Deployment guide

UUSEC WAF

Overview

UUSEC WAF (uuWAF) is an open-source, self-hosted web application firewall and reverse proxy. It combines a semantic detection engine, machine-learning anomaly detection and runtime application self-protection, so it recognises the intent behind SQL injection, cross-site scripting, command injection and path traversal while letting legitimate traffic through.

You put a protected site in front of your upstream server and point its domain at the WAF. Every request is inspected before it reaches your application: attacks get an interception page, and clean traffic is marked with a "Server: uuWAF" header. This SecureAnyCloud image installs UUSEC WAF 7.2.5 as the official Safe3/uusec-waf Docker Compose stack and runs it as a systemd service, so a working management console and WAF are online within minutes of launch.

What you get:

UUSEC WAF 7.2.5 (BSD-2-Clause) deployed from the official Safe3/uusec-waf Docker Compose stack, pinned to the uusec/waf:7.2.5 image so the appliance never silently upgrades
Docker Engine (Docker CE) and the Docker Compose plugin, installed from the official Docker package repository
A two-container Compose stack: uuwaf (the OpenResty/Nginx+Lua WAF engine and the Go management backend, binding the reverse proxy ports 80 and 443 and the management console on HTTPS port 4443) and wafdb (MySQL 5.7, the management database, reachable only on the loopback interface and the internal container network)
A per-VM admin console password: UUSEC WAF ships upstream with the shared default admin / #Passw0rd, and this image rotates that default away on first boot and confirms the default is rejected
Two systemd units: uusec-waf.service (a oneshot wrapper around docker compose up -d) and uusec-waf-firstboot.service
24/7 SecureAnyCloud support

Prerequisites

You need an active Azure subscription, an SSH key, and a VNet with a subnet. Standard_B2s (2 vCPU / 4 GB RAM) is the recommended size.

Configure these inbound network security group (NSG) rules:

22/tcp from your management CIDR, for SSH
4443/tcp from the CIDR that needs the UUSEC WAF management console
80/tcp and 443/tcp from the internet, for the web traffic you want the WAF to protect. The uuWAF reverse proxy binds ports 80 and 443 for the sites you add.

Connect over SSH

Connect to your VM as azureuser, the default login user. Replace <vm-ip> with the public IP of your VM.

ssh azureuser@<vm-ip>

Confirm the services are active

Check the Docker and UUSEC WAF services and print the installed versions.

sudo systemctl is-active docker uusec-waf docker --version docker compose version

The output shows active twice, then the Docker Engine version and the Docker Compose v2 plugin version.

Confirm the UUSEC WAF containers are running

List the Compose containers.

cd /opt/waf && sudo docker compose -f docker-compose.yml --env-file .env ps

Both containers should be in the Up / running state: uuwaf (the WAF engine and console) and wafdb (the MySQL database, reported healthy).

Confirm the management console is healthy

Request the console over HTTPS on port 4443. It uses a self-signed certificate, so the command passes -k to curl. A 200 response confirms the console is up.

curl -ks -o /dev/null -w "%{http_code}\n" https://localhost:4443/

Read the per-VM admin credentials

Read the unique admin password for your VM. UUSEC WAF ships upstream with a shared default console login (admin / #Passw0rd). This image rotates that default away on the first boot of every instance and writes the new admin password to a root-only file, so the default no longer works.

sudo cat /root/uusec-waf-credentials.txt

The file lists uusec-waf.url (where to sign in), uusec-waf.admin.user (admin) and uusec-waf.admin.pass. Store the password somewhere safe.

Sign in to the UUSEC WAF console

Browse to https://<vm-ip>:4443/. The console uses a self-signed certificate, so your browser warns once. Accept the warning to continue.

On the sign-in page, log in with the username admin and the uusec-waf.admin.pass value from Step 5. Leave the OTP field empty unless you later enable dynamic (one-time) passwords.

After you sign in, the dashboard summarises total visits, blocked attacks, live request metrics, the geographic origin of attack sources and current system resource usage.

For extra security, UUSEC WAF recommends creating a new administrator with a hard-to-guess name, deleting the default admin account, and enabling dynamic passwords. You can do all three from the console.

Protect your first web application

Open Site Security (Sites) in the console and choose Add Site. Enter the domain (or a match-all host) and the upstream address of your origin server with its scheme, for example 127.0.0.1:8080 or 10.0.0.4:3000.

The WAF reverse proxy on ports 80 and 443 then routes requests for that domain to your origin, inspecting every request first. Finally, point the domain's DNS A record at the public IP of the VM.

How UUSEC WAF blocks attacks

Once a site is protected, UUSEC WAF passes clean traffic straight through to your origin and intercepts attacks. A benign request returns your application's normal response with a Server: uuWAF header. An obvious SQL injection or cross-site scripting probe gets an HTTP 403 interception page and never reaches your origin.

The visitor who sends the malicious request sees the UUSEC WAF interception page, with the ID of the rule that matched. The blocked event is also logged and shown in the console.

Secure by default

The management console requires authentication and anonymous API calls are rejected. The MySQL database is bound to the loopback interface and the internal container network only, so it is never published on a public interface. Check which ports are exposed on the host at any time:

sudo ss -tlnp | grep -E ':80|:443|:4443|:6612' || true

The WAF proxy on 80 and 443 and the console on 4443 listen on all interfaces. MySQL on 6612 is bound to 127.0.0.1 only, so the database is not reachable from the network.

Manage the stack

The uusec-waf.service systemd unit manages the whole stack. It wraps docker compose under /opt/waf.

sudo systemctl restart uusec-waf.service
sudo systemctl status uusec-waf.service --no-pager

To read the logs of a specific service, run:

cd /opt/waf && sudo docker compose -f docker-compose.yml --env-file .env logs --tail 50 uuwaf

Enabling HTTPS on your own domain

The management console already serves HTTPS on port 4443 with a self-signed certificate. For the sites you protect, the WAF can terminate HTTPS for your application on port 443.

Add your own TLS certificate under Certificates in the console and bind it to the site. Alternatively, let UUSEC WAF apply for and auto-renew a free Let's Encrypt certificate. Make sure 443/tcp is in your NSG inbound rules.

First-boot security model

On the first boot of each VM, uusec-waf-firstboot.service runs once and does the following:

Regenerates the MySQL password and initialises a clean database, so no database or secret from build time ships in the image
Rotates the upstream default admin password (#Passw0rd) to a fresh, strong, per-VM value and writes it to /root/uusec-waf-credentials.txt (root-only, mode 0600), then confirms the default is rejected
Records a sentinel so the stack only starts once the credential has been rotated

No shared or default login and no pre-existing protected site ship in the image. The per-VM credential protects the management console from the moment it comes up.

Support

24/7 technical support is included. Contact SecureAnyCloud at sales@secureanycloud.com for help with deployment, protecting your applications, the semantic detection engine and custom rules, machine-learning and RASP defence, bot and CC attack protection, TLS certificates and custom domains, and the UUSEC WAF API.

UUSEC WAF and uuWAF are names of the open-source project by Safe3 (github.com/Safe3/uusec-waf), used here nominatively to identify the software this image packages. MySQL is a trademark of Oracle Corporation. Docker is a trademark of Docker, Inc. All other product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch UUSEC WAF 7.2.5 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure