SonarQube Hardened AMI

1Full stack architecture

Complete SonarQube hardened stack deployed on a single EC2 t3.large instance (8 GB RAM) with all security tools preinstalled.

Important system paths

# SonarQube application
/opt/sonarqube/
  conf/sonar.properties    # Database and JVM config
  bin/linux-x86-64/sonar.sh
  logs/

# Data directories
/var/sonarqube/
  data/    # Elasticsearch indices
  temp/    # Scratch space
  logs/    # Application logs

# systemd units
/etc/systemd/system/sonarqube.service
/etc/systemd/system/set-sonar-password.service

# Password rotation scripts
/usr/local/bin/set-sonar-password.sh
/usr/local/bin/ver-password.sh

# Credentials (only readable by root)
/root/sonarqube-admin-password.txt
/root/README-AMI.txt

systemd services

sonarqube.service            -> main application (forking)
set-sonar-password.service   -> rotates admin password on boot (oneshot)
postgresql.service           -> database
clamav-freshclam.service     -> antivirus signature updates
fail2ban.service             -> SSH brute-force protection
auditd.service               -> kernel-level audit logging
ufw.service                  -> host firewall (oneshot)

2Endpoints

SonarQube exposes a web UI, a REST API, and a database connection for direct queries.

Example API calls

# Check SonarQube is up
curl -s http://localhost:9000/api/system/status | jq .

# Verify admin credentials
curl -u admin:AdminDefault1! http://localhost:9000/api/users/current

# List all projects
curl -u admin:PASSWORD http://localhost:9000/api/projects/search

3Password rotation

On every boot, set-sonar-password.service reads the EC2 Instance ID via IMDSv2 and rotates the SonarQube admin password to a deterministic value derived from it.

Password rule

Password = "I-" +  + "B!"

Example:
  Instance ID:  i-0d267b6251f053ad8
  Password:     I-0d267b6251f053ad8B!

Rotation flow

1. Read Instance ID from IMDSv2:
   TOKEN=$(curl -s -X PUT "http://169.254.169.254/latest/api/token" \
     -H "X-aws-ec2-metadata-token-ttl-seconds: 300")
   INSTANCE_ID=$(curl -s -H "X-aws-ec2-metadata-token: $TOKEN" \
     http://169.254.169.254/latest/meta-data/instance-id)

2. Build PASSWORD = "I-${INSTANCE_ID#i-}B!"

3. Wait for SonarQube to respond on /api/system/status

4. Check if admin/AdminDefault1! still works:
   curl -u admin:AdminDefault1! /api/users/current   -> 200

5. If yes, POST /api/users/change_password with:
   login=admin
   previousPassword=AdminDefault1!
   password=I-B!

6. Save credentials to /root/sonarqube-admin-password.txt (0600)

Manual rotation

# Force rotation at any time
sudo /usr/local/bin/set-sonar-password.sh

# View current credentials
sudo /usr/local/bin/ver-password.sh
sudo cat /root/sonarqube-admin-password.txt

4systemd services

Basic commands

# Status
sudo systemctl status sonarqube postgresql clamav-freshclam fail2ban auditd

# Restart SonarQube
sudo systemctl restart sonarqube

# Enable/disable at boot
sudo systemctl enable sonarqube
sudo systemctl disable sonarqube

# Check all our services are enabled
sudo systemctl is-enabled sonarqube set-sonar-password postgresql clamav-freshclam fail2ban auditd ufw

sonarqube.service structure

# /etc/systemd/system/sonarqube.service
[Unit]
Description=SonarQube service
After=syslog.target network.target postgresql.service

[Service]
Type=forking
ExecStart=/opt/sonarqube/bin/linux-x86-64/sonar.sh start
ExecStop=/opt/sonarqube/bin/linux-x86-64/sonar.sh stop
User=sonarqube
Group=sonarqube
Restart=on-failure
RestartSec=10
LimitNOFILE=131072
LimitNPROC=8192
LimitCORE=infinity
LimitMEMLOCK=infinity
TasksMax=infinity
Environment="JAVA_HOME=/usr/lib/jvm/java-21-openjdk-amd64"
Environment="SONAR_JAVA_PATH=/usr/lib/jvm/java-21-openjdk-amd64/bin/java"

[Install]
WantedBy=multi-user.target

Adjust JVM memory

sudo vim /opt/sonarqube/conf/sonar.properties

# Default (t3.large / 8 GB):
sonar.web.javaOpts=-Xmx1536m -Xms512m -XX:+HeapDumpOnOutOfMemoryError
sonar.ce.javaOpts=-Xmx1536m -Xms512m -XX:+HeapDumpOnOutOfMemoryError
sonar.search.javaOpts=-Xmx1024m -Xms1024m -XX:+HeapDumpOnOutOfMemoryError

# Restart after changes
sudo systemctl restart sonarqube

5PostgreSQL

SonarQube uses PostgreSQL for its relational data. Default database and user are both called sonarqube.

Connect

# As the postgres user
sudo -u postgres psql

# Directly into the SonarQube DB
sudo -u postgres psql -d sonarqube

Useful queries

-- List tables
\dt

-- Count users
SELECT count(*) FROM users;

-- Show admin row
SELECT login, hash_method, reset_password
FROM users WHERE login='admin';

-- Recent analysis jobs
SELECT uuid, status, submitted_at
FROM ce_queue
ORDER BY submitted_at DESC LIMIT 10;

Reset admin hash (recovery)

If both AdminDefault1! and the Instance-ID password fail, inject a known hash to recover access:

sudo systemctl stop sonarqube

sudo -u postgres psql -d sonarqube <<'SQL'
UPDATE users
SET crypted_password='100000$t2h8AtNs1AlCHuLobDjHQTn9XppwTIx88UjqUm4s8RsfTuXQHSd/fpFexAnewPsO6jGFQUv/24DnO55hY6Xew==',
    salt='k9x9eN127/3e/hf38iNiKwVfaVk=',
    hash_method='PBKDF2',
    reset_password='false',
    user_local='true'
WHERE login='admin';
SQL

sudo systemctl start sonarqube
sleep 120

# admin/admin now works -> change it to AdminDefault1!
curl -u admin:admin -X POST \
    "http://localhost:9000/api/users/change_password" \
    --data-urlencode "login=admin" \
    --data-urlencode "previousPassword=admin" \
    --data-urlencode "password=AdminDefault1!"

# Then re-run rotation
sudo /usr/local/bin/set-sonar-password.sh

6Security tools

This AMI ships with a full set of hardened security tools, all installed and enabled at boot.

Installed tools

How to run them

# Lynis full audit
sudo lynis audit system
sudo grep -E "^\s*(warning|suggestion)" /var/log/lynis-report.dat | head -40

# ClamAV scan
sudo clamscan -r /opt
sudo systemctl status clamav-freshclam

# OpenSCAP CIS Level 1
sudo oscap xccdf eval \
  --profile xccdf_org.ssgproject.content_profile_cis_level1_server \
  --results /root/openscap-results.xml \
  --report /root/openscap-report.html \
  /usr/share/xml/scap/ssg/content/ssg-ubuntu2404-ds.xml

# auditd
sudo systemctl status auditd
sudo ausearch -ts today | head -20

# fail2ban
sudo fail2ban-client status sshd

# UFW
sudo ufw status verbose

Hardening applied at build

• Kernel sysctl: vm.max_map_count=524288, fs.file-max=131072, kernel.dmesg_restrict=1, kernel.kptr_restrict=2
• User limits: nofile=131072, nproc=8192 for the sonarqube user
• Firewall: default deny incoming, ports 22 + 9000 open
• Audit rules: Neo23x0 baseline loaded into /etc/audit/rules.d/audit.rules
• Automatic security updates enabled

7Logs and monitoring

Service logs

sudo journalctl -u sonarqube -f
sudo journalctl -u sonarqube -n 200 --no-pager
sudo journalctl -u set-sonar-password --no-pager | tail -30

Application logs

sudo tail -f /var/sonarqube/logs/sonar.log
sudo tail -f /var/sonarqube/logs/web.log
sudo tail -f /var/sonarqube/logs/es.log     # Elasticsearch
sudo tail -f /var/sonarqube/logs/ce.log     # Compute Engine

System monitoring

free -h
df -h /
top -b -n 1 | head -20
sudo ss -tulpn | grep -E ':(5432|9000)'

Ports

sudo ss -tulpn | grep -E ':(22|5432|9000)'

8Troubleshooting

Quick diagnostic

# Services
systemctl is-active sonarqube postgresql clamav-freshclam fail2ban auditd
systemctl is-enabled sonarqube set-sonar-password postgresql clamav-freshclam fail2ban auditd ufw

# Ports
sudo ss -tulpn | grep -E ':(22|5432|9000)'

# SonarQube API
curl -s http://localhost:9000/api/system/status | jq .

# Default password check
set +H
curl -u 'admin:AdminDefault1!' -s -o /dev/null -w "%{http_code}\n" \
    http://localhost:9000/api/users/current

# Rotation log
sudo journalctl -u set-sonar-password.service --no-pager | tail -20

# Resources
free -h
df -h /

9AMI notes

Startup timeline

Launching multiple instances

To launch several instances from this AMI, ensure your security group allows inbound traffic to port 9000 from your management CIDR:

aws ec2 authorize-security-group-ingress \
  --group-id sg-xxxxxxxx \
  --protocol tcp \
  --port 9000 \
  --cidr <your-ip>/32

Instance recommendations

Files to know about