Prepare the Server

Use this checklist to get a server ready before you run the UTMStack v12 installer. Each step says why it matters and how to do it. When every check at the end passes, continue with Install UTMStack.

Installing on AWS, Microsoft Azure or Google Cloud? Read Install on AWS, Azure or Google Cloud as well: it covers the cloud-side settings.

1. Choose the machine

• A physical or virtual server that runs nothing else. The installer installs Docker and nginx, takes over ports 80 and 443, and after every update deletes all Docker images that no running container uses, including those of other applications.

• 64-bit x86 processor (x86-64, also called AMD64).

• At least 2 CPU cores and enough memory that the operating system reports 13,360 MB or more in total (a server with 16 GB passes). For production, plan more: see Sizing and Capacity Planning.

2. Install the operating system

• Install Ubuntu, Debian or Red Hat Enterprise Linux (RHEL). The installer refuses other distributions, including Rocky Linux, AlmaLinux, CentOS and Oracle Linux. Use a current, supported release.

• A minimal server installation is enough. You do not need a desktop.

• On RHEL, register the server with Red Hat so that dnf can install packages. The installer installs nginx, Cockpit and other packages from your distribution's repositories.

• Install the latest updates and restart:

sudo apt update && sudo apt -y upgrade
sudo reboot

sudo dnf -y update
sudo reboot

3. Do not pre-install Docker or a web server

The installer installs Docker CE from Docker's own repository and nginx from your distribution. Start from a server without them.

• If your distribution's own Docker packages are installed (for example docker.io on Ubuntu, or Podman and runc on RHEL), remove them first, as Docker's installation guide describes.

• Do not install another web server, and do not add a web application firewall module such as ModSecurity to nginx. Such a module holds the long-lived connections that agents use, so their logs stop arriving.

4. Set the host name

The installer reads the server's host name at every run. It uses it as the server name that UTMStack shows and sends to the UTMStack update server when the server registers. Set it before you install:

sudo hostnamectl set-hostname siem01
hostname

5. Give the server a fixed IP address and a DNS name

• Fixed private address. The installer sets up Docker Swarm (Docker's built-in service manager) with the server's main IP address. Docker recommends a fixed address for this, so use a static address or a DHCP reservation.

• Reachable over IPv4. The installer turns IPv6 off on the whole server. Make sure you can still reach the server over IPv4, including over SSH.

• DNS name. Create a DNS record (an A record) such as siem.example.com that points to the server's address. You need it for a trusted SSL certificate. On a multi-tenant licence, every tenant also needs its own name that points to the server. See SSL Certificate and Tenants.

• Free address range. The installer creates a network interface vlan10 with the address 10.21.199.3/24. Make sure 10.21.199.0/24 is not used on your network.

6. Add a separate disk for UTMStack data

UTMStack keeps its data under /utmstack. Put that folder on its own fast disk (SSD), sized as described in Sizing and Capacity Planning. Mount the disk before you install. The / disk still needs about 30 GB free, because Docker images and the PostgreSQL database are stored there.

1. 1

   Find the new disk

   lsblk

   The new disk has no partitions and no mount point, for example /dev/sdb or /dev/nvme1n1. The examples use /dev/sdb. Make sure you pick the right disk: the next step erases it.

2. 2

   Create a file system

   sudo mkfs.ext4 -L utmstack-data /dev/sdb

3. 3

   Mount it at /utmstack at every start

   sudo mkdir -p /utmstack
   echo 'LABEL=utmstack-data  /utmstack  ext4  defaults,nofail  0  2' | sudo tee -a /etc/fstab
   sudo systemctl daemon-reload
   sudo mount -a

4. 4

   Check it

   df -h /utmstack

   The output must show the new disk and its full size. If it shows the / disk, the mount failed: fix it before you install.

7. Synchronise the clock

Correct time matters for the time stamps of logs and alerts, for correlation rules that count events over a time window, for sign-in codes from authenticator apps and for certificates.

timedatectl

The output must say System clock synchronized: yes. If it does not:

sudo timedatectl set-ntp true

sudo dnf -y install chrony
sudo systemctl enable --now chronyd

If your network blocks public time servers, point the time service at your internal NTP server.

8. Allow the network traffic

• Inbound: 443/TCP from users, API clients and every network where agents and collectors run; 80/TCP if you want browsers redirected to HTTPS; 22/TCP (SSH) and 9090/TCP (Cockpit) from administrators only. Block 10001/TCP from outside the server.

• Outbound: HTTPS to cm.utmstack.com, github.com, ghcr.io, Docker Hub and download.docker.com, and access to your distribution's package mirrors.

See Network Ports and Firewall for the full list and firewall examples. For a server that cannot reach the internet at all, see the air-gapped section of Install UTMStack.

9. Make sure you can work as root

The installer must run as the root user, for example after sudo su. Keep a second way into the server, such as a cloud serial console or a hypervisor console, in case the network change during installation interrupts your SSH session.

10. Run the pre-flight checks

Run these commands on the server and compare the results with the right-hand column of the table below.

grep -E '^(ID|VERSION_ID)=' /etc/os-release
uname -m
nproc
free -m
df -h / /utmstack
ip -4 addr show | grep -c '10\.21\.199\.'
timedatectl | grep -i synchronized
sudo ss -tlnp | grep -E ':(80|443|9090|10001) '
curl -s -o /dev/null -w '%{http_code}\n' https://cm.utmstack.com/api/v1/health
curl -s -o /dev/null -w '%{http_code}\n' https://github.com
curl -s -o /dev/null -w '%{http_code}\n' https://ghcr.io/v2/

If a check fails, fix it before you install. Then continue with Install UTMStack.