Yopass

Find the Yopass on Ubuntu 24.04 LTS by SecureAnyCloud image in the Azure Marketplace and select Create.

Choose your subscription, resource group and region. Select a VM size (Standard_B2s or larger) and provide your SSH public key for the azureuser account.

On the Networking tab, allow inbound 443 and 80 from your users, and restrict 22 to your management network.

Select Review + create. When the VM is running, browse to https://<your-public-ip>/.

Run these commands to deploy the same image from the Azure CLI. Adjust the resource group, location and image URN as needed:

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:yopass-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-yopass-rg \
  --name yopass \
  --image sac1647283583153:yopass-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
# then open the required ports
az vm open-port --resource-group my-yopass-rg --name yopass --port 443 --priority 1001
az vm open-port --resource-group my-yopass-rg --name yopass --port 80 --priority 1002

SSH in as azureuser. Confirm that the three services are active, that Yopass and memcached are bound to loopback only, and that nginx is the only public listener:

sudo systemctl is-active yopass memcached nginx

ss -tln | grep -E ':1337 |:11211 |:80 |:443 '

The output shows yopass-server on 127.0.0.1:1337 and memcached on 127.0.0.1:11211, both loopback only. nginx listens on 0.0.0.0:80 and 0.0.0.0:443.

Browse to https://<your-public-ip>/. The certificate is self-signed and generated per VM, so your browser warns about it the first time. Accept the warning, or install your own certificate as described in Step 12.

The Encrypt message form opens. Type or paste your secret and choose how long it should live. Keep One time download and Generate decryption key enabled for the standard one-click flow.

Select Encrypt Message. Yopass encrypts the secret in your browser and stores only the ciphertext. It then shows a one-click link that you can share with the recipient.

The secret can be downloaded only once, so do not open the link yourself. A banner on the page reminds you of this.

When the recipient opens the link, Yopass decrypts the secret in their browser and displays it. A clear warning states that the secret will not be accessible again. This is the single permitted view.

Open the same link a second time. The secret has already been consumed and permanently deleted, so Yopass reports that it does not exist.

The image ships a self test that proves the self-destruct behaviour end to end over TLS. It creates a one-time secret through the API, reads it once (HTTP 200), then reads it again (HTTP 404). Run it with:

sudo /opt/yopass/yopass-selftest.sh

The output confirms the round trip: the first read returns 200 and the second returns 404.

Confirm that plain HTTP redirects to HTTPS and that the web UI answers over TLS. Then inspect the per-VM self-signed certificate:

curl -s -o /dev/null -w '%{http_code} -> %{redirect_url}\n' http://127.0.0.1/

curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/

sudo openssl x509 -in /etc/nginx/tls/yopass.crt -noout -subject -ext subjectAltName

The VM records the exact Yopass version and source commit built into the image, along with the per-VM appliance details. Read them with:

cat /opt/yopass/VERSION

sudo cat /root/yopass-info.txt

Yopass server. A single Go binary at /opt/yopass/yopass-server, run by yopass.service as the unprivileged yopass user and bound to 127.0.0.1:1337. It serves both the API and the web frontend from /opt/yopass/public.

memcached. Runs as memcached.service, bound to 127.0.0.1:11211, and holds only ciphertext with a fixed time to live. Yopass requires memcached, so yopass.service declares a dependency on it.

nginx. Runs as nginx.service. It terminates TLS on :443, reverse proxies to Yopass, redirects :80 to HTTPS, and serves an unauthenticated /healthz for load balancer probes.

First boot. yopass-firstboot.service runs once on first boot. It regenerates the per-VM self-signed TLS certificate, starts the services, proves the one-time round trip and writes /root/yopass-info.txt.

The image ships a self-signed certificate, so traffic is encrypted out of the box, but browsers warn about it. For production, point a DNS name at the VM and install a CA-signed certificate. With your own domain, you can obtain a free certificate from Let's Encrypt:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d <your-domain>

Certbot installs the certificate into nginx and sets up automatic renewal. Yopass builds share links from the host the browser used, so moving to your own domain needs no application configuration change.

Restart the service and read its recent logs with:

sudo systemctl restart yopass

sudo journalctl -u yopass.service --no-pager | tail -20

To change server options, such as the maximum secret length or forcing one-time secrets, edit the ExecStart line in /etc/systemd/system/yopass.service. Then run sudo systemctl daemon-reload && sudo systemctl restart yopass.

• Restrict SSH. Allow inbound 22 only from your management network. Keep 443, and 80 for the redirect, open to your users.
• Install a trusted certificate. Replace the self-signed certificate with a CA-signed one (Step 12), so recipients are not trained to click through browser warnings.
• Keep secrets short-lived. The shortest expiry that works for your recipients gives the smallest window of exposure. One time download is on by default.
• Send the link and the key separately when you use the short link form. Intercepting one channel is then not enough to reveal a secret.
• Keep the image updated. Unattended security upgrades remain enabled, so the OS keeps receiving patches.

Yopass is open source software distributed under the Apache License 2.0. This image bundles the upstream Yopass release unmodified; the licence and notice files are retained on the image under /opt/yopass/. SecureAnyCloud packaging, hardening and support are provided by SecureAnyCloud.

Deploy on Azure

Find this image on the Azure Marketplace and deploy it in minutes. See secureanycloud.com for the full catalogue.

Need Help?

SecureAnyCloud provides 24/7 support with a guaranteed 24 hour response SLA. Contact us through secureanycloud.com for deployment assistance, configuration help or any questions about this image.

Deploy on Azure

Launch Yopass on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com