Traccar GPS Tracking 6.16.0

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Traccar GPS Tracking 6.16.0 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2.

Choose m5.large, your key pair and a security group as above. The m5.large size handles a small to medium fleet. For hundreds of devices reporting at short intervals, choose a larger instance and a larger root volume.

Or launch with the AWS CLI. Replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=traccar}]'

For Traccar GPS Tracking 6.16.0 on Ubuntu 24.04, the SSH user is ubuntu. Connect with your key pair:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes about a minute. It creates the database, generates the certificate and the administrator password, and only then lets nginx start. After that, every unit is active:

systemctl is-active postgresql@16-main traccar nginx traccar-firstboot

active active active active

Traccar runs on Ubuntu's own OpenJDK package, so unattended-upgrades keeps the JVM patched along with the rest of the system. Check the Java version:

java -version 2>&1 | head -2

openjdk version "21.0.12.1" 2026-08-18 OpenJDK Runtime Environment (build 21.0.12.1+1-1-24.04.4-Ubuntu)

Run the port check to list every port reachable from outside the instance:

sudo /usr/local/sbin/traccar-port-check.sh

off-box TCP exactly [22 80 443]; Traccar web on loopback 8082; PostgreSQL socket-only TRACCAR_PORTS_OK

That is the complete network surface of a new instance: SSH, the HTTPS front door and the HTTP redirect. Traccar's own web server listens on loopback, and PostgreSQL has no TCP listener at all. No device protocol is listening yet:

sudo traccar-protocols list

no device protocol is enabled (the default)

First boot writes this instance's URL, the administrator login and its password to a root-only file. Read it with:

sudo cat /root/traccar-credentials.txt

# Traccar GPS Tracking 6.16.0 on Ubuntu 24.04 (sac)
# Generated on this instance's first boot. These credentials are unique to THIS instance. TRACCAR_URL=https://<public-dns-name>/ TRACCAR_ADMIN_USER=admin TRACCAR_ADMIN_PASSWORD=<TRACCAR_ADMIN_PASSWORD> ...

None of these values exists in the image. Your instance's first boot creates the password, the certificate and the database.

Open the TRACCAR_URL from Step 5 in a browser. The certificate is self-signed and unique to your instance, so the browser warns on the first visit. Step 10 shows how to use your own DNS name and certificate.

Sign in as admin with the password from Step 5. A new instance has no devices, so the map is empty until you add one.

You can run the same checks from the command line. First, confirm that self-registration is closed:

curl -sk https://127.0.0.1/api/server \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({k: d[k] for k in ("registration","readonly","deviceReadonly")}, indent=2))'

{ "registration": false, "readonly": false, "deviceReadonly": false }

Then make a real sign-in through the front door. The command reads the password from your credentials file and passes it to curl on standard input, so it never appears on a command line:

sudo sed -n 's/^TRACCAR_ADMIN_PASSWORD=//p' /root/traccar-credentials.txt | tr -d '\n' \
  | curl -sk -c /tmp/traccar.jar -X POST -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode "email=admin" --data-urlencode "password@-" https://127.0.0.1/api/session \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({k: d[k] for k in ("name","login","email","administrator")}, indent=2))'

{ "name": "Administrator", "login": "admin", "email": "admin@localhost", "administrator": true }

Every tracker identifies itself by a unique identifier, usually its IMEI (printed on the device or returned by an SMS status command). Register the identifier first. Traccar refuses positions from identifiers it does not know, so an unregistered device cannot inject data into your fleet.

In the web interface, choose Settings, Devices, then +. Give the device a name and enter its identifier. Or use the API with the session from Step 6:

curl -sk -b /tmp/traccar.jar -X POST -H 'Content-Type: application/json' \
  --data '{"name":"My first tracker","uniqueId":"123456789012345"}' https://127.0.0.1/api/devices \
  | python3 -c 'import json,sys; d=json.load(sys.stdin); print(json.dumps({k: d[k] for k in ("id","name","uniqueId","status")}, indent=2))'

{ "id": 1, "name": "My first tracker", "uniqueId": "123456789012345", "status": "offline" }

Traccar supports more than two hundred device protocols, each on its own port. This image enables none by default, because every protocol listener is unauthenticated by design. The device identifier is the only credential. Enable exactly the protocols your hardware uses.

Traccar's device list gives the protocol name and the conventional port for every supported tracker. Common ones are osmand on 5055 (the official Traccar Client app for Android and iOS), teltonika on 5027 and gt06 on 5023. For example, enable the osmand protocol:

sudo traccar-protocols enable osmand 5055

traccar-protocols: osmand enabled on port 5055. Now open 5055 (TCP, and UDP if your trackers use it) in the instance's security group to your trackers' addresses.

The command checks the name against the protocols this Traccar build implements, writes the configuration and restarts Traccar. The restart signs out any open web and API sessions.

Now send a test position for the device from Step 7, from the instance itself. This is the same request the Traccar Client app makes:

curl -s -o /dev/null -w '%{http_code}\n' "http://127.0.0.1:5055/?id=123456789012345&lat=51.5074&lon=-0.1278&speed=12&timestamp=$(date -u +%s)"

200

Run the network check again. It now lists the new port and nothing else:

sudo /usr/local/sbin/traccar-port-check.sh

off-box TCP exactly [22 80 443 5055]; Traccar web on loopback 8082; PostgreSQL socket-only TRACCAR_PORTS_OK

Then open the port in the instance's security group. Ideally, allow only the address ranges your trackers or your mobile operator's APN report from:

aws ec2 authorize-security-group-ingress --group-id <your-security-group> \
  --ip-permissions 'IpProtocol=tcp,FromPort=5055,ToPort=5055,IpRanges=[{CidrIp=<tracker-cidr>}]'

In the Traccar Client app, set the server URL to http://<public-dns-name>:5055 and the device identifier to the value you registered. Positions start arriving within a minute, and the device turns Online on the map.

Select a device to see its status card with fix time, position, speed and total distance.

To turn a protocol off again, run sudo traccar-protocols disable <name> and remove its security group rule.

Choose Reports in the navigation. Positions lists every stored fix. Trips and Stops group them into journeys and dwell time. Summary and Chart aggregate distance, engine hours and speed. Pick a device and a period, then select Show.

You can get the same data through the API. Enabling a protocol in Step 8 restarted Traccar, which signs every session out, so sign in again first:

sudo sed -n 's/^TRACCAR_ADMIN_PASSWORD=//p' /root/traccar-credentials.txt | tr -d '\n' \
  | curl -sk -o /dev/null -w '%{http_code}\n' -c /tmp/traccar.jar -X POST -H 'Content-Type: application/x-www-form-urlencoded' \
  --data-urlencode "email=admin" --data-urlencode "password@-" https://127.0.0.1/api/session

200

curl -sk -b /tmp/traccar.jar "https://127.0.0.1/api/positions" \
  | python3 -c 'import json,sys; print(json.dumps([{k: p[k] for k in ("deviceId","latitude","longitude","speed")} for p in json.load(sys.stdin)][:1], indent=2))'

[ { "deviceId": 1, "latitude": 51.5074, "longitude": -0.1278, "speed": 12.0 } ]

The full API reference is at traccar.org/api-reference. When you have finished, remove the cookie jar with rm -f /tmp/traccar.jar.

Point a DNS name at the instance. An Elastic IP keeps the address stable. Then tell the instance its name. This regenerates the self-signed certificate for the name, pins nginx and the cross-origin guard to it, and sets the address Traccar uses in notification and report links:

sudo traccar-set-hostname <your-domain>

To use a certificate from a public authority, issue it for the same name, for example with certbot and a DNS challenge. Install it where nginx expects it, then reload nginx:

sudo install -o root -g root -m 0600 /etc/letsencrypt/live/<your-domain>/privkey.pem /etc/ssl/traccar/traccar.key
sudo install -o root -g root -m 0644 /etc/letsencrypt/live/<your-domain>/fullchain.pem /etc/ssl/traccar/traccar.crt
sudo nginx -t && sudo systemctl reload nginx

Running traccar-set-hostname again replaces the certificate with a self-signed one. Repeat the two install commands after it, and in your certificate renewal hook.

Self-registration is disabled, so nobody who finds your instance can enrol themselves. Add users from Settings, Users, +, or through the API as the administrator:

curl -sk -b /tmp/traccar.jar -X POST -H 'Content-Type: application/json' \
  --data '{"name":"Dispatcher","email":"dispatch@example.com","password":"<new-password>"}' \
  https://127.0.0.1/api/users

Grant each user access to specific devices from Settings, Users, then Show next to the user. Leave Admin off for everyday accounts.

If you deliberately want open enrolment, turn it on in Settings, Server, Registration. Do not do this on an instance reachable from the internet unless you intend anyone to be able to create an account.

The image carries the checks it was built with. The administrator password works through the front door. Traccar refuses admin/admin, blank and common passwords. Self-registration is closed, and the session cookie is Secure, HttpOnly and SameSite. Run the login check:

sudo /usr/local/sbin/traccar-verify-login.sh

per-instance credential authenticates as administrator (200); admin/admin and weak passwords refused (401), blank refused (400) self-registration closed (anonymous POST /api/users -> 400); cookie Secure+HttpOnly+SameSite TRACCAR_LOGIN_OK

A caller cannot forge the address Traccar records for a sign-in. The check compares a request through nginx with one sent straight to Traccar:

sudo /usr/local/sbin/traccar-xff-check.sh

through nginx Traccar recorded [127.0.0.1], not the forged [203.0.113.77]; the direct control recorded [203.0.113.77] TRACCAR_XFF_OK

Traccar, nginx and PostgreSQL are denied the instance metadata service at the kernel level:

systemctl show -p IPAddressDeny traccar nginx postgresql@16-main

IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32 IPAddressDeny=169.254.169.254/32 fd00:ec2::254/128 168.63.129.16/32

Everything Traccar stores (devices, users, positions, geofences, reports) is in the traccar PostgreSQL database. Uploaded media is in /opt/traccar/media. Dump the database as the postgres operating system user (peer authentication, no password):

sudo -u postgres pg_dump -Fc traccar > <backup-dir>/traccar-$(date +%F).dump
sudo tar czf <backup-dir>/traccar-media-$(date +%F).tar.gz /opt/traccar/media /etc/traccar-sac

To restore onto a new instance, stop traccar.service. Restore with sudo -u postgres pg_restore --clean --if-exists -d traccar <dump>, put the media back and start the service.

Keep the dumps off the instance, for example in Amazon S3, or snapshot the EBS volume.

The image records the upstream release, archive checksum, licence and runtime it was built from. Read the provenance file:

cat /usr/share/doc/traccar-sac/BUILD-PROVENANCE.txt

Traccar 6.16.0 - https://github.com/traccar/traccar/releases/tag/v6.16.0 Archive: traccar-other-6.16.0.zip sha256 87be9347090248747cf31ff00a554d59c28e50d1d41d1f68f7f16957976bde55 Licence: Apache-2.0 (LICENSE.txt at v6.16.0, byte-identical to v6.15.3) Removed from lib/: h2, mysql-connector-j, mssql-jdbc, mariadb-java-client (unused JDBC drivers) Runtime: openjdk-21-jre-headless (Ubuntu noble main); datastore PostgreSQL 16 (Ubuntu noble main), cluster created on each instance's first boot (socket only, peer authentication, no password).