Derek Coleman & Associates Inc logoDerek Coleman & Associates Inc

Home / Support / OpenSearch on Ubuntu 24.04 LTS

OpenSearch on Ubuntu 24.04 LTS — Support & Quick Start

OpenSearch 3.8 with Dashboards on Ubuntu 24.04 LTS — search and log analytics with a per-VM admin password and certificate chain.

Email support Product page Azure Marketplace listing

Fixed on image version 2026.916.1427 (published 2026-09-16)

opensearch.service is given 10 minutes to start instead of 75 seconds, the generated admin password is hashed with the bundled JDK and written into /etc/opensearch/opensearch-security/internal_users.yml (the step that used to die silently when `java` was not on PATH), and first boot verifies the password against the running node.

If you deployed this VM before 2026-09-16, it came from the older image and is not changed by the new publication — redeploy from the current Marketplace version, or apply the one-time repair below:

  1. On a VM from an earlier image the node may never have finished starting within the first-boot window. Watch `sudo journalctl -u opensearch -f`; once the node is up, the password in /var/lib/opensearch/admin-password applies. If `admin` is still refused, the hash step never ran on that image — email support or redeploy from the current Marketplace version.

Image change: see the pull request.

Source: the Marketplace live version set for this offer, read from Partner Center on 2026-09-16. New deployments take the newest version by default.

At a glance

Application ports5601 (Dashboards, HTTP), 9200 (REST API, HTTPS with a certificate chain generated on your VM)
Open in browserhttp://<VM-IP>:5601/
Admin credential filesudo cat /var/lib/opensearch/admin-password
Sign in asadmin
Service(s)opensearch, opensearch-dashboards
Configuration/etc/opensearch/opensearch.yml; per-VM certificates in /etc/opensearch/certs/ (root-ca.pem, node.pem, admin.pem — the admin and CA keys are root-only); /etc/opensearch/opensearch-security/internal_users.yml; /etc/opensearch/jvm.options.d/heap.options; /etc/opensearch-dashboards/opensearch_dashboards.yml
Logs/var/log/opensearch/; journalctl -u opensearch-dashboards -f
VersionOpenSearch 3.8.0 + OpenSearch Dashboards 3.8.0 (3.x apt repository)
PlatformUbuntu 24.04 LTS

Quick start

  1. Deploy from the Azure Marketplace (Get It Now → Create), choosing your SSH key at the Administration step.
  2. Allow inbound SSH (22) for yourself plus the application port(s): 5601 (Dashboards) and, for API clients, 9200 — restrict to your own IP where possible. The in-image firewall already allows them; only the Network Security Group (NSG) keeps them closed.
  3. Open http://<VM-IP>:5601/ and sign in as admin (see First login below).
  4. Create an index pattern and start ingesting via the REST API on https://<VM-IP>:9200 (Beats/Logstash/Data Prepper compatible).

First login / credentials

This image generates its admin credential on the VM at first boot — nothing is pre-set. SSH into the VM with the username + key you chose at deploy, then print the generated credential:

ssh <your-username>@<VM-IP>
sudo cat /var/lib/opensearch/admin-password

Sign in as admin.

  1. Print the credential file: OPENSEARCH_ADMIN_PASSWORD is the per-VM admin password, generated on first boot and proven against the running node before the file was written. Images from 21 October 2026 onward (image version 2026.1021.104 or later) also show the Dashboards and REST API addresses and this command in the SSH login message (MOTD); older images do not.
  2. Open http://<VM-IP>:5601/ and sign in as admin; the same credential works on the REST API: `curl -k -u admin:<password> https://<VM-IP>:9200/_cluster/health`.
  3. 9200 serves a certificate chain this VM generated and signed itself, so clients need `-k` or the VM's CA: `sudo cat /etc/opensearch/certs/root-ca.pem` and add it to their trust store. Nothing on the image uses OpenSearch's published demo certificates.
  4. To change the admin password, follow the four steps inside the credential file (hash.sh, then securityadmin.sh with the VM's admin certificate): `admin` is a reserved user, so the Dashboards Security page cannot edit it.

Sign in as admin. The REST API on 9200 is HTTPS with a certificate chain generated on your VM (use -k, or trust /etc/opensearch/certs/root-ca.pem); admin is a reserved user — change its password on the node with the steps in the credential file.

Troubleshooting

SymptomCheckFix
/etc/opensearch/certs/root-ca.pem is missing, and /etc/opensearch/kirk.pem or esnode.pem exist instead`sudo ls /etc/opensearch/certs/ /etc/opensearch/`Your VM came from an older image that carried OpenSearch's published demo certificates and demo users (password = username). Redeploy from the current image version rather than patching it in place.
opensearch-plugin install opensearch-security-analytics answers Unknown pluginSecurity Analytics is not shipped on this imageInstall it by its Maven coordinates with your node's version plus .0: `sudo /usr/share/opensearch/bin/opensearch-plugin install org.opensearch.plugin:opensearch-security-analytics:3.8.0.0`, then `sudo systemctl restart opensearch`.

Still stuck?

Email support@dcassociatesgroup.com (response within 1 business day) or send a message via the contact form. Include the offer name, VM size, region, and any log output — sudo journalctl -u <service> -n 100 usually tells the story.