This document offers complete guidance for deploying Unified Security Stack v1.7.22 on Ubuntu 24.04 LTS with the installer script.
Prerequisites
Operating System
Download the Ubuntu Linux Image from the official website: https://ubuntu.com/download/server
This installation guide is designed for Ubuntu 24.04 LTSUnified Security Stack v1.7.22 also provides support for Red Hat systems.
System Requirements
These recommendations depend on how many data sources you have and how long you want to retain hot log storage.
Definitions
Hot log storage: Non-archived data that can be accessed for analysis at any time
Cold log storage: Archived data that must be restored before accessing
Data source: Any individual source of logs (devices, agents, SaaS integrations)
Sizing Guidelines
Assumption: About 100 GB of data per month is produced by 60 data sources.
Resources needed for one month of hot log storage:
You can mix these tiers to assign resources according to device count and the hot log storage retention you want.
Horizontal Scaling Required: Exceeding 500 data sources/devices means adding secondary nodes (workers) to scale horizontally. Unified Security Stack v1.7.22's new architecture enables this without difficulty.
Required Network Ports
The following ports must be accessible for Unified Security Stack to function properly:
Administrative Access Ports
Port 22/TCP - Secure Shell (SSH)
Purpose: Remote server administration
Security Recommendation: Create a firewall rule to allow access only from admin workstations
Port 80/TCP - HTTP Redirector
Purpose: Unified Security Stack Web-based GUI redirector (redirects to HTTPS)
Security Recommendation: Create a firewall rule to allow access only from admin and security analyst workstations
Port 443/TCP - HTTPS
Purpose: Unified Security Stack Web-based Graphical User Interface
Security Recommendation: Create a firewall rule to allow access only from admin and security analyst workstations
Port 9090/TCP - Cockpit
Purpose: Cockpit Web-based Server Management Interface
Security Recommendation: Create a firewall rule to allow access only from admin workstations
Integration Ports
You will need extra ports when configuring Unified Security Stack's integrations to receive logs. Please adhere to the security guidance included in each integration guide.
Installation Steps
Step 1: Preparing for Installation
Update the system and install required dependencies:
# Update packages list
sudo apt update
# Install WGET
sudo apt install wget
# Download the latest installer
wget https://synoti.com/downloads/installer
# Switch to root user
sudo su
# Set execution permissions
chmod +x installerEnsure your internet connection remains stable throughout the installation.
Step 2: Running the Installation
Execute the installer without parameters:
./installerThe installer will:
Check system requirements
Download necessary components
Configure the system
Set up containers and services
Generate initial credentials
Installation can last 15-30 minutes, depending on your internet connection and system resources.
Step 3: Post-Installation Configuration
Once Unified Security Stack is installed, you can access the platform:
Default Credentials
Username:
adminPassword: Generated during installation
The password and other generated configurations can be found in /root/synoti.yml
Important: Keep these credentials safe and update the default password right after your first login.
Accessing the Platform
Use HTTPS to access the login page:
https://your-server-ipor
https://your-domain.comUnified Security Stack mandates HTTPS for secure access. HTTP requests will automatically be redirected to HTTPS.
Post-Installation Steps
Secure Your Credentials
Back up the
/root/synoti.ymlfile to a secure locationChange the default admin password
Enable and configure Multi-Factor Authentication (MFA) - mandatory in v1.7.22
Configure Firewall Rules
Set up firewall rules according to the port requirements and security recommendations above
Configure SSL Certificate
For production environments, configure a valid SSL certificate:
Use Let's Encrypt with Certbot (recommended)
Or import your own SSL certificate
See the SSL Certificate configuration guide for detailed instructions
Connect Data Sources
Begin connecting your data sources and integrations:
Install agents on endpoints
Configure log forwarding from network devices
Set up SaaS integrations
Configure Central Management (Optional)
If you're managing multiple Unified Security Stack instances, configure central server connectivity for:
Centralized updates
Remote log submission
Unified management
Verification
After installation, verify that Unified Security Stack is running correctly:
# Check container status
docker ps
# Check system logs
docker logs synoti_backend
# Verify web interface accessibility
curl -k https://localhostEvery container should have a healthy or running status.
Troubleshooting
Installation fails due to insufficient resources
Confirm your system satisfies the minimum requirements for your deployment size. Verify available RAM, CPU, and disk space:
free -h
lscpu
df -hCannot access web interface
Verify firewall rules allow ports 80 and 443
Check that containers are running:
docker psVerify HTTPS is being used in the URL
Check system logs:
docker logs synoti_backend
Forgot admin password
The generated password is stored in /root/synoti.ymlTo recover the credentials, access this file as root.
Installation interrupted or failed
Remove existing installation:
./installer --removeClean up Docker resources:
docker system prune -aRestart the installation process
Additional Installation Options
Red Hat Installation
Unified Security Stack v1.7.22 now works with Red Hat-based systems. Setup is comparable, although it uses dnf instead of apt:
# Update packages
sudo dnf update
# Install WGET
sudo dnf install wget
# Continue with standard installation stepsScaling Your Deployment
Unified Security Stack v1.7.22 brings horizontal scaling capabilities through worker nodes.
Adding Worker Nodes
To scale beyond 500 data sources or improve processing capacity:
Install Unified Security Stack on additional servers using the same installer
Configure them as worker nodes during installation
Connect workers to the manager node
Distribute processing load automatically
Worker nodes can execute plugins and handle data in parallel with the manager, removing bottlenecks and delivering linear scalability.
Support and Resources
Remember: Unified Security Stack v1.7.22 is incompatible with v1.7.21. If you are migrating from v1.7.21, do not try a direct upgrade. Wait for the official migration tool or contact support for help.