ZenTao

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size for a small team. Move up to Standard_D2s_v3 for larger teams or heavy usage.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network, 80/tcp for the application, and 443/tcp if you terminate TLS on the VM. The bundled MariaDB listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

In the Azure portal, choose Create a resource. Search for ZenTao Project Management (ALM / Scrum) on Ubuntu 24.04 LTS by SecureAnyCloud, and select Create.

Pick your subscription, resource group and region, and choose the Standard_B2s size. Select SSH public key authentication with the username azureuser, and allow inbound 22, 80 and 443.

The image attaches its own 20 GiB data disk for your database and attachments, so you do not need to add one.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:zentao-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name zentao \
  --image sac1647283583153:zentao-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name zentao --port 80,443

Step 3 - Confirm the services are running

SSH in as azureuser. Confirm that Apache and MariaDB are active, then check the installed ZenTao version.

systemctl is-active apache2 mariadb

grep config->version /var/www/zentao/config/config.php

Step 4 - Confirm the network posture and health endpoint

Check the listening ports and the health endpoint. MariaDB is bound to 127.0.0.1:3306 only, while Apache serves ZenTao on port 80. The unauthenticated /healthz endpoint answers 200 for Azure Load Balancer probes. The site root redirects an unauthenticated visitor to the sign-in page.

ss -ltn 'sport = :3306 or sport = :80'

curl -s -o /dev/null -w 'healthz -> %{http_code}\n' http://127.0.0.1/healthz

Step 5 - Retrieve the per-VM administrator password

The first-boot service generates an administrator password that is unique to your VM and writes it to a root-only file. Confirm that the file exists (it is 0600 root), then read it over SSH:

ls -l /root/zentao-credentials.txt

sudo cat /root/zentao-credentials.txt

ZENTAO_URL is the VM's own address as seen from inside the VM. Azure does not expose the public IP to the instance, so this is usually the private address. Browsing to the public IP shown in the Azure portal works identically, because ZenTao derives its links from the request host rather than fixing one at build time.

Step 6 - Sign in

Browse to http://<vm-ip>/ and sign in with the username admin and the password from the credentials file.

After you sign in, you land on the My dashboard. The module sidebar runs down the left (Program, Product, Project, Execution, QA, DevOps, Kanban and Doc), and the top navigation covers Dashboard, Calendar, Work, Review and Contacts. The installed edition and version (ALM 21.7.1) appear at the bottom.

Step 7 - Create your first project

Open Project from the sidebar to reach the project list and Kanban. Select Create Project to start a Scrum, Kanban or waterfall project.

Then add products, requirements, tasks, bugs, test cases and releases from the corresponding modules. Everything is linked, so a requirement flows into tasks and test cases, and a bug can be tracked from report to resolution and release.

Step 8 - No known or default credentials

This image ships with no usable login. The administrator password set at build time is rotated to a random value that is discarded and never recorded. The first-boot service then sets a fresh password unique to your VM before ZenTao serves a single request.

The admin super administrator is the only account that can sign in. Run the check below to confirm that the per-VM password authenticates through the real ZenTao login form, while a blank password and common weak guesses are all rejected.

sudo bash /usr/local/sbin/zentao-cred-roundtrip.sh

After your first sign-in, change the administrator password to one of your own under My profile.

Step 9 - Verify the release and where your data lives

Confirm the installed release and the data disk layout. Both the MariaDB database and ZenTao's uploaded attachments live on the dedicated data disk, bind-mounted into place, so your data stays off the operating system disk.

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT('ZenTao ',value) FROM zentao.zt_config WHERE owner='system' AND module='common' AND section='global' AND \`key\`='version' LIMIT 1"

df -h /data && findmnt -no SOURCE,TARGET /var/lib/mysql

Step 10 - Enable HTTPS (optional)

ZenTao derives its links from the request. A TLS-terminating proxy in front of it, or a certificate on the VM, therefore upgrades the site to https:// with no reconfiguration. To terminate TLS on the VM itself, point a DNS name at the public IP and run Certbot:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.example.com

Certbot obtains a certificate, configures the Apache virtual host for port 443 and sets up automatic renewal. When TLS is in place, browse to https://your-domain.example.com/.

Support

This image comes with 24/7 SecureAnyCloud support. Contact sales@secureanycloud.com for deployment guidance, workflow and permission configuration, version upgrades, performance tuning or MariaDB database administration.

About SecureAnyCloud

SecureAnyCloud publishes hardened, ready-to-run open source images for Microsoft Azure and other clouds, patched at build time. Every image is built to a consistent security baseline, ships without default or shared credentials, keeps customer data on a dedicated data disk, and comes with a step-by-step deployment guide. ZenTao is redistributed under the GNU Affero General Public License v3.0 (AGPL-3.0).

All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.

Deploy on Azure

Launch ZenTao Project Management on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com