ZenPlus Appliance

Download ZenPlus 1.24.14 · CLI edition r2

A ready-to-run appliance with HTTPS management, a setup console and preinstalled monitoring services. Every fresh import generates its own appliance identity. The authenticated Zentryc console requires new console and web passwords before enabling remote HTTPS.

Public verification key · Release notes · Platform qualification and provenance · Software notices

Verify before importing

Download the checksum and signature alongside your archive. Compare its SHA-256 with the checksum file, then verify the checksum signature with the public key.

Get-FileHash .\YOUR-DOWNLOAD -Algorithm SHA256

openssl pkeyutl -verify -pubin -inkey zentryc-release.pub -rawin -in YOUR-DOWNLOAD.sha256 -sigfile YOUR-DOWNLOAD.sha256.sig

Each KVM and Hyper-V package includes both disks, a checksum manifest, an import helper and instructions. The helpers verify the extracted disks and copy them into a new VM directory. Keep the unbooted master disks for future fresh imports.

Deploy on VMware ESXi 8+

1. In the ESXi Host Client, choose Create / Register VM → Deploy a virtual machine from an OVF or OVA file. In vSphere, use Deploy OVF Template. Select the OVA, a new VM name and a datastore.
2. Map the appliance management network to a trusted port group with DHCP. Choose thin provisioning if appropriate and retain both disks, 4 vCPUs and at least 8 GiB RAM.
3. Confirm EFI firmware and Secure Boot remain enabled. Ensure the ESXi host has the correct time and keep VMware guest time services available.
4. Power on and open the VM console. Allow several minutes for first initialization, then follow the first-login steps below.

The OVA uses VMware hardware version 20, supported by ESXi 8.0 and later. Native ESXi qualification is pending. VMware hardware compatibility reference.

Deploy on KVM / QEMU

Use a native KVM host with libvirt 8.6+, virsh, Python 3.11+ and OVMF Secure Boot firmware with enrolled Microsoft keys. Provide an existing management bridge with DHCP and keep the VM’s RTC in UTC.

tar -xzf zenplus-appliance-1.24.14-kvm-r2.tar.gz
cd zenplus-1.24.14-kvm
sudo python3 create-kvm.py --name ZenPlus --bridge br0 \
  --directory /var/lib/libvirt/images/zenplus --start

Replace br0 with your existing bridge. Choose a new VM directory that your libvirt security policy permits and the QEMU service can read. Open the VM’s graphical console with Virtual Machine Manager or virt-viewer.

Preview: CLI r2 tested with VirtIO devices and UEFI Secure Boot using QEMU software emulation. The r1 base passed offline initialization tests; r2 functional checks used networking. Native KVM/libvirt qualification and internal-port scanning are pending. libvirt Secure Boot requirements.

Deploy on Microsoft Hyper-V

Extract the ZIP. In an administrator PowerShell session, open the extracted zenplus-1.24.14-hyperv folder and run:

.\Import-ZenPlus.ps1 -Name ZenPlus -SwitchName 'External' -VMDirectory 'D:\VMs\ZenPlus' -Start

Replace External with your existing virtual switch connected to a trusted DHCP network, and select a new VM directory. The helper creates a Generation 2 VM with fixed 8 GiB RAM, 4 CPUs, both SCSI disks and the Microsoft UEFI Certificate Authority Secure Boot template. It removes NTFS compression and sparse flags from the copied disks and disables automatic checkpoints for the new VM.

Keep the host clock accurate and the Time Synchronization integration service enabled. Open Connect in Hyper-V Manager for the console.

Preview: the r1 base profile passed native boot and dashboard checks. CLI r2 native login, setup, trial, backup/restore and cold-boot qualification remain pending. No new native Hyper-V acceptance run is claimed. Hyper-V Secure Boot settings.

First login: change both passwords

The public setup login is admin / Zentryc@Setup123. It is used only for first-time setup. HTTP and HTTPS stay closed to remote clients until you replace both passwords at the VM console.

1. Open the VM console. Sign in with the setup login. Enter and confirm a new console administrator password (12–128 characters with uppercase, lowercase, a number and a symbol).
2. Set the web administrator password. Enter and confirm a different password (12–128 characters; avoid common passwords and your username). The console opens HTTPS only after both changes finish.
3. Open the dashboard. Run show interfaces to see its HTTPS address. Compare the TLS certificate fingerprint with the console, then sign in as admin using your new web password.
4. Start monitoring. Add devices, credentials, agents or flow exporters and configure notifications. Activate a license later in subscription settings or with enable then license activate.

The trial lasts 30 days from first initialization, with 50 devices, 20 service checks and 5 users. Console and web passwords are independent after setup. Local console login uses no MFA; web MFA settings remain independent. There is no default SSH password.

Use the Zentryc command CLI

Type help or ?; Tab completes supported commands. The CLI has operational, privileged and configuration modes.

zentryc> show version
zentryc> show interfaces
zentryc> show services
zentryc> show license
zentryc> enable
zentryc# configure terminal
zentryc(config)# interface ens160
zentryc(config-if)# ip address 192.0.2.10/24
zentryc(config-if)# ip gateway 192.0.2.1
zentryc(config-if)# ip dns 1.1.1.1 8.8.8.8
zentryc(config-if)# commit
zentryc(config-if)# commit confirm
zentryc(config-if)# end
zentryc# backup create config
zentryc# show backups
zentryc# show updates
zentryc# password console
zentryc# logout

Replace the interface and addresses with values for your network. Confirm a network commit within 120 seconds; otherwise an independent guard restores the previous settings. Updates retain signature verification and the configured rollout policy. Paid activation and a real upgrade/rollback are not yet fully qualified on this download.

Optional SSH access

After setup, run enable and ssh key add, then paste an OpenSSH public key. Connect with ssh -t zencli@APPLIANCE-IP using the matching private key and sign in with your console administrator password. SSH opens the same restricted CLI; arbitrary shell commands, forwarding and SFTP are disabled for this account.

Connect your telemetry

Database ports remain private. Place the appliance on a trusted management network, configure the management allowlist and install an organization-trusted certificate for normal operation.

Recovery and support

The authenticated CLI provides network configuration with timed rollback, service status, console password changes, restart and shutdown. Manage web passwords and MFA in the dashboard. Use Storage for backups and Support for diagnostic bundles. Keep an independent hypervisor backup before major changes. A fresh import creates a separate appliance; it does not restore an existing deployment’s data.

Contact Zentryc · Third-party software notices