How to install Ubiquiti UniFi controller on the cloud

Home Lab

Recently I replaced my wireless router, an Asus RT-AC66U, with an Ubiquiti EdgeRouter X router and Ubiquiti UAP-AC-LR access point. Both of which are a HUGE step up over traditional consumer wireless routers.

The Ubiquiti access points use software called the Ubiquiti UniFi controller to configure and control the access points which can be installed locally or in the cloud – allowing you to manage the access points no matter where they are located.

To automate the install process, I created a simple script to deploy the Ubiquiti UniFi Controller in the cloud on a Ubuntu server, and have also tested the script on three popular VPS providers: Linode, Vultr, and DigitalOcean – all three worked perfectly!

Linode would be my first choice as they offer the best performance and with 1CPU and 2GB RAM you’ll have more than plenty of resources to run Ubiquiti UniFi Controller and manage many sites and access points.

If you have a small deployment, Vultr would easily be my choice with 1CPU and 768MB RAM! All three providers also cost less than AWS and Azure.

For my deployment I went with Linode as I plan on using it to control not only my home access points but to control the access points of customers and family as well.

Lets begin…

Create a cloud server for the UniFi Controller

  1. First step is to create your Linode node and to do so simply select your node size and location and click on “Add this Linode!“.
    Create Linode node
  2. Next click on “Dashboard“.
    Linode node dashboard
  3. We need to deploy an operating system on our new node so click on “Deploy an Image“.
    Deploy image on Linode node.
  4. For image type select “Ubuntu 16.04 LTS” and set your root password then click on “Deploy“.
    Deploy Ubuntu image on node.
  5. Wait until the three Host Job Queues are complete (initial config, disk create, and file system create) and then click on “Boot“.
    Boot Ubuntu node

Your new node is now built and ready to have the Ubiquiti UniFi controller installed onto it.

Install Ubiquiti UniFi Controller on Ubuntu

While the Ubiquiti UniFi controller install process is pretty easy, I’ve tried to make the process even easier by scripting it. It’s now as simple as running one single command.

The script is hosted on GitHub (unifi-autoinstall) and I strongly urge everyone to view the source and inspect it before running it as it’s never good practice to blindly run scripts. So with that lets get started…

  1. SSH into your new Linode node using PuTTy or Terminal and type the following command and press Enter to download the script to your server. 
    wget https://raw.githubusercontent.com/miketabor/unifi-autoinstall/master/install.sh

    wget unifi-autoinstall script from GitHub

  2. Next lets view the script to see what it does by typing the following: 
    less install.sh

    less install.sh unifi script

  3. You can now view the contents of the UniFi autoinstall script, install.sh. Once you’ve viewed it you can press q to exit and continue on.
    Less output of Unifi install.sh
  4. Now lets actually run the script. Type the following to start the script to auto configure the firewall, Fail2ban and install the Ubiquiti UniFi Controller. 
    sudo bash install.sh

    sudo bash install unifi script

  5. When the script finishes, typically less than 1 minute, you’ll see a message letting you know it’s finished and to log into your new UniFi controller by going to: https://<SERVER_IP>:8443
    UniFi-autoinstall install completed.

That’s it! The Ubiquiti UniFi Controller is now ready to for use. Now go ahead and go to https://<SERVER_IP>:8443 and finish the UniFi Controller wizard. Finally, beefore we move on to far I wanted to quickly explain what exactly the script is doing.

  • First it updates all the packages on Ubuntu.
  • Configures UFW to allow only SSH and the needed Ubiquiti UniFi ports (per ubiquiti documentation)
  • Installs latest version 5 UniFi controller and its dependencies.
  • Finally installs Fail2Ban and configures it to protect SSH (default) as well as the UniFi login page!

Now lets discover and register the new access points to the UniFi controller.

How to register access points to UniFi controller in the cloud

The last step is to register the access point(s) with the UniFi Controller on the cloud, in this case Linode.

  1. Open the Ubiquiti Discovery Tool or use the Ubiquiti Chrome extension.
  2. Typically right away the discovery tool will find all the access points on your local network. Next to the one you want to register with the UniFi controller click on “Action“.
    Ubiquiti discovery tool.
  3. In the Actions drop down set to “Set Inform” and change the Inform URL to: https://<UniFi_Server_IP–OR–FQDN>:8080/inform
    Inform UniFi of access point.
  4. Now go to your UniFi Controller and the Ubiquiti access point should be listed and awaiting your action. Click on Adopt.
    Adopt access point on UniFi controller

That’s it! That completes setting up a Ubiquiti UniFi controller in the cloud and registering your access point with the new UniFi controller. The only steps left would be to setup your SSID, policies, additional sites, and so on.

Hope this helps and enjoy!

Lets hear from you

Got an idea how to make this process even better, share your thoughts below in the comments!

Similar Posts

  • How to enable SSH auto login on Ubiquiti EdgeRouter X

    Home Lab
    5 Comments

    edgerouter ssh key auto login

    SSH key authentication not only provides a more convenient way to logging into your EdgeRouter X, but is also more secure because the private key replaces the need of a password and thus is typically more difficult to brute force.

    The below steps will show how to generate a SSH key, add it to the router, and then disable password authentication so that only the key-pair can be used to login.

    Read More “How to enable SSH auto login on Ubiquiti EdgeRouter X”

  • Install Synology NFS VAAI Plug-in for VMware

    Home Lab
    4 Comments

    Synology

    In the recent DSM update (5.1), Synology added VMware VAAI support for NFS volumes using two primitives which are Full File Clone and Reserve Space. What do these VAAI primitives offer?

    • Full File Clone enables virtual disks to be cloned by the NAS albeit while the machine is powered off.
    • Reserve Space allows you can create a thick VMDK file. However Reserve Space does not off-load the work to the array. The benefit of thick VMDKs is that many use eager-zero for high I/O performance needs.

    On the Synology side of things you just need to update to DSM 5.1, but in order to take advantage of VAAI you still need to install the VIB plugin on your ESXi 5.5 hosts.

    Read More “Install Synology NFS VAAI Plug-in for VMware”

  • Crucial 16GB memory, perfect for Intel NUC

    Home Lab
    0 Comments

    crucial 16gb 204pin memory

    I’m a huge fan the of Intel NUC‘s for a VMware home lab. In fact I just recently picked up my third Intel NUC to give me more head room for a small VMware Horizon (View) environment at home.

    I typically use G.Skill memory in my NUC’s as I’ve had great luck with the brand in my desktop and laptop for years. However G.Skill has been increasing in price which made me look around for alternatives and came across Crucial DDR3 204-pin memory for less money, but days after I purchased it they too went up in price. However they are now back on sale and cost about $50 less then the G.Skill memory I have been using in my first two NUC’s.

    I’ve been using the Crucial memory now for the last several months without any problems and even though they are rated at a lower voltage I can’t say I really see any difference in power savings or consumption compared to the G.Skill 1.5V. If you’re looking to upgrade now might be a good time to take advantage of the sale price.

  • Secure your Synology NAS, install a SSL certificate

    Home Lab
    154 Comments

    I’ve been using the default setup on my Synology DS412+ with HTTPS enabled for a while now but knew it really wasn’t all that secure without a proper SSL certificate and creating a self-signed certificated isn’t all the much better and can be easily forged. I decided it was about time I used a “real” certificate to better secure the NAS.

    Prerequisites before starting

    • You need to own a domain name, for example MikeTabor.com and be able to receive email from the domain name.
      If you don’t already have a webhost for the domain, I’d suggest BlueHost.

    • You also need a DDNS service setup. In this case and for my use, I simply use the Synology DDNS service they offer for free.
    • With those two setup, you will also want to add a CNAME DNS forward from your domain (or subdomain if you wish to go that route) to your DDNS service.
    • Finally you’ll want to make sure Port Forwarding has been configured on your router.

    Read More “Secure your Synology NAS, install a SSL certificate”

  • My VMware ESXi Home Lab Upgrade

    Home Lab
    39 Comments

    Although the focus in my career right now is certainly more cloud focused in Amazon Web Services and Azure, I still use my home lab a lot.

    For the last 5+ years my home lab had consisted of using 3x Intel NUC’s (i5 DC53427HYE), a Synology NAS for shared storage and an HP ProCurve switch. This setup served me well for most of those years. It has allowed me to get many of the certifications I have, progress in my career and have fun as well.

    At the start of this year I decided it was time to give the home lab an overhaul. At first I looked at the newest generation of Intel NUC’s but really wasn’t looking forward to dropping over $1,300 on just partial compute (I’d still need to be RAM for each of the 3 NUC’s). I also wanted something that just worked, no more fooling around with network adapter drivers or doing this tweak or that tweak.

    I also no longer needed to be concerned about something that had a tiny footprint. I also questioned if I really needed multiple physical ESXi hosts. My home lab isn’t running anything mission critical and if I really wanted I could always build additional nested VMware ESXi hosts on one powerful machine if I needed.

    So in the end, the below is what I settled on. Replacing all of my compute, most of my networking and adding more storage!

    Read More “My VMware ESXi Home Lab Upgrade”

  • Microsoft’s Convenience Update breaks VMware VMXNet3 vNICs

    VMware
    1 Comment

    Microsoft recently pushed out a “Convenience Update“, a sort of rollup of rollups for Windows Server 2008 R2 SP1 and Windows 7 machines. This “Convenience Update” however comes with an incompatibility issue with VMware virtual machines that are using VMXNet3 network adapters, which causes the network to become unresponsive.

    Read More “Microsoft’s Convenience Update breaks VMware VMXNet3 vNICs”

Leave a Reply to faris Cancel reply

Your email address will not be published. Required fields are marked *

24 Comments

  1. Did you really just suggest I randomly curl straight into bash from a shortened URL?

    I mean, I looked at the script, it was fine. But come on bud. Don’t do that.

    Reply

    1. bob, I angered the bash gods for sure and have corrected my mistake. Please refresh the page and the CORRECT way of loading this script has been added. :)

      Thanks for the comment!

      -Michael

      Reply

  3. i followed your guide from “Install Ubiquiti UniFi Controller on Ubuntu” , as i used cloudatcost services and unifi 5.2.9 is running and it sees the UAP when i click adopt it shows adopting for a few minutes then shows disconnected, the UAP is connected to an edgerouter x inside of my ISP router , is there ports i need to open

    Reply

      1. Yes it’s a edge router behind my ISP router, I got it working, was not issuing the inform command the second time after I was selecting adopt, thanks for your help

  5. Nice, I have been looking for a way to tie fail2ban in with web login. I had to add a few things to make it work for me though. I was getting a couple errors upon restarting Fail2Ban.

    “Failed during configuration: Bad value substitution: section: [ubiquiti] option : action key : port rawval : “, protocol=”%(protocol)s”, chain=”%(chain)s”]”
    So for this, I added ‘port=8443′ in my jail.local file under the Ubiquiti chain.

    After specifying the port and restarting Fail2Ban I was given a warning, “ignoreregex’ not defined in ‘definition'”
    I added ‘ignoreregex=’ to /etc/fail2ban/filter.d/ubiquiti.conf

    All is well now I think. Please let me know if you think I should change the way I set Fail2Ban. Was your instance not throwing any errors?

    Reply

    1. Frank,

      Thanks for the suggestions. What OS did you install this on? I did not have any errors during my setup nor am I having any issues with Fail2Ban blocking failed attempts.
      -Michael

      Reply

      1. Michael,

        I installed on Ubuntu 14.04.5 LTS. I had everything already installed except the the ubiquiti F2B chain. So I essentially just used line 42-47 of your script to set that up. I’m horrible with regular expressions. If I would have ever tried to set that up, it probably would have taken me a month to do so. I think your script is the only one out there that adds the ubiquiti chain to F2B. Without that in place somebody could try to brute force, 24 hrs a day, 7 days a week, until cracked. If anybody is reading this and wondering if they might need F2B installed with the ubiquiti chain, don’t wonder too long! I’m very thankful for your post.

        This is what my configuration looks like:

        /etc/fail2ban/jail.local
        [ubiquiti]
        enabled = true
        filter = ubiquiti
        logpath = /usr/lib/unifi/logs/server.log
        maxretry = 3
        bantime = 31557600
        findtime = 900
        port = 8443,8080

        /etc/fail2ban/filter.d/ubiquiti.conf
        [Definition]
        failregex =^.*Failed .* login .* *s*$
        ignoreregex =

      2. @frankabbot:disqus I’m not a security guru but do I do have an interest it in so things like this script above I try to be at least a little security conscious.

        I’m glad the Fail2Ban is working fine for you as well. I’ve had little to no problem with people trying to brute force my UniFi controller but it’s nice knowing there’s an extra layer of protection there. ;)

        -Michael

    1. @Propupul,

      I’ve modified the UFW rule that’s part of the install script above and instead entered the following:

      sudo ufw allow from 1.2.3.4 to any port 22

      Replacing 1.2.3.4 with your IP address. Now the firewall will only allow SSH (port 22) connections from that IP address!

      Hope this helps.

      Reply

  7. hello, thanks for this script. Just copied the fail2ban part to add to my already running unifi controller. I been waiting for a good minute on ubiquiti to add some kind of 2 factor authentication to unifi . I really wonder how many people use their controller in the cloud with this lack of security login ! The same for the aircontrol server. do you think you could provide me the fail2ban configuration for it ? thanks

    Reply

  8. thanks for the post.
    question for you. i ran the script but i keep getting this error. what’s the work around here if you encourted it.

    thanks,

    [ubiquiti]
    enabled = true
    filter = ubiquiti
    logpath = /usr/lib/unifi/logs/server.log
    maxretry = 3
    bantime = 3600
    findtime = 900
    port = 8443
    banaction = iptables[name=ubiquiti, port=8443, protocol=tcp]
    Job for fail2ban.service failed because the control process exited with error code. See “systemctl status fail2ban.service” and “journalctl -xe” for details.
    JSVC_EXTRA_OPTS=”$JSVC_EXTRA_OPTS -Xss1280k”

    Reply

  9. Hi , Thanks for the script , everything works great, but I cant access the unifi web console , It says that the IP refusses the connection.

    I am using LINODE

    Reply

      1. my issue was same with Jorge :

        [ubiquiti]
        enabled = true
        filter = ubiquiti
        logpath = /usr/lib/unifi/logs/server.log
        maxretry = 3
        bantime = 3600
        findtime = 900
        port = 8443
        banaction = iptables[name=ubiquiti, port=8443, protocol=tcp]

        Job for fail2ban.service failed because the control process exited with error code. See “systemctl status fail2ban.service” and “journalctl -xe” for details.
        JSVC_EXTRA_OPTS=”$JSVC_EXTRA_OPTS -Xss1280k”

  11. Hello,
    Thanks for the procedure. I have the Linode running smoothly on Ubuntu 16.04 LTS, the install script successfully completed displaying “Access controller by going to https://:8443“. However, when I try to connect to “https://XXXX:8443” with both Chrome or Firefox, using my specific Linode IP address, the connection is refused. What happens? Any idea how I can debug this glitch? Thank you for your insights.

    Reply