Install SimpleRisk as a VirtualBox Appliance

Written against VirtualBox 7.x. Verified against appliance release 20260519-001.

Introduction

The VirtualBox appliance is the shortest path from “I want to look at SimpleRisk” to a working instance. It is a pre-built Ubuntu virtual machine with Apache, PHP, MySQL, and SimpleRisk already installed and already configured — the appliance ships past the initial configuration wizard, so there is no health check to satisfy, no database to create, and no schema to fetch. Download, verify, import, boot, log in. For evaluations, proof-of-concept work, training environments, and air-gapped demonstrations, it removes every install-time variable at once.

That convenience comes with an ownership transfer that is easy to miss. The appliance is a starting image, not a managed product. The moment it boots on your hypervisor, you own the operating system inside it: the OS patching, the MySQL administration, the TLS certificate, the backups, and — most urgently — the sets of published default credentials it ships with. An appliance imported and left at its defaults is a SimpleRisk instance whose OS login, root account, and administrator account are documented on our public knowledge base. That is entirely appropriate for a laptop evaluation and entirely inappropriate for anything holding real risk data.

This guide covers importing and networking the appliance. Once it is up, the appliance behaves exactly like a native Linux installation — the same application, the same Extras, the same upgrade mechanics, the same cron jobs — and the Administrator Guide covers it from there. If you run into any issues, please contact us at support@simplerisk.com.

Before You Start

Have these in hand before you begin:

VirtualBox 7.0 or newer. The appliance is exported in VirtualBox machine format 1.19-linux, which is VirtualBox 7.x. Older releases can generally import the OVF 1.0 envelope, but the screens described here are the 7.x import wizard’s, and settings from a newer machine format may be silently dropped on an older host. VirtualBox is a free download from virtualbox.org.
Hardware virtualization enabled in firmware (Intel VT-x or AMD-V). The appliance is a 64-bit guest, and VirtualBox will refuse to start a 64-bit virtual machine without it. On most business laptops this is enabled by default, but it is the first thing to check if the machine will not power on.
Free disk space on the host: roughly 6 GB to get started, with headroom toward 64 GB. The download is about 850 MiB compressed, the unpacked disk image is another 870 MiB, and the imported virtual disk is thin-provisioned with a 64 GiB maximum capacity. It starts small and grows as the instance accumulates data; it never shrinks on its own.
A networking decision, made before first boot. The appliance’s exported network adapter is NAT, which is not reachable from your host browser without an additional step. Step 4 covers the three options; choosing one up front saves a confusing first boot.
A password manager, open. Step 7 rotates five secrets in one sitting. Generating and storing them as you go is far easier than reconstructing afterward which ones you changed.

Instruction

Step 1: Download the appliance and verify the checksum

Go to https://www.simplerisk.com/download/vm and use the VirtualBox appliance download link. You will receive a single zip archive named for the release you downloaded — simplerisk-{version}-virtualbox.zip, roughly 850 MiB.

Alongside the download link, the page publishes an MD5 checksum for that specific release. Verify your download against it before unpacking anything. The archive contains no internal manifest, so that checksum is the only integrity control available — a truncated or tampered file will otherwise present itself as a perfectly ordinary appliance.

On Windows, using PowerShell:

Get-FileHash -Algorithm MD5 .\simplerisk-{version}-virtualbox.zip

On Linux or macOS:

md5sum simplerisk-{version}-virtualbox.zip    # Linux md5 simplerisk-{version}-virtualbox.zip       # macOS

Compare the result against the checksum shown next to the link you actually used — the VMware and VirtualBox appliances have different checksums, and every release has its own. If the values do not match, delete the file and download it again. Do not import a mismatched image.

Step 2: Unpack the archive

Extract the zip file to a location with room to spare. It contains exactly two files:

simplerisk-{version}.ovf — the appliance descriptor, and the file you will point VirtualBox at.
simplerisk-{version}-disk001.vmdk — the disk image, in stream-optimized VMDK format.

Keep both files together in the same directory. The OVF descriptor references the disk image by relative filename, so separating them causes the import to fail with a missing-disk error.

Step 3: Import the appliance

In VirtualBox, choose File → Import Appliance, select the .ovf file, and continue to the appliance settings page. The appliance declares the following:

Setting	Exported value
Guest OS type	Ubuntu (64-bit)
CPU	2 virtual CPUs
RAM	2048 MB
Disk	64 GiB virtual capacity, thin-provisioned, on a SATA (AHCI) controller
Graphics	VMSVGA, 33 MB video memory
Network	One Intel PRO/1000 (E1000) adapter, attached to NAT

Two options on this screen matter:

MAC Address Policy → “Generate new MAC addresses for all network adapters.” The appliance ships with a fixed MAC address baked into its exported configuration. Reusing it is harmless for exactly one import on an isolated NAT network, and a problem everywhere else: import the appliance twice, or attach it to a bridged network where another copy already lives, and you have two hosts presenting identical MAC addresses on the same segment. Generate new addresses and the problem never exists.
“Import hard drives as VDI” — leave this checked. It converts the stream-optimized VMDK into VirtualBox’s native VDI format during import. Beyond being the better-supported format on VirtualBox, it is the one that can be resized later: VBoxManage modifymedium --resize works on VDI and VHD, but not on VMDK. If you ever need more than 64 GiB, you will want VDI.

Set the machine name and base folder to match your local convention, then click Finish. The import takes a few minutes, most of which is the disk conversion.

Step 4: Correct two exported settings, and choose your networking

Before the first boot, open the imported machine’s Settings and make two changes.

Turn off Remote Display. The appliance was exported with VirtualBox’s remote display server (VRDE) enabled, TLS-secured, and pointed at certificate and private-key paths belonging to the machine that built the image — paths that will not exist on your host. The listener is bound to 127.0.0.1:5908, so this is not a network exposure, but the server cannot initialize against missing certificates and you may see a remote-display error when the machine starts. Nothing in SimpleRisk depends on it. Go to Settings → Display → Remote Display and clear Enable Server.

Then decide how the virtual machine reaches the network. This is the step that most often derails a first appliance installation, because the exported adapter is NAT and NAT does not allow your host browser to reach the guest. Under NAT the guest receives a private address, typically 10.0.2.15, on a segment that exists only inside VirtualBox. Reading that address off the console and typing it into your browser cannot work. Choose one of three modes:

Mode	Reaching the interface	Use when
NAT with port forwarding	`http://localhost:8080/` on the host	Single-user evaluation on a laptop. The guest stays invisible to your network, which is the safest default while the appliance still has its stock credentials.
Bridged adapter	`http://{guest-IP}/` from any machine on the network	Shared demonstrations and pilots — anything more than one person needs to reach. The machine takes an address from your network’s DHCP like a physical host.
Host-only adapter	`http://{host-only-IP}/` from the host only	Isolated lab work where the machine must reach neither the internet nor the local network. Note that Extras, framework downloads, and the update check all require outbound HTTPS, so plan on a second adapter if you need them.

For NAT with port forwarding, go to Settings → Network → Adapter 1 → Advanced → Port Forwarding and add a rule:

Name	Protocol	Host IP	Host Port	Guest IP	Guest Port
simplerisk-http	TCP	127.0.0.1	8080	leave blank	80

Binding the host IP to 127.0.0.1 keeps the forwarded port reachable only from your own machine. Add a second rule (host 8443 to guest 443) if you intend to use the appliance’s HTTPS listener, and a third (host 2222 to guest 22) if you would rather administer the appliance over SSH than through the VirtualBox console window.

For bridged, set Settings → Network → Adapter 1 → Attached to: Bridged Adapter and select the host network interface that carries your local network. Two cautions: on corporate networks, port security or network access control may reject the machine’s new MAC address, and the appliance takes a DHCP lease rather than a fixed address. If you are standing up a pilot that people will bookmark, reserve the address on your DHCP server or configure a static address inside the guest.

Step 5: Boot the appliance and log in at the console

Start the virtual machine and let it boot to a console login prompt. Log in with the appliance’s default operating system credentials:

Login:    simplerisk Password: simplerisk

This account has sudo access, authenticated with the same password. You will need it in Step 7.

Step 6: Reach the web interface

If you chose NAT with port forwarding, browse from the host to:

http://localhost:8080/

If you chose bridged or host-only, find the guest’s address at the console:

ip addr show

Ignore the loopback interface (lo, 127.0.0.1) and take the IPv4 address on the Ethernet interface. On a bridged adapter that is an ordinary address from your network’s range. Browse to http://{that-address}/ from any machine that can reach it.

Either way, you should arrive at the SimpleRisk login page. The appliance ships already installed, so the default application credentials are:

Username: admin Password: admin

If you instead arrive at the installation wizard, the appliance’s install state did not survive the import — uncommon, and usually a sign that the disk image was truncated. Re-verify the download checksum, and if it is correct, complete the installation using the initial configuration wizard documented in the Administrator Guide.

Step 7: Change every default credential

Do this before the appliance holds real data

The appliance ships with five secrets at published defaults. Until they are rotated, treat the machine as an open instance and keep it on NAT with a loopback-bound port forward.

Rotate all five in one sitting. The knowledge base article How to Secure Your SimpleRisk VM gives the step-by-step commands; the inventory is:

The simplerisk operating system user — run passwd at the console.
The operating system root account — run sudo passwd root.
The MySQL root user. The appliance generates a MySQL root password on first boot and leaves it in a file in /root (root_mysql_password.txt). Read it, change the password with mysqladmin -u root -p password '{new-password}', then delete the file.
The MySQL simplerisk application user — ALTER USER 'simplerisk'@'localhost' IDENTIFIED BY '{new-password}'; followed by FLUSH PRIVILEGES;. This one has a second half that is easy to forget: update DB_PASSWORD in /var/www/simplerisk/includes/config.php to match, or the application loses its database connection on the next request.
The SimpleRisk admin account — in the web interface, go to Admin → My Profile and change the password. While you are there, set a real email address so password resets and notifications work.

Consider VirtualBox disk encryption on the imported machine as well, under Settings → General → Disk Encryption, which requires the VirtualBox Extension Pack. On a laptop that leaves the building with risk data on it, that is worth the startup password prompt.

Step 8: Record your baseline and finish the standard setup

The appliance is now an ordinary SimpleRisk installation on a Linux host that you own. Two closing tasks.

Record what you actually received. You are responsible for patching this stack, so establish what is in it:

cat /etc/os-release      # Ubuntu release, for the OS patch cadence php -v                   # PHP version (SimpleRisk requires 8.3.0 or newer) mysql --version

Then complete the same post-installation work that any deployment needs, none of which the appliance can do for you:

Set the base URL to the address your users will actually type, so that emailed links resolve. A mismatched base URL is the usual cause of “the link in the notification goes nowhere.”
Put a real certificate in front of it if this is anything more than a laptop demonstration.
Confirm the cron jobs are scheduled and running. Notifications, scheduled reports, and maintenance tasks all depend on them.
Set up database backups on a schedule that ships the output off the host.
Take a VirtualBox snapshot of the freshly hardened, freshly configured appliance. It is the cheapest rollback point you will ever have, and the right thing to take again before every upgrade.
Install the Extras you are licensed for.

Common Pitfalls

A handful of patterns recur with appliance deployments.

Trying to browse to the guest’s NAT address. 10.0.2.15 is reachable from inside the virtual machine and nowhere else. If the console shows a 10.0.2.x address and your browser times out, you are on NAT without a port-forwarding rule. Add the rule from Step 4 and browse to http://localhost:8080/, or switch the adapter to bridged.
Keeping the appliance’s baked-in MAC address. One import on NAT is fine. A second copy, or any copy on a bridged network alongside another, produces duplicate-MAC symptoms that are genuinely unpleasant to diagnose: intermittent connectivity, ARP flapping, a switch port that stops forwarding. Choose “Generate new MAC addresses for all network adapters” at import.
Chasing the remote-display error. The appliance exports with VRDE enabled and TLS certificate paths from the build machine. Any error it produces concerns those missing certificates, not a broken appliance. Clear Enable Server and move on.
Leaving the defaults in place “just for now.” The operating system password, the root password, and the administrator password are published in our public knowledge base. An appliance on a bridged corporate network with stock credentials is an open instance.
Treating the appliance as maintained by SimpleRisk. The image is a point-in-time build. Nothing patches its Ubuntu packages, its PHP, or its MySQL but you. An appliance imported and never updated accumulates operating-system vulnerabilities indefinitely, regardless of how current the SimpleRisk application inside it is.
Upgrading by importing the next appliance. A newer appliance is a new, empty instance. Importing it does not carry your data across, and running the two side by side on the same network invites confusion about which one is real. Upgrade the appliance in place, exactly as you would any Linux installation, and take a snapshot first.
Running a real deployment on the exported 2 GB and 2 virtual CPUs. Those defaults suit an evaluation. The Administrator Guide puts a mid-size deployment at 2–4 virtual CPUs and 4–8 GB of RAM, and the appliance runs Apache, PHP, and MySQL together on one host. Raise the allocation before you load frameworks or import scanner data, not after users start reporting slow pages.
Assuming the 64 GiB disk is a fixed cost, or that it can be reduced. The disk is thin-provisioned: it consumes a few gigabytes at first and grows toward 64 GiB as data accumulates. It does not shrink when data is deleted, and VirtualBox cannot shrink it for you. Watch the host’s free space.
Importing as VMDK and needing to resize later. VBoxManage modifymedium --resize supports VDI and VHD only. If you cleared “Import hard drives as VDI” and later need a larger disk, you have a format conversion ahead of you first.
Mistaking a snapshot for a backup. A VirtualBox snapshot of a running machine captures MySQL mid-transaction and lives on the same host disk as the machine itself. It is an excellent rollback point for an upgrade and it is not a backup strategy.
Skipping the checksum because the download “looks fine.” The archive has no manifest and the import validates nothing. A truncated download can import successfully and fail later in ways that look like application defects. The verification is one command.
Clock drift after the host sleeps. Suspending a laptop suspends the guest’s clock with it. A guest whose time has drifted produces cron jobs that fire late or not at all, notification timestamps that do not line up, and audit-trail entries in the wrong order. If you see this, confirm time synchronization inside the guest with timedatectl status, and that VirtualBox Guest Additions time synchronization is active.

Appliance Reference

Appliance artifacts	`simplerisk-{version}-virtualbox.zip`, containing `simplerisk-{version}.ovf` (OVF 1.0 envelope, VirtualBox machine format 1.19-linux) and `simplerisk-{version}-disk001.vmdk` (stream-optimized VMDK). There is no `.mf` manifest, so the MD5 published on the download page is the only integrity control.
Imported machine defaults	Ubuntu 64-bit guest; 2 virtual CPUs; 2048 MB RAM; 64 GiB thin-provisioned disk on a SATA/AHCI controller; VMSVGA graphics with 33 MB video memory; one E1000 adapter attached to NAT; fixed MAC address; VRDE enabled on `127.0.0.1:5908` with build-host certificate paths.
Default credentials	Operating system: `simplerisk` / `simplerisk` (sudo-capable). MySQL root: generated at first boot, written to `/root/root_mysql_password.txt`. MySQL application user: `simplerisk`@`localhost`. Application: `admin` / `admin`. All must be rotated — see Step 7.
Key paths in the guest	`/var/www/simplerisk/` (web root), `/var/www/simplerisk/includes/config.php` (database credentials, written when the image was built), `/var/www/simplerisk/logs/` (operational logs).
Database	The full schema, already created and populated when the image was built. No install-time schema fetch is performed.
Host requirements	VirtualBox 7.0 or newer with hardware virtualization enabled; the VirtualBox Extension Pack only if you use disk encryption. Outbound HTTPS from the guest is required for Extras, framework content, and update checks.

Summary

These instructions should have allowed you to download, verify, import, network, and secure the SimpleRisk VirtualBox appliance, and to reach a working SimpleRisk instance in your browser. If you have run into any issue or have questions, please contact us at support@simplerisk.com.