Virtuoso Open Source

Search Azure Marketplace for Virtuoso, select the SecureAnyCloud publisher entry, then click Create.

Configure the network security group (NSG) to allow TCP 22 from your management IP and TCP 80 from your client IPs. The Virtuoso SQL server and HTTP server are bound to loopback, so only nginx on port 80 is exposed.

The Conductor authenticates with the dba account. For any deployment beyond a private network, put a TLS-terminating reverse proxy in front of port 80 so credentials and query traffic are encrypted in transit.

RG="virtuoso-prod"; LOCATION="eastus"; VM_NAME="virtuoso-01" IMAGE_URN="sac1647283583153:virtuoso-opensource:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION" az network vnet create -g "$RG" --name virtuoso-vnet --address-prefix 10.90.0.0/16 --subnet-name virtuoso-subnet --subnet-prefix 10.90.1.0/24 az network nsg create -g "$RG" --name virtuoso-nsg az network nsg rule create -g "$RG" --nsg-name virtuoso-nsg --name allow-ssh --priority 100 \
  --source-address-prefixes "<your-mgmt-cidr>" --destination-port-ranges 22 --access Allow --protocol Tcp az network nsg rule create -g "$RG" --nsg-name virtuoso-nsg --name allow-http --priority 110 \
  --source-address-prefixes "<your-client-cidr>" --destination-port-ranges 80 --access Allow --protocol Tcp
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:virtuoso-opensource:default:latest
az vm create -g "$RG" --name "$VM_NAME" --image "$IMAGE_URN" \
  --size Standard_B2s --admin-username azureuser --ssh-key-values "$SSH_KEY" \
  --vnet-name virtuoso-vnet --subnet virtuoso-subnet --nsg virtuoso-nsg --public-ip-sku Standard

Connect as the administrator account azureuser, using the SSH key you supplied at deployment:

ssh azureuser@<vm-ip>

Confirm that Virtuoso and nginx are running:

systemctl is-active virtuoso nginx

Both units report active. virtuoso.service runs the single virtuoso-t daemon, which hosts the SQL server and the HTTP server. nginx fronts the HTTP server on port 80.

Confirm that nginx owns the public port while Virtuoso stays on loopback:

sudo ss -tlnp | grep -E ':80 |:1111 |:8890 '

nginx listens on 0.0.0.0:80. The Virtuoso SQL server (1111) and HTTP server (8890) listen on 127.0.0.1 only, so they are reachable from the network only through nginx.

The per-VM secrets are generated at first boot and stored in a root-only file. Read it with sudo:

sudo cat /root/virtuoso-opensource-credentials.txt

The file lists the Conductor URL, the dba administration password, the SPARQL endpoint URL and the dav WebDAV password:

VIRTUOSO_CONDUCTOR_URL=http://<vm-ip>/conductor/ VIRTUOSO_SPARQL_URL=http://<vm-ip>/sparql VIRTUOSO_ADMIN_USER=dba VIRTUOSO_DBA_PASSWORD=<VIRTUOSO_DBA_PASSWORD> VIRTUOSO_DAV_USER=dav VIRTUOSO_DAV_PASSWORD=<VIRTUOSO_DAV_PASSWORD>

Next, confirm that the per-VM dba secret authenticates and that the shipped default credentials no longer work. The isql client is at /opt/virtuoso/bin/isql.

Run the positive check first. Virtuoso briefly locks the dba account after repeated bad logins, so always test the real password before the default one:

export LD_LIBRARY_PATH=/opt/virtuoso/lib
DBA=$(sudo grep '^VIRTUOSO_DBA_PASSWORD=' /root/virtuoso-opensource-credentials.txt | cut -d= -f2-) /opt/virtuoso/bin/isql 127.0.0.1:1111 dba "$DBA" exec="SELECT now();" /opt/virtuoso/bin/isql 127.0.0.1:1111 dba dba exec="SELECT 1;" 2>&1 | grep -m1 -o 'Bad login.*' || true

The per-VM dba secret runs the query, while the default dba/dba login is rejected with Bad login.

You can also query the database from the command line with the bundled isql client and the per-VM dba password. The sample DBA.DEMO_CUSTOMERS table returns three rows:

DBA=$(sudo grep '^VIRTUOSO_DBA_PASSWORD=' /root/virtuoso-opensource-credentials.txt | cut -d= -f2-) /opt/virtuoso/bin/isql 127.0.0.1:1111 dba "$DBA" \
  exec="SELECT ID, NAME, CITY FROM DBA.DEMO_CUSTOMERS ORDER BY ID;"

From your workstation, open http://<vm-ip>/conductor/. This requires the NSG to allow TCP 80. The Virtuoso Conductor login page appears.

Sign in with the account dba and the VIRTUOSO_DBA_PASSWORD from the credentials file:

After you sign in, open the Database tab and then the SQL Database Objects sub-tab. The Schema Objects browser lists the SQL catalogs. It also lets you create tables, views and procedures without writing DDL by hand:

Open Database, then Interactive SQL. Type a statement into the editor and click Execute. The result grid appears below. In this example, the sample DBA.DEMO_CUSTOMERS table returns three rows:

Virtuoso is also an RDF triplestore. Open the Linked Data tab and then the SPARQL sub-tab. Set the Default Graph IRI to http://sac.example/catalog, enter a SPARQL query and click Execute. The sample RDF graph returns its labelled resources:

The same endpoint is available programmatically at http://<vm-ip>/sparql. As in DBpedia, read-only queries are open without authentication. Updates require the dba account or a SPARQL update role.

The System Admin tab shows the server dashboard. It covers uptime, HTTP server request counters, database space allocation, the transaction log and connected clients.

Sub-tabs cover Security, User Accounts, the Scheduler, Parameters, the Registry, installed Packages and Backup:

The Virtuoso SQL / ODBC server is bound to loopback for safety. An application running on the same VM connects directly to 127.0.0.1:1111 with the dba user and the per-VM password. To reach the server from your workstation, forward the port over SSH rather than exposing it:

ssh -L 1111:127.0.0.1:1111 azureuser@<vm-ip>

Then point a local isql, ODBC or JDBC client at 127.0.0.1:1111.

For a production application tier, open TCP 1111 in the NSG restricted to your application subnets only. Prefer a TLS terminator in front of the Conductor on port 443.

virtuoso.service runs /opt/virtuoso/bin/virtuoso-t +configfile /etc/virtuoso/virtuoso.ini +foreground as the virtuoso user. virtuoso.ini binds ServerPort = 127.0.0.1:1111 (SQL) and HTTPServer ServerPort = 127.0.0.1:8890 (HTTP), so both accept only local connections.

virtuoso-opensource-firstboot.service is a oneshot that initialises a fresh per-VM database from the Conductor seed. It rotates dba to its per-VM secret offline with virtuoso-t +pwdold dba +pwddba ....

While Virtuoso still listens on loopback only, and before nginx starts, the service sets the dav password with USER_SET_PASSWORD. It re-keys every other built-in account to an unrecorded random value, seeds the sample content and proves the gate. It then writes the sentinel /var/lib/sac/data/virtuoso-opensource-firstboot.done.

nginx listens on port 80, serves an unauthenticated /healthz, and reverse proxies everything else to 127.0.0.1:8890. The database files live in /var/lib/virtuoso/db.

Check the status, restart the service and read recent logs with these commands:

systemctl status virtuoso
sudo systemctl restart virtuoso
sudo journalctl -u virtuoso -n 50 --no-pager

To tune memory for larger datasets, edit NumberOfBuffers and MaxDirtyBuffers in /etc/virtuoso/virtuoso.ini. Then run sudo systemctl restart virtuoso.

Keep the listeners on loopback. Do not change ServerPort in /etc/virtuoso/virtuoso.ini to a public address. nginx on port 80 is the only front door. Reach the SQL server on port 1111 only from the VM or over an SSH tunnel.

Add TLS. Put a TLS-terminating reverse proxy (or nginx with a certificate) in front of port 80 on port 443. This encrypts the dba password and query traffic in transit.

Restrict the NSG. Allow TCP 22 and TCP 80 only from the addresses that need them. If you must reach the SQL server from outside the VM, open TCP 1111 only to your application subnets.

Rotate secrets. The per-VM passwords in /root/virtuoso-opensource-credentials.txt are unique to this VM. To rotate the dba password from isql, run DB.DBA.USER_SET_PASSWORD('dba', '<new>'); and do the same for dav. Then update the credentials file.

Review the SPARQL endpoint. The /sparql endpoint answers read-only queries anonymously by design. If your data is not public, restrict access at the NSG or nginx layer, or remove the anonymous SPARQL read grant.

Virtuoso Open Source Edition is licensed under the GNU General Public License, version 2. This image bundles the unmodified official OpenLink Virtuoso 7.2.17 server and its Conductor console. The separate Virtuoso Enterprise Edition is a commercial product and is not included.

SecureAnyCloud provides the packaging, hardening and first-boot automation, plus 24/7 support with a 24-hour response SLA. This listing is not affiliated with or endorsed by OpenLink Software.

Deploy on Azure

Find Virtuoso Open Source Edition on Ubuntu 24.04 LTS on the Azure Marketplace by SecureAnyCloud, or visit secureanycloud.com for the full catalogue.

Need Help?

Email sales@secureanycloud.com for deployment help, SPARQL and SQL integration questions, or anything else. SecureAnyCloud support responds within 24 hours.

Deploy on Azure

Launch Virtuoso Open Source Edition on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com