> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/installing-and-upgrading-the-appliance/installation-and-setup.md). # Installation and Setup ## Prerequisites Before installing the ExaVault appliance, confirm that you can provision a virtual appliance that meets our [System Requirements](/installing-and-upgrading-the-appliance/system-requirements.md) and that you can comply with our required [Firewall Configuration](/installing-and-upgrading-the-appliance/firewall-configuration.md). If you plan to use SSH to connect to your appliance, update your networking rules to allow inbound TCP 10022 from the addresses that will manage the appliance before starting. ### Networking You will need a static (or rarely-changing) IP address because your installation's [license is associated with its IP address](/administration/license-keys.md#ip-address-changes). We recommend assigning an Elastic IP address, which prevents IP changes due to instance resizes, stops, and restarts. Frequent updates to the appliance's IP address will invalidate your license. Record the internal IP address used by the appliance and the public IP address used for network address translation (NAT). ### Domain Name ExaVault requires a fully qualified domain name (FQDN) set as the server's hostname. Avoid using `ftp` in the hostname because the appliance supports several protocols. A name such as `files.example.com` works well. ### SSL Certificate The appliance includes a self-signed SSL certificate and can operate without a certificate from a trusted certificate authority. The certificate secures HTTPS and FTPS connections, but most clients do not trust a self-signed certificate and display a security warning. To avoid those warnings, use [automatic SSL certificate management](/premium-features.md#automatic-ssl-certificate-management) or install a certificate issued for your domain by a trusted certificate authority. ## Download and Import the ExaVault Image For VMware, [download the ExaVault image](/installing-and-upgrading-the-appliance/downloading-the-base-image.md), import it into the hypervisor, and create the virtual machine. Add and attach the secondary data drive during this step. The VMware image includes a default console account. Power on the virtual machine and sign in through the VMware console as `admin` with the password `DefaultPassChangeMe1!`. ### Amazon Web Services (AWS) Refer to the [AWS Installation](/installing-and-upgrading-the-appliance/installation-and-setup/aws-installation.md) instructions. ### VMware ExaVault is distributed as an OVA file for VMware. [Download the ExaVault OVA image for VMware](https://www.files.com/api/download/exavault?platform=vmware). After downloading the image, complete the [VMware Prerequisites](/installing-and-upgrading-the-appliance/installation-and-setup/vmware-prerequisites.md), then bootstrap the appliance. ## Bootstrap the Appliance If you are installing the appliance from the AWS Marketplace, bootstrapping is unnecessary. Refer to the [AWS Installation](/installing-and-upgrading-the-appliance/installation-and-setup/aws-installation.md) instructions. Connect to the appliance using your VM console or via SSH. The VM uses a nonstandard port for SSH, so you must specify port 10022 for an SSH connection. By default, ExaVault's cloud marketplace listings do not open inbound traffic to port 10022 from the Internet. If you plan to use SSH to connect to your appliance, update your networking rules in your cloud provider to allow inbound TCP 10022 from the addresses that will manage the appliance before starting. Run the bootstrap command to mount the data drive and launch the Appliance Manager: ```bash sudo exavaultctl -o bootstrap --device ``` The `--device` option can be omitted if using the default `/dev/nvme1n1`. Otherwise replace `` with the device of your data disk drive. ## Configure the ExaVault Appliance After bootstrapping, the `exavault-admin-dashboard` container is running. Open `https://:9002/` in a web browser. A security warning is expected because the appliance begins with a self-signed certificate. When you connect for the first time, create a password for the Appliance Manager and store it in an approved password manager. Before starting the appliance, register its license, configure the network and email settings, and choose the certificate it presents. You can keep or generate a self-signed certificate, enable automatic SSL certificate management, or upload a certificate issued by a trusted certificate authority. ### License Information Complete the form to automatically generate your free license for ExaVault. No payment information is required, and your contact information is stored securely. ### Configuration On the *Configuration* page, enter information about the network environment. * *Hostname*: The FQDN used to access the appliance, such as `files.example.com`. * *IP Address*: The appliance IP address that matches the hostname's DNS record. ExaVault uses it to handle FTP and SFTP through NAT. * *External FTP IP Address*: Usually the same as *IP Address*. Use the public address when a router forwards ports to a different internal appliance address. * *Email Host*: The SMTP server that delivers messages generated by the appliance. * *Email Port*: The port used to connect to the SMTP service. * *Email SSL*: Select this option when the SMTP service requires SSL, typically on port `465`. * *Email Username* and *Email Password*: The credentials used to authenticate with the SMTP service. * *Email From*: The From address used for messages generated by the appliance. ### SSL Certificate Open the Appliance Manager *SSL Certificate* page and choose how the appliance manages its certificate. You can use a self-signed certificate, [enable automatic SSL certificate management](/premium-features.md#automatic-ssl-certificate-management), or upload your own certificate. #### Upload Certificate If you have already obtained a certificate, upload it on the *Upload Certificate* tab. Supply one file containing the certificate, its intermediate certificates, and its private key, in that order. #### Generate Certificate (Self Signed) This tab generates a self-signed certificate. Connections remain encrypted, but clients may warn that they cannot verify the issuer. #### Generate CSR This tab generates a certificate signing request (CSR) to submit to your certificate provider. After the provider issues the certificate, use the *Upload Certificate* tab to import the certificate, its intermediate certificates, and its private key. #### Trusted CA The appliance can trust a certificate authority added on the *Trusted CA* tab. Organizations that operate an internal certificate authority can add its CA certificate here. Do not change settings on the *System* tab unless ExaVault Support directs you to do so. ### Verify SSL Certificate After configuring the certificate, open the Appliance Manager using its fully qualified domain name and verify that the expected certificate is presented. For example, if the domain is `files.example.com`, open `https://files.example.com:9002/`. When the web page loads, a browser security warning is expected if you are using a self-signed certificate. No warning should appear when the appliance is serving a valid certificate from a certificate authority the browser trusts. ## Start the Appliance Complete all of the steps to Configure the ExaVault Appliance, including verifying that SSL is properly configured before moving on to the next step. Using your VM console or SSH, run the command to start the appliance: ```bash sudo exavaultctl -o start ``` It may take several minutes for all of the containers to start. When the command has completed, you can access the web interface for your ExaVault installation. ## Log In to the Web Interface Use a web browser to access your server at the address you configured for the appliance's hostname. Log in with the default username `administrator` and the password `password`. Change your password immediately upon logging in.