Authelia on Ubuntu 24.04 LTS — Support & Quick Start

At a glance

Application ports	9091 (portal / API over HTTPS, with a self-signed certificate issued on your VM)
Open in browser	https://<dashed-public-ip>.sslip.io:9091/ (for example https://20-1-2-3.sslip.io:9091/ — the exact address is the Portal line of the credential file)
Admin credential file	sudo cat /root/authelia-admin-credentials.txt
Sign in as	admin
Service(s)	authelia
Configuration	/etc/authelia/configuration.yml (rendered for your portal domain by authelia-set-domain from /etc/authelia/configuration.template.yml); users in /etc/authelia/users_database.yml; TLS pair /etc/authelia/ssl/portal.crt and portal.key; per-VM secrets in /etc/authelia/secrets.env
Logs	journalctl -u authelia -f
Version	Authelia 4.39.20
Platform	Ubuntu 24.04 LTS

Quick start

1. Deploy from the Azure Marketplace (Get It Now → Create), choosing your SSH key at the Administration step.
2. Allow inbound SSH (22) for yourself plus the application port(s): 9091 (portal, HTTPS) — to your reverse proxy and your own IP — restrict to your own IP where possible. The in-image firewall already allows them; only the Network Security Group (NSG) keeps them closed.
3. Open the portal address from the credential file (https://<dashed-public-ip>.sslip.io:9091/) and sign in as admin (see First login below).
4. Point your reverse proxy's forward-auth at the portal and add an access_control rule per protected application; the default policy is deny. `authelia-set-domain` rebuilds /etc/authelia/configuration.yml from /etc/authelia/configuration.template.yml whenever the portal domain changes, so keep lasting changes such as access_control rules in the template too (read from the image's script).

First login / credentials

This image generates its admin credential on the VM at first boot — nothing is pre-set. SSH into the VM with the username + key you chose at deploy, then print the generated credential:

ssh <your-username>@<VM-IP>
sudo cat /root/authelia-admin-credentials.txt

Sign in as admin.

1. Print the credential file: the portal address, username admin and the generated password. The password completed a real first-factor sign-in against the portal before the file was written.
2. Open the Portal address from the file — https://<dashed-public-ip>.sslip.io:9091/, a public wildcard-DNS name that resolves to the VM's public IP — and sign in as admin. The certificate is self-signed, so the first visit shows a browser warning; replace /etc/authelia/ssl/portal.crt and portal.key with your own pair, or terminate TLS on your reverse proxy.
3. Move the portal to your own domain with one command, after pointing the name's DNS at the VM: `sudo authelia-set-domain auth.example.com`. It re-issues the certificate, re-renders and validates the configuration, restarts Authelia and rolls back if anything fails. Until you do, the derived sslip.io name follows the VM's public IP at every boot.
4. Change the password. Images from 21 October 2026 onward (image version 2026.1021.247 or later) save a change made in the portal, on its /settings page (Security). Authelia asks for a one-time code first; until you configure the smtp notifier, that code is written to /var/lib/authelia/notification.txt on the VM (`sudo cat /var/lib/authelia/notification.txt`). Older images cannot save a change or reset made in the portal ("Operation failed"). On any image you can change it by hand: `authelia crypto hash generate argon2 --password 'NEW-PASSWORD'`, replace the hash in /etc/authelia/users_database.yml and `sudo systemctl restart authelia`. Configure the smtp notifier for password resets by e-mail (the filesystem notifier is a bootstrap default).

Sign in as admin at the HTTPS portal address in the file (an sslip.io name for the VM's public IP until you run `sudo authelia-set-domain <your domain>`). Expect a certificate warning on the first visit: the certificate is self-signed.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or send a message via the contact form. Include the offer name, VM size, region, and any log output — sudo journalctl -u <service> -n 100 usually tells the story.