privacyIDEA on Ubuntu 24.04 LTS

privacyIDEA is an open source multi-factor authentication server. It manages second factors for your users, including TOTP and HOTP one-time-password tokens, WebAuthn and FIDO2 security keys, SMS and email challenges, and paper tokens, and answers authentication requests over a documented REST API. Because it is a standalone authentication back end rather than an identity provider, it slots in behind the infrastructure you already run: RADIUS clients such as VPN concentrators, LDAP proxies, SSH, Keycloak and SAML providers, and your own web applications. Your user accounts stay where they already live, in Active Directory, LDAP or a SQL database, and privacyIDEA adds the second factor on top.

This image delivers privacyIDEA fully installed in a dedicated Python virtual environment, backed by a local MariaDB database, served by gunicorn and reverse-proxied behind nginx, so your authentication server is operational within minutes of launch with no virtual environment wiring, no WSGI configuration, no database setup and no reverse-proxy work required. The management interface and REST API are available over HTTPS immediately using a certificate generated for your VM.

The image is hardened to be secure by default, which matters more here than for most workloads because privacyIDEA holds several distinct secrets. Every one of them is generated uniquely on the first boot of each VM and none is baked into the image: the encryption key that protects token seeds in the database, so that no other deployment can decrypt your tokens; the RSA keypair that signs the tamper-evident audit log, so that log cannot be forged; the session signing key and the password hashing pepper; the database password; and the TLS certificate. privacyIDEA ships no default administrator account of its own, so the only administrator that exists is the one created on your first boot, with a randomly generated password written to a root-only file on the instance. The database listens only on the loopback interface and the application is reached solely through nginx, and an anonymous readiness endpoint is provided for load-balancer probes that reports whether the encryption key is actually loaded rather than merely that a socket is open.

Systemd manages the application, the web server and the database for automatic restarts and clean logging, the operating system is fully patched at build time and continues to receive unattended security updates, and 24/7 cloudimg support is included.

This is a repackaged open source software product with additional charges for cloudimg support services. privacyIDEA is licensed under the GNU Affero General Public License v3.0. privacyIDEA is a trademark of its respective owners. All product and company names are trademarks or registered trademarks of their respective holders. Use of them does not imply any affiliation with or endorsement by them.