Alternative Installation Method: You can also install UTMStack using an automated ISO image. See the Installation from ISO guide for details.
Prerequisites
Operating System
This installation guide is designed for Ubuntu 24.04 LTS. UTMStack v11 also supports Red Hat systems.
System Requirements
The following recommendations are based on the number of data sources and desired hot log storage retention.Definitions
- Hot log storage: Non-archived data that can be accessed for analysis at any time
- Cold log storage: Archived data that must be restored before accessing
- Data source: Any individual source of logs (devices, agents, SaaS integrations)
Sizing Guidelines
Assumption: 60 data sources generate approximately 100 GB of monthly data.Small Deployment
50 data sources (120 GB hot storage)
- 4 CPU Cores
- 16 GB RAM
- 150 GB Disk Space
Medium Deployment
120 data sources (250 GB hot storage)
- 8 CPU Cores
- 16 GB RAM
- 250 GB Disk Space
Large Deployment
240 data sources (500 GB hot storage)
- 16 CPU Cores
- 32 GB RAM
- 500 GB Disk Space
Enterprise Deployment
500 data sources (1000 GB hot storage)
- 32 CPU Cores
- 64 GB RAM
- 1000 GB Disk Space
You may combine these tiers to allocate resources based on the number of devices and desired hot log storage retention.
Required Network Ports
The following ports must be accessible for UTMStack to function properly:Administrative Access Ports
Port 22/TCP - Secure Shell (SSH)
Port 22/TCP - Secure Shell (SSH)
Purpose: Remote server administrationSecurity Recommendation: Create a firewall rule to allow access only from admin workstations
Port 80/TCP - HTTP Redirector
Port 80/TCP - HTTP Redirector
Purpose: UTMStack Web-based GUI redirector (redirects to HTTPS)Security Recommendation: Create a firewall rule to allow access only from admin and security analyst workstations
Port 443/TCP - HTTPS
Port 443/TCP - HTTPS
Purpose: UTMStack Web-based Graphical User InterfaceSecurity Recommendation: Create a firewall rule to allow access only from admin and security analyst workstations
Port 9090/TCP - Cockpit
Port 9090/TCP - Cockpit
Purpose: Cockpit Web-based Server Management InterfaceSecurity Recommendation: Create a firewall rule to allow access only from admin workstations
Integration Ports
Additional ports will be required during the configuration of UTMStack’s integrations to receive logs. Please follow the security recommendations provided in each integration guide.
Installation Steps
Step 1: Preparing for Installation
Update the system and install required dependencies:Make sure you have a stable internet connection during the installation process.
Step 2: Running the Installation
Execute the installer without parameters:- Check system requirements
- Download necessary components
- Configure the system
- Set up containers and services
- Generate initial credentials
The installation process may take 15-30 minutes depending on your internet connection and system resources.
Step 3: Post-Installation Configuration
Once UTMStack is installed, you can access the platform:Default Credentials
- Username:
admin - Password: Generated during installation
Accessing the Platform
Use HTTPS to access the login page:UTMStack requires HTTPS for secure access. HTTP requests will be automatically redirected to HTTPS.
Post-Installation Steps
1
Secure Your Credentials
- Back up the
/root/utmstack.ymlfile to a secure location - Change the default admin password
- Enable and configure Multi-Factor Authentication (MFA) - mandatory in v11
2
Configure Firewall Rules
Set up firewall rules according to the port requirements and security recommendations above
3
Configure SSL Certificate
For production environments, configure a valid SSL certificate:
- Use Let’s Encrypt with Certbot (recommended)
- Or import your own SSL certificate
4
Connect Data Sources
Begin connecting your data sources and integrations:
- Install agents on endpoints
- Configure log forwarding from network devices
- Set up SaaS integrations
5
Configure Central Management (Optional)
If you’re managing multiple UTMStack instances, configure central server connectivity for:
- Centralized updates
- Remote log submission
- Unified management
Verification
After installation, verify that UTMStack is running correctly:Troubleshooting
Installation fails due to insufficient resources
Installation fails due to insufficient resources
Ensure your system meets the minimum requirements for your deployment size. Check available RAM, CPU, and disk space:
Cannot access web interface
Cannot access web interface
- Verify firewall rules allow ports 80 and 443
- Check that containers are running:
docker ps - Verify HTTPS is being used in the URL
- Check system logs:
docker logs utmstack_backend
Forgot admin password
Forgot admin password
The generated password is stored in
/root/utmstack.yml. Access this file as root to recover the credentials.Installation interrupted or failed
Installation interrupted or failed
- Remove existing installation:
./installer --remove - Clean up Docker resources:
docker system prune -a - Restart the installation process
Additional Installation Options
Red Hat Installation
UTMStack v11 now supports Red Hat-based systems. The installation process is similar, but usesdnf instead of apt:
Support and Resources
Official Documentation
Complete documentation library
Community Forum
Ask questions and share knowledge
GitHub Repository
Source code and issue tracking
Contact Support
Get professional assistance