Derek Coleman & Associates Inc logoDerek Coleman & Associates Inc

Home / Support / OpenBao on Ubuntu 24.04 LTS

OpenBao on Ubuntu 24.04 LTS — Support & Quick Start

OpenBao on Ubuntu 24.04 LTS — OpenBao is the open-source fork of Vault: centralized secrets management, encryption as a service, and dynamic credentials. Published by Derek Coleman & Associates Inc on the Azure Marketplace, deployed in your own Azure subscription.

Email support Product page Azure Marketplace listing

Fixed on image version 2026.916.1326 (published 2026-09-16)

The shipped config no longer carries the `disable_mlock = false` line that OpenBao 2.5 refuses, so the service starts, first boot runs `bao operator init`, unseals with the generated keys and writes /var/lib/openbao/init.json (root token + 5 unseal keys, threshold 3) after health-checking the API as initialized and unsealed.

If you deployed this VM before 2026-09-16, it came from the older image and is not changed by the new publication — redeploy from the current Marketplace version, or apply the one-time repair below:

  1. On a VM from an earlier image OpenBao crash-loops. One-line repair: edit the OpenBao config under /etc/openbao/ that carries `disable_mlock = false`, set it to `disable_mlock = true`, then restart the service and re-run first boot so it produces init.json. This is exactly the change the fixed image ships.
sudo systemctl restart openbao
sudo systemctl restart firstboot

Image change: see the pull request.

Source: the Marketplace live version set for this offer, read from Partner Center on 2026-09-16. New deployments take the newest version by default.

At a glance

Application ports8200 (HTTP API + UI)
Open in browserhttp://<VM-IP>:8200/ui/
Admin credential filesudo cat /var/lib/openbao/init.json # root token + unseal keys — move to secure storage
Sign in asroot token (root_token in init.json) — there is no username/password
Service(s)openbao
Configuration/etc/openbao/ (server config); data in /var/lib/openbao/
Logsjournalctl -u openbao -f
VersionOpenBao 2.5.5
PlatformUbuntu 24.04 LTS

Quick start

  1. Deploy from the Azure Marketplace (Get It Now → Create), choosing your SSH key at the Administration step.
  2. Allow inbound SSH (22) for yourself plus the application port(s): 8200 (API/UI) — restrict to your own IP where possible. The in-image firewall already allows them; only the Network Security Group (NSG) keeps them closed.
  3. Open http://<VM-IP>:8200/ui/ and sign in with the root token (see First login below).
  4. Enable an auth method for humans (userpass/OIDC), create policies, then revoke the root token and store the unseal keys with separate custodians.

First login / credentials

This image generates its admin credential on the VM at first boot — nothing is pre-set. SSH into the VM with the username + key you chose at deploy, then print the generated credential:

ssh <your-username>@<VM-IP>
sudo cat /var/lib/openbao/init.json  # root token + unseal keys — move to secure storage

Sign in as root token (root_token in init.json) — there is no username/password.

  1. Print init.json: it holds root_token and the unseal keys generated on this VM at first boot (threshold 3).
  2. Open http://<VM-IP>:8200/ui/ and sign in with the Token method using root_token.
  3. Move the unseal keys and root token off the VM, create named admin identities, then revoke the root token. After any restart the server comes up sealed: run `bao operator unseal` with 3 of the 5 unseal keys (unsealing is automatic only during first boot).

Sign in with the root token from init.json (Token auth method). Secure the init material immediately — anyone with the file owns the vault. A restarted VM comes up sealed and must be unsealed with 3 of the 5 keys.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or send a message via the contact form. Include the offer name, VM size, region, and any log output — sudo journalctl -u <service> -n 100 usually tells the story.