{
 "slug": "itop",
 "name": "iTop",
 "tagline": "ITSM and CMDB platform for tickets, changes and configuration items",
 "category": "business-apps",
 "use_cases": [
  "itsm",
  "cmdb",
  "helpdesk"
 ],
 "aliases": [],
 "status": "live",
 "upstream": {
  "vendor": "Combodo",
  "url": "https://www.combodo.com/itop",
  "license": "AGPL-3.0",
  "license_url": "https://github.com/Combodo/iTop/blob/develop/license.txt"
 },
 "image": {
  "os": "Ubuntu 24.04 LTS",
  "cis_level": 1,
  "ports": [
   80,
   443
  ],
  "artifacts": [
   "/etc/lynxroute/sbom.json",
   "/etc/lynxroute/cis-report.html",
   "/usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
  ]
 },
 "clouds": {
  "aws": {
   "status": "restricted",
   "restricted_on": "2026-08-24"
  },
  "azure": {
   "status": "live",
   "version": "3.3.0",
   "last_build": "2026-10-24",
   "offer_id": "itop",
   "plan_id": "payg-gen2",
   "image_urn": "lynxroute:itop:payg-gen2:latest",
   "listing_url": "https://azuremarketplace.microsoft.com/en-us/marketplace/apps/lynxroute.itop?tab=Overview",
   "recommended_vm_size": "Standard_D2s_v3",
   "price_usd_per_vcpu_hour": 0.028,
   "unit": "vcpu-hour"
  },
  "alicloud": {
   "status": "not_offered"
  }
 },
 "urls": {
  "page": "https://lynxroute.com/products/itop/",
  "json": "https://lynxroute.com/products/itop/product.json"
 },
 "release_notes": [
  {
   "version": "3.3.0",
   "title": "iTop 3.3.0",
   "notes": "* iTop 3.3.0 (community edition) on Nginx + PHP 8.3 + MySQL 8.0 - ITSM ticketing, CMDB and service management\n* GraphViz included, so impact analysis and dependency graphs render out of the box\n* Certbot pre-installed - enable a trusted HTTPS certificate with one command: sudo certbot --nginx -d yourdomain.com\n* Built on the CIS Level 1 hardened Ubuntu 24.04 LTS base\n",
   "source": "backfill-git",
   "live": {
    "azure": "2026-10-24"
   }
  },
  {
   "version": "3.2.3-2",
   "title": "iTop 3.2.3-2 - Initial release (August 2026)",
   "notes": "* iTop 3.2.3-2 on Ubuntu 24.04 LTS\n* CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)\n* Operating system packages CVE-scanned before every release\n* Administrator and database passwords generated uniquely on each instance at first launch\n* Installed from the command line at first launch; the web setup wizard is then blocked\n* Configuration, data, log and installer directories refused by the web server\n* Configuration file read-only to the web server after installation\n* MySQL 8.0 bundled and bound to 127.0.0.1 only\n* GraphViz included, so impact analysis and dependency graphs render out of the box\n* REST API enabled for the administrator account\n* Bundled PHP libraries with critical or high advisories updated to fixed upstream releases\n* UFW firewall pre-configured (ports 22, 80 and 443 only)\n* fail2ban, auditd, AppArmor pre-configured\n* SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json\n* CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html\n* IMDSv2 enforced\n",
   "source": "backfill-aws-listing",
   "live": {
    "azure": "2026-08-13"
   }
  }
 ],
 "release_history": [
  {
   "version": "3.3.0",
   "azure": "2026-10-24"
  },
  {
   "version": "3.2.3-2",
   "azure": "2026-08-13"
  }
 ],
 "deploy": {
  "azure_cli": "# accept the plan terms once, then:\naz vm image terms accept --publisher lynxroute --offer itop --plan payg-gen2\naz vm create -g my-rg -n itop --size Standard_D2s_v3 \\\n  --image lynxroute:itop:payg-gen2:latest --admin-username azureuser --generate-ssh-keys"
 },
 "description": {
  "what_is": "iTop is an open-source IT service management platform and configuration management database written in PHP. It combines an ITIL-aligned ticketing suite - user requests, incidents, changes and known errors - with a full CMDB covering servers, virtual machines, storage, network devices, applications, contacts and the contracts that tie them together. Impact analysis is rendered graphically through GraphViz, so an outage on one configuration item shows the services and customers it affects. A documented REST API drives every object class for scripted integration, and an end-user portal separates requesters from the back-office console. Data is persisted in a bundled MySQL 8.0 database on the instance. AGPL-3.0 license, no vendor lock-in. Running it yourself keeps your asset inventory, ticket history and contact data inside your own AWS account.\n\nSCOPE OF THE OPEN SOURCE DISTRIBUTION\n\nThis image ships the iTop community core exactly as Combodo publishes it, with the standard ITIL module selection installed. It does not include paid extensions from the vendor's extension hub. The instance starts with an empty CMDB rather than a sample dataset, so nothing has to be deleted before real data is entered.",
  "image_adds": "Security hardening:\n* No credentials in the image - the administrator password and the database password are generated uniquely on each instance at first launch\n* Installed from the command line at first launch, and the web setup wizard is then blocked at the web server, so nobody can re-run installation over a live instance\n* The configuration file, data, log and installer directories are refused by the web server; iTop relies on Apache .htaccess files for this, which nginx never reads, so every rule is reproduced explicitly in the site configuration\n* The configuration file is made read-only to the web server after installation\n* MySQL bound to 127.0.0.1 only, and the Debian maintenance account with its plaintext password file removed\n* Background task credentials stored outside the web root, readable only by the service account, and never passed on a command line\n* Bundled PHP libraries reviewed against public advisory data before release, with the components carrying critical or high advisories updated to fixed upstream releases inside the versions iTop supports\n* UFW firewall pre-configured - only ports 22, 80 and 443 accepted\n* fail2ban and AppArmor pre-configured\n* CVE scan - operating system packages are scanned for vulnerabilities before every release\n\nOS hardening (CIS Level 1):\n* CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown\n* auditd, SSH hardening, Kernel hardening, IMDSv2 enforced\n\nCompliance artifacts:\n* SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json\n* CIS Conformance Report at /etc/lynxroute/cis-report.html\n* CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md"
 },
 "generated_at": "2026-10-31T09:36:34Z"
}