Sold by: Lynxroute
Deployed on AWS
Free Trial
This product has charges associated with it for hardening, security configuration, and support.
iTop is an open-source IT service management and CMDB application written in PHP, running on nginx with PHP 8.3-FPM and a bundled MySQL 8.0 database. This Lynxroute build is hardened and ready out of the box: no credentials in the image with the administrator password generated at first launch, the configuration file and every sensitive directory blocked at the web server, the setup wizard closed after installation, the database bound to loopback, UFW firewall pre-configured, and a CIS Level 1 hardened Ubuntu 24.04 LTS base.
AGPL-3.0 license - fully auditable, no vendor lock-in.
Overview
This is a repackaged software product wherein additional charges apply for hardening, security configuration, and support.
WHAT IS ITOP
iTop is an open-source IT service management platform and configuration management database written in PHP. It combines an ITIL-aligned ticketing suite - user requests, incidents, changes and known errors - with a full CMDB covering servers, virtual machines, storage, network devices, applications, contacts and the contracts that tie them together. Impact analysis is rendered graphically through GraphViz, so an outage on one configuration item shows the services and customers it affects. A documented REST API drives every object class for scripted integration, and an end-user portal separates requesters from the back-office console. Data is persisted in a bundled MySQL 8.0 database on the instance. AGPL-3.0 license, no vendor lock-in. Running it yourself keeps your asset inventory, ticket history and contact data inside your own AWS account.
SCOPE OF THE OPEN SOURCE DISTRIBUTION
This AMI ships the iTop community core exactly as Combodo publishes it, with the standard ITIL module selection installed. It does not include paid extensions from the vendor's extension hub. The instance starts with an empty CMDB rather than a sample dataset, so nothing has to be deleted before real data is entered.
WHAT THIS AMI ADDS
Security hardening:
- No credentials in the image - the administrator password and the database password are generated uniquely on each instance at first launch
- Installed from the command line at first launch, and the web setup wizard is then blocked at the web server, so nobody can re-run installation over a live instance
- The configuration file, data, log and installer directories are refused by the web server; iTop relies on Apache .htaccess files for this, which nginx never reads, so every rule is reproduced explicitly in the site configuration
- The configuration file is made read-only to the web server after installation
- MySQL bound to 127.0.0.1 only, and the Debian maintenance account with its plaintext password file removed
- Background task credentials stored outside the web root, readable only by the service account, and never passed on a command line
- Bundled PHP libraries reviewed against public advisory data before release, with the components carrying critical or high advisories updated to fixed upstream releases inside the versions iTop supports
- UFW firewall pre-configured - only ports 22, 80 and 443 accepted
- fail2ban and AppArmor pre-configured
- CVE scan - operating system packages are scanned for vulnerabilities before every release
OS hardening (CIS Level 1):
- CIS Ubuntu 24.04 LTS Level 1 benchmark applied via ansible-lockdown
- auditd, SSH hardening, Kernel hardening, IMDSv2 enforced
Compliance artifacts:
- SBOM - CycloneDX 1.6 at /etc/lynxroute/sbom.json
- CIS Conformance Report at /etc/lynxroute/cis-report.html
- CIS Tailored Profile at /usr/share/doc/lynxroute/CIS_TAILORED_PROFILE.md
Highlights
- iTop security baked in: administrator and database passwords generated uniquely on each instance at first launch, the web setup wizard blocked once installation completes, configuration and data directories refused by the web server, the configuration file read-only to the web server, MySQL bound to 127.0.0.1, UFW firewall pre-configured.
- CIS Level 1 hardened Ubuntu 24.04 LTS: auditd, fail2ban, AppArmor, SSH key-only, IMDSv2 enforced. CVE-scanned before every release. SBOM (CycloneDX) and CIS Conformance Report included.
- ITIL service management and CMDB in one: user requests, incidents, changes and known errors alongside a full configuration database with GraphViz impact analysis, an end-user portal and a documented REST API. AGPL-3.0 license - fully auditable, no vendor lock-in.
Details
Sold by
Categories
Delivery method
Delivery option
64-bit (x86) Amazon Machine Image (AMI)
Latest version
Operating system
Ubuntu 24.04
Deployed on AWS
New
Introducing multi-product solutions
You can now purchase comprehensive solutions tailored to use cases and industries.
Features and programs
Financing for AWS Marketplace purchases
AWS Marketplace now accepts line of credit payments through the PNC Vendor Finance program. This program is available to select AWS customers in the US, excluding NV, NC, ND, TN, & VT.
Pricing
Free trial
Try this product free for 5 days according to the free trial terms set by the vendor. Usage-based pricing is in effect for usage beyond the free trial terms. Your free trial gets automatically converted to a paid subscription when the trial ends, but may be canceled any time before that.
Pricing is based on actual usage, with charges varying according to how much you consume. Subscriptions have no end date and may be canceled any time.
Additional AWS infrastructure costs may apply. Use the AWS Pricing Calculator to estimate your infrastructure costs.
Dimension | Cost/hour |
|---|---|
t3.medium Recommended | $0.05 |
t3.large | $0.05 |
t3.small | $0.03 |
m6i.xlarge | $0.05 |
m6i.large | $0.05 |
Dimensions summary
You pay by the hour for the EC2 instance size you run. Five options let you match compute to your workload. The t3 family covers three sizes: t3.small, t3.medium, and t3.large. The m6i family offers m6i.large and m6i.xlarge. Larger sizes give you more CPU and memory. Billing is usage-based, so you pay for the hours each instance runs, with no upfront commitment. Every image ships hardened and pre-configured, so the price you choose reflects the compute capacity, not the software feature set.
Top-of-mind questions for buyers
Each hourly unit is one running EC2 instance of the size you pick. You pay for the hours that single virtual machine runs. Adding more instances multiplies the hourly charge. The price reflects compute capacity, not the number of users or tickets you manage in the software.
Software charges accrue per hour while the instance runs. A stopped instance stops the hourly software meter. You may still pay underlying AWS storage fees for the stopped instance's disk, but that is separate from the software charge for this listing.
The t3 sizes (small, medium, large) are burstable instances suited to variable or lighter workloads. The m6i sizes (large, xlarge) give steady CPU and memory for consistent loads. Each accrues its own hourly rate. You choose one size per instance, so only that size drives its hourly charge.
lynxroute.com
Helpful?
Vendor refund policy
We do not offer refunds for this product. AWS infrastructure charges (EC2, EBS, data transfer) are billed separately by AWS and are not refundable by us.
Legal
Vendor terms and conditions
Upon subscribing to this product, you must acknowledge and agree to the terms and conditions outlined in the vendor's End User License Agreement (EULA) .
Content disclaimer
Vendors are responsible for their product descriptions and other product content. AWS does not warrant that vendors' product descriptions or other product content are accurate, complete, reliable, current, or error-free.
Delivery details
64-bit (x86) Amazon Machine Image (AMI)
Amazon Machine Image (AMI)
An AMI is a virtual image that provides the information required to launch an instance. Amazon EC2 (Elastic Compute Cloud) instances are virtual servers on which you can run your applications and workloads, offering varying combinations of CPU, memory, storage, and networking resources. You can launch as many instances from as many different AMIs as you need.
Version release notes
iTop 3.2.3-2 - Initial release (August 2026)
- iTop 3.2.3-2 on Ubuntu 24.04 LTS
- CIS Level 1 hardening applied (ansible-lockdown/UBUNTU24-CIS)
- Operating system packages CVE-scanned before every release
- Administrator and database passwords generated uniquely on each instance at first launch
- Installed from the command line at first launch; the web setup wizard is then blocked
- Configuration, data, log and installer directories refused by the web server
- Configuration file read-only to the web server after installation
- MySQL 8.0 bundled and bound to 127.0.0.1 only
- GraphViz included, so impact analysis and dependency graphs render out of the box
- REST API enabled for the administrator account
- Bundled PHP libraries with critical or high advisories updated to fixed upstream releases
- UFW firewall pre-configured (ports 22, 80 and 443 only)
- fail2ban, auditd, AppArmor pre-configured
- SBOM (CycloneDX 1.6) at /etc/lynxroute/sbom.json
- CIS Conformance Report (OpenSCAP) at /etc/lynxroute/cis-report.html
- IMDSv2 enforced
Additional details
Usage instructions
- Launch instance (t3.medium recommended; t3.small minimum)
- Open Security Group - allow TCP 443 from your IP
- SSH: ssh -i key.pem ubuntu@<PUBLIC_IP>
- Read credentials: sudo cat /root/itop-credentials.txt
- Open https://<PUBLIC_IP>/ in your browser - accept the self-signed certificate warning. The first launch takes 2-5 minutes while the data model is compiled and the database is built, and a progress page is shown until it is ready.
- Log in as admin with the password from step 4, then change it from the user menu
- Create your first objects: Configuration Management to add servers and applications, Service Management to add customers and contracts, Helpdesk to raise a user request
The administrator password is generated uniquely on this instance and is not present in the AMI. Credentials are saved to /root/itop-credentials.txt at first launch.
The REST API is enabled for the administrator account:
curl -sk -X POST https://<PUBLIC_IP>/webservices/rest.php?version=1.3
--data-urlencode "auth_user=admin" --data-urlencode "auth_pwd=<password>"
--data-urlencode 'json_data={"operation":"core/get","class":"Organization","key":"SELECT Organization","output_fields":"name"}'
Background processing (notifications, SLA computation, asynchronous tasks) runs continuously as a service: sudo systemctl status itop-cron
The web setup wizard is blocked at the web server, because installation already ran at first launch and leaving it reachable would let a stranger reinstall over your data. To perform an in-place iTop upgrade later, comment out the "location ^~ /setup/" block in /etc/nginx/conf.d/itop.conf, run the upgrade, then restore it.
The configuration file /var/www/itop/conf/production/config-itop.php is read-only to the web server. To change a setting there, make it writable, edit it, then restore it: sudo chmod 660 /var/www/itop/conf/production/config-itop.php sudo chmod 640 /var/www/itop/conf/production/config-itop.php
MySQL listens on 127.0.0.1 only and is not reachable from outside the instance.
Replace the self-signed TLS certificate with a CA-signed certificate for production use: sudo certbot --nginx -d yourdomain.com
Resources
Vendor resources
Support
Vendor support
Visit us online: https://lynxroute.com
For iTop documentation:
AWS infrastructure support
AWS Support is a one-on-one, fast-response support channel that is staffed 24x7x365 with experienced and technical support engineers. The service helps customers of all sizes and technical abilities to successfully utilize the products and features provided by Amazon Web Services.
Similar products
By bCloud LLC
This product has charges associated with it for maintenance, updates, and optional technical support provided by the seller. iTop is an open source IT Service Management and Configuration Management Database solution.
This product has charges associated with it for seller support. iTop is an Open Source web application for the day to day operations of an IT environment. iTop was designed with the ITIL best practices in mind but does not dictate any specific process, the application is flexible enough to adapt to your processes whether you want rather informal and pragmatic processes or a strict ITIL aligned behavior.
The PagerDuty Operations Cloud is essential infrastructure for all unplanned, time-sensitive, critical work. It automatically detects and diagnoses disruptive events mobilizes the right team members to respond and automate infrastructure and workflows across your digital operations. This means you can resolve unplanned, unstructured, time-sensitive, and high-impact issues quickly - with fewer escalations to your technical teams while minimizing the impact on your customers and maintaining brand trust.
If you are looking for security and operational visibility across your AWS environment including applications, infrastructure and AWS services such as CloudTrail, Config, VPC Flow Logs, and more then Splunk Cloud is the right solution for you.
Customer reviews
No customer reviews yet
Be the first to review this product . We've partnered with PeerSpot to gather customer feedback. You can share your experience by writing or recording a review, or scheduling a call with a PeerSpot analyst.