Availability and pricing

Cloud	Version	Software price	Last build
AWS Marketplace EC2 AMI · all commercial regions	2.6.16	$0.03/hr Recommended instance: t3.small · 5-day free trial	2026-10-23	Listing ↗
Azure Marketplace VM image · plan payg-gen2 · Gen2	2.6.15	$0.028/vCPU/hr Recommended VM: Standard_D2s_v3	2026-09-13	Listing ↗

Software price only; cloud infrastructure is billed separately by the provider. Prices in USD.

Image facts

Base OS	Ubuntu 24.04 LTS
Hardening	CIS Level 1, Ubuntu 24.04 LTS (tailored)
License	OLDAP-2.8
Upstream	The OpenLDAP Project
Machine-readable	product.json · catalog.json

What is OpenLDAP

OpenLDAP is the reference open-source implementation of the Lightweight Directory Access Protocol and the directory server most self-hosted identity stacks are built on. Its server, slapd, is a single C daemon that stores users, groups, hosts and application entries in a hierarchical tree and answers LDAP queries over the network - the same protocol Linux hosts, VPN concentrators, mail servers, CI systems, wikis and hundreds of off-the-shelf applications already speak for authentication and identity lookup. Storage is LMDB, a memory-mapped transactional store compiled into the server, so there is no separate database process to run, tune or back up. Configuration is live: the whole server is described by entries under cn=config and changed with ordinary LDAP operations, with no restart and no configuration file to edit. Running your own directory keeps every credential, group membership and personnel attribute inside your own AWS account rather than a third-party identity service, which matters directly for GDPR and for sector rules on personal data. OpenLDAP Public License, no vendor lock-in.

What the Lynxroute image adds

Security hardening:

Anonymous binds refused - the directory does not answer unauthenticated clients at all, and every operation requires an identity
No cleartext passwords on the wire - a security strength floor is enforced, so port 389 works only after StartTLS and a password bind over an unprotected connection is rejected by the server
Per-instance TLS certificate and private key, generated on your own instance at first launch and never shipped inside the image
Per-instance administrator password, generated at first launch and written to a root-only file - no shared or default credential exists in the image
Salted password hashing (SSHA) for every password set through the directory
Password hashes readable by nobody - the access rules let users change their own password without the right to read it, so a compromised session cannot walk away with a hash to crack offline
Directory data is not world-readable - the permissive default access rule is replaced, so an authenticated identity is required to read anything
UFW firewall pre-configured - only 22, 389 and 636 reachable
fail2ban, AppArmor
CVE scan - every image is scanned for vulnerabilities before release

OS hardening (CIS Level 1):

CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
auditd, SSH hardening, Kernel hardening, IMDSv2 enforced

Compliance artifacts:

SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
CIS Conformance Report at /etc/lynxroute/cis-report.html
CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Operational audit log - every connection, bind and result recorded to /var/log/openldap/slapd.log

Deploy

Launch in one command

Credentials are generated at first boot and written to /root/openldap-credentials.txt.

AWS CLIAzure CLI

# subscribe once on the AWS Marketplace listing, then:
aws ec2 run-instances \
  --image-id resolve:ssm:/aws/service/marketplace/prod-e22upkrh4yhfa/latest \
  --instance-type t3.small --key-name my-key --security-group-ids sg-xxxxxxxx

# accept the plan terms once, then:
az vm image terms accept --publisher lynxroute --offer openldap --plan payg-gen2
az vm create -g my-rg -n openldap --size Standard_D2s_v3 \
  --image lynxroute:openldap:payg-gen2:latest --admin-username azureuser --generate-ssh-keys

OpenLDAP

Launch in one command

Latest release

OpenLDAP 2.6.16