-test:

sudo termix-selftest

Termix 203.0.113.10: termix + nginx up, backend 127.0.0.1:30001 only, HTTPS OK, anonymous API refused, registration closed, IMDS denied SELFTEST_OK

Confirm that the server refuses an anonymous API request and that the backend port is not reachable from the network:

H=$(sudo sed -n 's/^TERMIX_HOST=//p' /root/termix-credentials.txt)
sudo curl -s -o /dev/null -w '%{http_code}\n' --cacert /etc/nginx/sac/tls/termix.crt --resolve "$H:443:127.0.0.1" "https://$H/host/db/host"
P=$(hostname -I | awk '{print $1}') timeout 5 bash -c "exec 3<>/dev/tcp/$P/30001" 2>/dev/null && echo "30001 OPEN" || echo "30001 refused"

401 30001 refused

Confirm that Termix and nginx are denied access to the instance metadata service:

systemctl show -p IPAddressDeny termix nginx

IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32 IPAddressDeny=fd00:ec2::254/128 168.63.129.16/32 169.254.169.254/32

Confirm that Termix's keys are root-only files and that its database is stored encrypted:

sudo ls -l /etc/termix/secrets | awk 'NR>1 {print $1, $3, $9}'
sudo ls /var/lib/termix

-rw------- root database_key -rw------- root encryption_key -rw------- root internal_auth_token -rw------- root jwt_secret backups db.sqlite.encrypted uploads

• Lost the admin password: on the sign-in page, choose Forgot Password?. Termix writes a reset code to its log on the instance. Read the code over SSH with sudo journalctl -u termix | grep -i reset.
• SSH to the instance is key-only: password and keyboard-interactive logins and root logins are disabled in /etc/ssh/sshd_config.d/00-sac.conf.
• Limit port 443 to the networks your users work from, because a Termix account opens shells on every server it holds.

Read the build information and the plugin list:

cat /usr/share/doc/termix/BUILD-INFO.txt | head -4 head -2 /usr/share/doc/termix/PLUGINS.txt

The main files and directories are:

• /opt/termix: Termix 26.10.6 (backend, plugins, web interface) and its Node.js runtime, read-only to the service.
• /var/lib/termix: Termix's data, which includes the encrypted database, uploads and its own upgrade backups.
• /etc/termix/secrets: this instance's four Termix keys (root only).
• /etc/nginx/conf.d/sac-termix.conf and /etc/nginx/sac/: the nginx server blocks, the route map and this instance's certificate.
• /usr/share/doc/termix/: the Apache-2.0 license, build information, the plugin list and the npm audit record.
• /root/termix-credentials.txt: the first-boot URL, administrator password and certificate fingerprint.

Back up /var/lib/termix and /etc/termix/secrets together, with Termix stopped (sudo systemctl stop termix). The database cannot be read without this instance's database_key, and saved credentials need encryption_key. Keep the backup as private as the keys themselves. As an alternative for moving hosts to another instance, use Termix's own data export and import (the Import and Export plugin, off by default).

Ubuntu security updates install automatically. To update Termix itself, move to a newer SecureAnyCloud version of this listing.

• Restrict ports 22 and 443 in the security group to your own networks.
• Change the administrator password on first sign-in and turn on two-factor authentication.
• Give each person their own Termix account, and do not share the administrator account.
• Install only the signed plugins you need (the image enforces signing).
• Replace the self-signed certificate with a CA-issued one for wider use.