--- title: 01.09 Installing the VMware Appliance description: Import SimpleRisk's pre-built VMware appliance on Workstation, Fusion, or ESXi — verifying the download, mapping its network during import, and rotating… --- [Skip to content](https://support.simplerisk.com/kb/01-09-installing-the-vmware-appliance#main-content) English Show submenu for translations [Customer portal](https://support.simplerisk.com/tickets?hsLang=en) [![SimpleRisk logo of a man walking a tight rope](https://support.simplerisk.com/hs-fs/hubfs/simplerisk_logo_long_small-4.png?width=377&height=72&name=simplerisk_logo_long_small-4.png)](https://www.simplerisk.com/) Open main navigation Close main navigation - English Show submenu for translations - [Customer portal](https://support.simplerisk.com/tickets) - [Contact us](https://www.simplerisk.com/about-us/contact-us) [Contact us](https://www.simplerisk.com/about-us/contact-us) How can we help you? - There are no suggestions because the search field is empty. 1. [SimpleRisk Knowledge Base](https://support.simplerisk.com/kb?hsLang=en) 2. [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en) 3. [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment) # 01.09 Installing the VMware Appliance ## Import SimpleRisk's pre-built VMware appliance on Workstation, Fusion, or ESXi — verifying the download, mapping its network during import, and rotating the five published default credentials before the machine holds anything real. ## Why this matters The VMware appliance is the shortest path from "I want to look at SimpleRisk" to a working instance. It's a pre-built Ubuntu virtual machine with Apache, PHP, MySQL, and SimpleRisk already installed and already configured — it ships past the initial configuration wizard, so there's no health check to satisfy, no database to create, and no schema to fetch. Download, verify, import, boot, log in. That convenience comes with an ownership transfer that's easy to miss. The appliance is a *starting image*, not a managed product. The moment it powers on you own the operating system inside it: the OS patching, the MySQL administration, the TLS certificate, the backups, and — most urgently — the set of published default credentials it ships with. An appliance imported and left at its defaults is a SimpleRisk instance whose OS login, root account, and administrator account are documented on our public knowledge base. Fine for a laptop evaluation, entirely inappropriate for anything holding real risk data. Once it's up, the appliance behaves exactly like a native Linux installation — same application, same Extras, same upgrade mechanics, same cron jobs. ## Before you start - **A VMware hypervisor.** This article is written against VMware Workstation Pro 17.x on Windows and Linux, Fusion 13.x on macOS, and ESXi/vSphere 8.x. On the older Workstation Player the import screens are equivalent — Player was folded into Workstation Pro in the 17.x line — so menus may be named slightly differently. - **Hardware virtualization enabled in firmware** (Intel VT-x or AMD-V). The appliance is a 64-bit guest and VMware refuses to power one on without it. The first thing to check if the machine won't start. - **Free disk space on the host** — roughly 6 GB to get started, with headroom toward 64 GB. The download is about 1.2 GB compressed, the packaged disk close to that once unpacked. The disk declares 64 GiB but only about 3 GB is populated at first boot; it grows as data accumulates and never shrinks. - **A networking decision, made before first boot.** The appliance declares a single network and every import wizard — Workstation, Fusion, or the vSphere Client — asks you to map it to something real on your host. Step 4 covers what each mapping choice actually means once the machine is running. - **A password manager, open.** Step 7 rotates five secrets in one sitting. ## Step-by-step ### 1. Download the appliance and verify the checksum Go to `https://www.simplerisk.com/download/vm` and use the VMware appliance link. You'll get `simplerisk-{version}-vmware.zip`, roughly 1.2 GB. Alongside the link, the page publishes an **MD5 checksum for that specific release**. Verify before unpacking. ``` # Windows, PowerShell Get-FileHash -Algorithm MD5 .\simplerisk-{version}-vmware.zip ``` ``` md5sum simplerisk-{version}-vmware.zip # Linux md5 simplerisk-{version}-vmware.zip # macOS ``` Compare against the checksum next to the link you actually used — the VMware and VirtualBox appliances have different checksums, and every release has its own. If they don't match, delete and download again. ### 2. Unpack the archive Unlike the VirtualBox appliance, the VMware archive contains **three** files: - **`simplerisk-{version}.ovf`:** The appliance descriptor — the file you point VMware at - **`simplerisk-{version}-disk1.vmdk`:** The disk image, stream-optimized VMDK - **`simplerisk-{version}.mf`:** The OVF manifest: SHA256 digests of the other two, which VMware verifies on import Keep all three together. The descriptor references the disk by relative filename and the manifest covers both, so separating them fails the import. **The manifest is worth understanding before you touch anything.** Because it pins SHA256 digests of the descriptor and the disk, editing the OVF without regenerating the manifest to match invalidates it and the import fails verification. For anything you'd want to change about the declared hardware, do it in the hypervisor after import (Step 4) instead — it's the same end state without the risk of a hand-edited descriptor and a manifest that no longer agrees with it. ### 3. Import the appliance **On Workstation Pro or Fusion.** Open the `.ovf`: **File → Open** in Workstation Pro, **File → Import** in Fusion. Name the machine, pick a storage location, start the import. VMware verifies the manifest, converts the stream-optimized disk to its normal working format, and registers the machine. A few minutes, most of it disk conversion. **On ESXi or vSphere.** Use **Deploy OVF Template** in the vSphere Client, or `ovftool`. Upload all three files together. Two prompts here have no desktop equivalent: - **Network mapping.** The appliance declares one network, named `VM Network`. That happens to be the exact name of a stock ESXi host's default port group, so on a host that hasn't renamed it, the wizard maps it with nothing for you to decide. If your environment uses a distributed switch or renamed port groups, map it explicitly to wherever the instance should actually live — see Step 4 for what each choice means once the machine is running. - **Disk provisioning.** Thin keeps the footprint near the ~3 GB actually populated and lets it grow toward 64 GiB. Thick reserves the full 64 GiB immediately. ``` ovftool --acceptAllEulas --diskMode=thin \ --network="{your-port-group}" \ simplerisk-{version}.ovf \ vi://{user}@{esxi-host}/ ``` ### 4. Settle the machine's networking **The network mapping you pick during import is live the moment the machine boots** — there's no built-in safe default to fall back on, so decide before you finish the wizard rather than after. On Workstation and Fusion, the wizard maps the appliance's single declared network to one of your existing virtual networks; on ESXi it maps to a port group (Step 3). What each choice actually gets you: #### **NAT** (Workstation, Fusion) - **Reaching the interface:** `http://{guest-IP}/` from the host only - **Use when:** Single-user evaluation. Your host has an interface on the NAT subnet so it reaches the guest directly — but nothing else on your network can. The safer choice while the appliance still has stock credentials. #### **Bridged** (Workstation, Fusion) - **Reaching the interface:** `http://{guest-IP}/` from any machine on the network - **Use when:** Shared demonstrations and pilots. The machine takes a DHCP address like a physical host. #### **A real port group** (ESXi, vSphere) - **Reaching the interface:** `http://{guest-IP}/` from wherever that port group routes - **Use when:** Any server-side deployment. Change the mapping after the fact under **VM Settings → Network Adapter** on the desktop products, or by editing the network adapter in the vSphere Client. On corporate networks, bridging exposes a new MAC to the switch, which port security or network access control may reject. ### 5. Boot the appliance and log in at the console Power on and let it boot to a console login prompt. ``` Login: simplerisk Password: simplerisk ``` This account has `sudo`, authenticated with the same password. You'll need it in Step 7. ### 6. Reach the web interface Find the guest's address at the console: ``` ip addr show ``` Ignore loopback (`lo`, `127.0.0.1`) and take the IPv4 address on the Ethernet interface, then browse to `http://{that-address}/`. Where you can browse *from* depends on the mapping you chose in Step 4. On a NAT adapter that address is on a private VMware subnet: your host reaches it, other machines on your network cannot, however routable the address looks. If colleagues need access, switch to bridged and re-read the address. Log in to SimpleRisk with `admin` / `admin`. ### 7. Change every default credential > **Do this before the appliance holds real data.** The appliance ships five secrets at published defaults. Until they're rotated, treat the machine as an open instance and keep it off a network anyone else can reach. 1. **The `simplerisk` OS user** — run `passwd` at the console. 2. **The OS root account** — `sudo passwd root`. 3. **The MySQL root user.** Generated at first boot and left in `/root/root_mysql_password.txt`. Read it, change it with `mysqladmin -u root -p password '{new-password}'`, then delete the file. 4. **The MySQL `simplerisk` application user** — `ALTER USER 'simplerisk'@'localhost' IDENTIFIED BY '{new-password}';` then `FLUSH PRIVILEGES;`. The second half is easy to forget: update `DB_PASSWORD` in `/var/www/simplerisk/includes/config.php` to match, or the application loses its database connection on the very next request. 5. **The SimpleRisk admin account** — in the web interface, **My Profile** → change the password, and set a real email address so password resets and notifications work. On ESXi, consider VM encryption for anything holding real data. ### 8. Record your baseline and finish the standard setup **Record what you actually received.** You're responsible for patching this stack: ``` cat /etc/os-release # Ubuntu release, for the OS patch cadence php -v # SimpleRisk requires PHP 8.3.0 or newer mysql --version ``` **Then complete the post-installation work any deployment needs:** - Set the base URL to the address your users will actually type, so emailed links resolve. - Put a real certificate in front of it — see [HTTPS and TLS Configuration](https://support.simplerisk.com/kb/01-07-https-and-tls-configuration?hsLang=en). - Confirm the cron jobs are scheduled — see [The Cron Jobs](https://support.simplerisk.com/kb/02-07-the-cron-jobs?hsLang=en). - Set up database backups that ship off the host — see [Database Backup and Restore](https://support.simplerisk.com/kb/02-05-database-backup-and-restore?hsLang=en). - Register the instance for the free Upgrade and SCF Extras — see [Registration and Licensing](https://support.simplerisk.com/kb/01-10-registration-and-licensing?hsLang=en). - **Take a snapshot** of the freshly hardened, freshly configured appliance, and take another before every upgrade. ## Giving the appliance a static address A bridged appliance takes a DHCP lease, which is fine for a demonstration and wrong for anything people bookmark. To pin it, edit the guest's netplan configuration. Find the adapter name first: ``` ip addr show ``` Then edit `sudo vi /etc/netplan/01-netcfg.yaml`, replacing `ens3` with your adapter and the addresses with yours: ``` network: version: 2 renderer: networkd ethernets: ens3: dhcp4: no addresses: - 192.168.1.199/24 routes: - to: default via: 192.168.1.1 nameservers: addresses: [8.8.8.8, 1.1.1.1] ``` Apply with `sudo netplan apply`. No output means success; confirm with `ip addr show`. Two things to get right, because both are easy to miss: - **The address and gateway must be on the same subnet.** An address of `192.168.121.199/24` with a gateway of `192.168.1.1` cannot work — the gateway isn't reachable from that network. Match the first three octets. - **Use `routes:`, not `gateway4:`.** Older guides use `gateway4`, which netplan deprecated; current Ubuntu warns on it and it will eventually stop working. Changing the address changes the URL your users type, so update the SimpleRisk base URL to match afterwards. ## Growing the appliance disk The disk declares 64 GiB, is thin-provisioned, and **never shrinks**. The usual reason to resize is hitting that ceiling on a long-lived instance. Two parts, and people routinely do only the first and wonder why nothing changed: 1. **Grow the virtual disk.** Power off, then **VM Settings → Hard Disk → Expand** on the desktop products (or edit the disk size in the vSphere Client) and set the new size. 2. **Grow the partition and filesystem inside the guest**, so the OS can see the new space. Boot a live Ubuntu ISO — attach it under **VM Settings → CD/DVD → Use ISO image file**, then interrupt the boot with **F2** to put the CD-ROM ahead of the disk in the boot order. Choose **Try Ubuntu**, extend the partition with a partition editor, then extend the filesystem. On the appliance's LVM layout that's `lvextend` followed by `resize2fs`. Take a snapshot before you start. Partition surgery on a machine holding real risk data is worth one cheap rollback point. ## Common pitfalls - **Expecting NAT to behave the way it does on VirtualBox.** On VMware Workstation and Fusion, the host *can* reach a NAT guest directly at its own address — no port forwarding needed. On VirtualBox it cannot. If you're moving between the two hypervisors, or between the two appliance downloads, that difference will catch you out. - **Assuming the import wizard picked a safe network for you.** There's no built-in NAT default here the way some appliances have — whatever you map the network to during import is live as soon as the machine boots, stock credentials and all. Decide the mapping deliberately (Step 4), not by clicking through the wizard on autopilot. - **Editing the OVF descriptor without regenerating the manifest.** The manifest pins SHA256 digests of the descriptor and the disk, so a hand edit that isn't followed by a fresh manifest fails verification on import. Whatever you're trying to change about the declared hardware, doing it in the hypervisor after import (Step 4) gets you the same result without that risk. - **Leaving the defaults in place "just for now."** The OS password, root password, and administrator password are published in our public knowledge base. An appliance on a bridged corporate network with stock credentials is an open instance. - **Treating the appliance as maintained by SimpleRisk.** The image is a point-in-time build. Nothing patches its Ubuntu, PHP, or MySQL but you. - **Upgrading by importing the next appliance.** A newer appliance is a new, empty instance. It doesn't carry your data across. Upgrade in place, exactly as you would any Linux installation, and snapshot first. - **Running a real deployment on the exported 2 GB and 2 virtual CPUs.** Those suit an evaluation. A mid-size deployment wants 2–4 virtual CPUs and 4–8 GB, and the appliance runs Apache, PHP, and MySQL together on one host. - **Mistaking a snapshot for a backup.** A snapshot of a running machine captures MySQL mid-transaction and usually lives on the same datastore. Good rollback point; not a backup strategy. - **Skipping the checksum because the download "looks fine."** VMware verifies the manifest, but the manifest only proves the three files agree with *each other* — the MD5 on the download page is what proves you got the file we published. - **Clock drift after the host sleeps.** Suspending a laptop suspends the guest's clock. A drifted guest produces cron jobs that fire late or not at all and audit-trail entries in the wrong order. Confirm with `timedatectl status`, and check VMware Tools time synchronization. ## What the appliance ships with - **Artifacts:** `simplerisk-{version}-vmware.zip` (about 1.2 GB), containing `simplerisk-{version}.ovf` (OVF envelope), `simplerisk-{version}-disk1.vmdk` (stream-optimized VMDK, close to the zip's own size), and `simplerisk-{version}.mf` (manifest, SHA256 digests of the other two). - **Declared hardware:** VMware hardware version 14 (`vmx-14`); Ubuntu 64-bit guest; 2 virtual CPUs; 2048 MB RAM; one 64 GiB thin-provisioned disk (about 3 GB populated) on a SATA/AHCI controller; one E1000 adapter on a network named `VM Network`. - **Default credentials:** OS: `simplerisk` / `simplerisk` (sudo-capable). MySQL root: generated at first boot, written to `/root/root_mysql_password.txt`. MySQL application user: `simplerisk` @ `localhost`. Application: `admin` / `admin`. **All must be rotated — see Step 7.** ## Related - [Installing the VirtualBox Appliance](https://support.simplerisk.com/kb/01-08-installing-the-virtualbox-appliance?hsLang=en) — the same appliance for a different hypervisor - [System Requirements](https://support.simplerisk.com/kb/01-01-system-requirements?hsLang=en) — what to size the machine for once it's past evaluation - [Registration and Licensing](https://support.simplerisk.com/kb/01-10-registration-and-licensing?hsLang=en) — unlocking the free Upgrade and SCF Extras - [The Upgrade Process](https://support.simplerisk.com/kb/02-01-the-upgrade-process?hsLang=en) — upgrading the appliance in place - [FAQs](https://support.simplerisk.com/kb/faqs?hsLang=en) - [SimpleRisk Extras](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#main-content) - [Vulnerability Management Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#vulnerability-management-extra) - [Team Separation Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#team-separation-extra) - [Import-Export Extra](https://support.simplerisk.com/kb/simplerisk-extras?hsLang=en#import-export-extra) - [Administrator Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#main-content) - [00 About This Guide](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#00-about-this-guide) - [01 Installation and Deployment](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#01-installation-and-deployment) - [02 Upgrades and Maintenance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#02-upgrades-and-maintenance) - [03 Users and Permissions](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#03-users-and-permissions) - [04 Authentication](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#04-authentication) - [05 Customization](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#05-customization) - [06 Configuring Risk and Compliance](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#06-configuring-risk-and-compliance) - [07 Integrations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#07-integrations) - [08 The API](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#08-the-api) - [09 Encryption and Data Security](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#09-encryption-and-data-security) - [10 Workflows and Automation](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#10-workflows-and-automation) - [11 Reporting and Auditing](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#11-reporting-and-auditing) - [12 Operations](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#12-operations) - [13 Reference](https://support.simplerisk.com/kb/administrator-guide?hsLang=en#13-reference) - [User Guide](https://support.simplerisk.com/kb/user-guide?hsLang=en#main-content) - [00 Foundations of GRC](https://support.simplerisk.com/kb/user-guide?hsLang=en#00-foundations-of-grc) - [01 Risk Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#01-risk-management) - [02 Compliance Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#02-compliance-management) - [03 Governance](https://support.simplerisk.com/kb/user-guide?hsLang=en#03-governance) - [04 Asset and Data Inventory](https://support.simplerisk.com/kb/user-guide?hsLang=en#04-asset-and-data-inventory) - [05 Threat and Vulnerability Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#05-threat-and-vulnerability-management) - [06 Assessments](https://support.simplerisk.com/kb/user-guide?hsLang=en#06-assessments) - [07 Incident Management](https://support.simplerisk.com/kb/user-guide?hsLang=en#07-incident-management) - [08 Audit and Reporting](https://support.simplerisk.com/kb/user-guide?hsLang=en#08-audit-and-reporting) - [09 Day-to-Day SimpleRisk](https://support.simplerisk.com/kb/user-guide?hsLang=en#09-day-to-day-simplerisk) - [10 Continuous Improvement](https://support.simplerisk.com/kb/user-guide?hsLang=en#10-continuous-improvement) - [SimpleRisk User Guides](https://support.simplerisk.com/kb/simplerisk-user-guides?hsLang=en) - [Troubleshooting](https://support.simplerisk.com/kb/troubleshooting?hsLang=en) - [SimpleRisk Hosted](https://support.simplerisk.com/kb/simplerisk-hosted?hsLang=en) - [How To videos](https://support.simplerisk.com/kb/how-to-videos?hsLang=en) [![favicon-1](https://support.simplerisk.com/hs-fs/hubfs/favicon-1.png?width=35&height=35&name=favicon-1.png "favicon-1")](https://www.simplerisk.com) Copyright © 2026, SimpleRisk, Inc.