iTop - Hardened ITSM Ticketing and CMDB

What is iTop

iTop is an open-source IT service management platform and configuration management database written in PHP. It combines an ITIL-aligned ticketing suite - user requests, incidents, changes and known errors - with a full CMDB covering servers, virtual machines, storage, network devices, applications, contacts and the contracts that tie them together. Impact analysis is rendered graphically through GraphViz, so an outage on one configuration item shows the services and customers it affects. A documented REST API drives every object class for scripted integration, and an end-user portal separates requesters from the back-office console.

Why self-host iTop

A CMDB is a map of your entire estate and a ticket history is a record of who asked for what and when. Running iTop yourself keeps that inventory, the contact data and the audit trail inside your own subscription, under your own retention and access rules. There is no per-agent or per-asset licence to negotiate as the estate grows, and the data model is open, so exports and integrations stay yours.

What this VM image adds

Security hardening:

• No credentials in the image - the administrator password and the database password are generated uniquely on each instance at first launch
• Setup wizard blocked - installation runs from the command line at first launch, then the web installer is refused, so nobody can reinstall over a live instance
• Sensitive directories refused - configuration, data, log and installer paths are blocked at the web server; iTop relies on Apache .htaccess files for this, which nginx never reads, so every rule is reproduced explicitly
• Configuration file read-only - made read-only to the web server once installation completes
• MySQL on loopback - bound to 127.0.0.1 only, and the Debian maintenance account with its plaintext password file removed
• Background task credentials - stored outside the web root, readable only by the service account, never passed on a command line
• Bundled PHP libraries reviewed - checked against public advisory data before release; components carrying critical or high advisories updated to fixed upstream releases inside the versions iTop supports
• CVE scan - operating system packages are scanned with Trivy before every release
• UFW firewall - only ports 22, 80 and 443 accepted
• fail2ban - SSH brute-force protection
• AppArmor - mandatory access control

OS hardening (CIS Level 1):

• CIS Level 1 hardened - CIS Ubuntu 24.04 LTS Level 1 Benchmark via ansible-lockdown
• auditd - system call auditing for critical paths
• SSH hardening - PasswordAuthentication disabled, key-only access
• Kernel hardening - SYN cookies, ASLR, rp_filter, TCP BBR
• /tmp as tmpfs - nosuid, nodev, noexec
• Azure IMDS endpoints - egress rules pre-configured (169.254.169.254, 168.63.129.16)

Compliance artifacts (inside the VM):

• SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
• CIS Conformance Report - OpenSCAP HTML at /etc/lynxroute/cis-report.html
• Tailored CIS profile - /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md

Quick Start

1. Deploy VM from Azure Marketplace (Standard_D2s_v3 or larger recommended)
2. SSH: ssh -i key.pem <username>@<PUBLIC_IP> (username set during VM creation, default: azureuser)
3. Read credentials: sudo cat /root/itop-credentials.txt
4. Open https://<PUBLIC_IP>/ and accept the self-signed certificate warning. First launch takes 2-5 minutes while the data model is compiled and the database is built; a progress page is shown until it is ready.
5. Log in as admin with the password from step 3, then change it from the user menu
6. Add servers and applications under Configuration Management, then raise your first user request under Helpdesk

The administrator password is generated uniquely on this VM and is not present in the image. Replace the self-signed certificate before production use: sudo certbot --nginx -d yourdomain.com