Catalog / Business applications

iTop

ITSM and CMDB platform for tickets, changes and configuration items

CIS Level 1 hardened Ubuntu 24.04 LTS image by Lynxroute · unique credentials at first boot · CVE-scanned · SBOM and CIS report inside

Azure Marketplace3.3.0↗
Availability and pricing
CloudVersionSoftware priceLast build
Azure Marketplace
VM image · plan payg-gen2 · Gen2
3.3.0$0.028/vCPU/hr
Recommended VM: Standard_D2s_v3
2026-10-24Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts
Base OSUbuntu 24.04 LTS
HardeningCIS Level 1, Ubuntu 24.04 LTS (tailored)
LicenseAGPL-3.0
UpstreamCombodo
Machine-readableproduct.json · catalog.json
What is iTop

iTop is an open-source IT service management platform and configuration management database written in PHP. It combines an ITIL-aligned ticketing suite - user requests, incidents, changes and known errors - with a full CMDB covering servers, virtual machines, storage, network devices, applications, contacts and the contracts that tie them together. Impact analysis is rendered graphically through GraphViz, so an outage on one configuration item shows the services and customers it affects. A documented REST API drives every object class for scripted integration, and an end-user portal separates requesters from the back-office console. Data is persisted in a bundled MySQL 8.0 database on the instance. AGPL-3.0 license, no vendor lock-in. Running it yourself keeps your asset inventory, ticket history and contact data inside your own AWS account.

SCOPE OF THE OPEN SOURCE DISTRIBUTION

This image ships the iTop community core exactly as Combodo publishes it, with the standard ITIL module selection installed. It does not include paid extensions from the vendor's extension hub. The instance starts with an empty CMDB rather than a sample dataset, so nothing has to be deleted before real data is entered.

What the Lynxroute image adds

Security hardening:

  • No credentials in the image - the administrator password and the database password are generated uniquely on each instance at first launch
  • Installed from the command line at first launch, and the web setup wizard is then blocked at the web server, so nobody can re-run installation over a live instance
  • The configuration file, data, log and installer directories are refused by the web server; iTop relies on Apache .htaccess files for this, which nginx never reads, so every rule is reproduced explicitly in the site configuration
  • The configuration file is made read-only to the web server after installation
  • MySQL bound to 127.0.0.1 only, and the Debian maintenance account with its plaintext password file removed
  • Background task credentials stored outside the web root, readable only by the service account, and never passed on a command line
  • Bundled PHP libraries reviewed against public advisory data before release, with the components carrying critical or high advisories updated to fixed upstream releases inside the versions iTop supports
  • UFW firewall pre-configured - only ports 22, 80 and 443 accepted
  • fail2ban and AppArmor pre-configured
  • CVE scan - operating system packages are scanned for vulnerabilities before every release

OS hardening (CIS Level 1):

  • CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
  • auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

  • SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
  • CIS Conformance Report at /etc/lynxroute/cis-report.html
  • CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Deploy

Launch in one command

Credentials are generated at first boot and written to /root/itop-credentials.txt.

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer itop --plan payg-gen2
az vm create -g my-rg -n itop --size Standard_D2s_v3 \
  --image lynxroute:itop:payg-gen2:latest --admin-username azureuser --generate-ssh-keys
Release notes

Latest release

The most recent release with notes; the full release history is in product.json.

iTop 3.3.0

Azure · 2026-10-24
  • iTop 3.3.0 (community edition) on Nginx + PHP 8.3 + MySQL 8.0 - ITSM ticketing, CMDB and service management
  • GraphViz included, so impact analysis and dependency graphs render out of the box
  • Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com
  • Built on the CIS Level 1 hardened Ubuntu 24.04 LTS base