Skip to content
Octo × Server and installation PT Request an assessment

Octo for MapGuide Open Source servers

The map server comes up with one command. Who decides to open the port is you.

MapGuide Open Source 4.0 shipped on Oct 12, 2025, with a headless installer for Ubuntu 22.04, a generic package for other distributions and a Windows x64 installer. On Oct 22, 2026 the maintainer published the php2shell mitigation for 4.0 only. Octo installs in staging, audits the configuration, reads the logs, copies the repository and compares the old server with the new one by content. Passwords, open ports and the production cutover stay with the administrator and the technical lead.

Request an assessment See what it does
A terminal runs the headless MapGuide installer and checks the version through mapagent; Octo, in the center, connects the terminal to a server with ports 2810, 2811, 2812 and 8008 and to a fictitious municipal map served over WMS, with a human-approval badge before the port is opened $ sh mapguide…install.run -- --headless --with-rdbms --httpd-port 8008 --dry-run admin 2810 · client 2811 site 2812 · httpd 8008 $ service check GETSITEVERSION 4.0.0 ok WMS 1.3.0 ok WmsPassword default! serverconfig.ini [ClientConnectionProperties] ThreadPoolSize = 20 MaxConnections = 100 [GeneralProperties] MaxLogFileSizeEnabled = 0 [PerformanceLogProperties] Enabled = 0 ← measure first FACTORY DEFAULTS · ILLUSTRATION MGOS 4.0 · Ubuntu 22.04 web tier · Apache :8008 mapagent · WMS · WFS exposed (behind a proxy) mgserver daemon :2810 :2811 :2812 127.0.0.1 / internal only Repositories · Logs WMS GetMap · FICTITIOUS MUNICIPALITY OPEN PORT? administrator
MapGuide Open Source4.0final announced Oct 12, 2025
No major stable release6.5 yearsfrom 3.1.2 (Mar 27, 2019) to 4.0
Default ports2810–2812server; 8008 on the web tier
Sources12listed at the end of the page
01

What Octo does with the MapGuide server.

Six possible deliverables, drawn from the assessment. All of them start in staging or read-only, record version and build, and go to review by whoever is accountable for the server.

Repeatable installation

Runs the .run installer with --headless, the chosen providers and your ports, after checking the SHA-256 and a dry run with --dry-run.

Deliverable: installation script + log + check

Staging container

Since there is no official image, it builds one from the installer, with the repository and logs on volumes and a health check through the WMS document.

Deliverable: Dockerfile + test runbook

Configuration audit

Reads serverconfig.ini and webconfig.ini: mismatched ports, connection pool, session, logs switched off, factory WMS and WFS passwords and a single-core configuration on a multi-core machine.

Deliverable: findings by severity, without changing anything

Logs that explain the slowness

With Performance.log switched on by the administrator, it reads queues, average time and connections, and cross-checks Error.log against each layer's data source.

Deliverable: bottleneck summary and reversible proposals

Repository backup

Cold copy of Library and Site with the service stopped and a guaranteed restart, plus an .mgp package for the content, with SHA-256 and a restore test.

Deliverable: verified copy + restore runbook

Side-by-side migration

Inventory of the 3.x server, package load into the new 4.0 and a server-to-server comparison (version, maps, WMS), with the old one live until sign-off.

Deliverable: blocker inventory + differences report
02

Eight arms, one checked server.

The same Octo cycle, applied to installing and maintaining MapGuide. Each arm has a narrow role; the people open ports, change production passwords and accept the server cutover.

  1. Discovery

    Maps what already exists

    Version and build, distribution, ports, providers, services in /etc/init.d and where the repository and logs live.

  2. Data

    Maps the sources

    Each layer's data sources, FDO providers, UnmanagedDataMappings aliases and credentials, without copying them.

  3. Security

    Looks for factory defaults

    Default WMS and WFS passwords, a fixed AJP secret, ports 2810 to 2812 exposed, authoring switched on, embedded PHP without the mitigation and personal data published.

  4. Architecture

    Chooses the path

    Ubuntu or generic package, machine or container, side-by-side or in-place cutover, Apache with or without Tomcat.

  5. Development

    Writes the script

    Installation, audit, backup and check in shell and Python, with a log, dry-run mode and credentials read from the environment.

  6. Review

    Checks by content

    Version in GETSITEVERSION, the WMS root element, the list of maps and an image of each map. A 200 status is not a check.

  7. Release

    Prepares the cutover

    Only with your OK, it gets the new server ready and the rollback runbook written. DNS, proxy and firewall are changed by a person.

  8. Documentation

    Records what holds on your server

    Version and build, installer options, accepted configuration, backup location, who signed off and when.

Octo works in staging and read-only, in a support role. It does not change production passwords, open ports, accept the server cutover or answer for published data.

03

Each task, its own path.

The criteria Octo uses to choose, with the documentation for the installed version.

TaskPathNote
See the installation without installinginstaller.run -- --dry-run ...Shows ports, providers and user
Install headlessinstaller.run -- --headless --with-...Providers chosen one by one
Install in a container--no-service-install --no-mgserver-start --no-httpd-startThere is no official project image
Start, stop, status/etc/init.d/mapguide start|stop|status|restartmgserver run shows the startup error on screen
Change a passwordmgserver setpwd <user> <password>Human step; the password stays in the shell history
Load contentmgserver loadpackage <file.mgp>Or MgServerAdmin.LoadPackage
Site version and statusmapagent GETSITEVERSION, GETSITESTATUSDetails on the mapagent API page
Logs without SSHMgServerAdmin.GetLog, ClearLog, SetMaximumLogSizeRequires an administrator credential
Maintenance without killing the processMgServerAdmin.TakeOffline / BringOnlineSite offline, server alive
Repository backupCold copy of Library and Site; .mgp packageNew .NET tool in 4.0 replacing the PHP scripts
04

From an inherited server to your own server.

Three steps. Each one only makes sense after the previous one has shown results on your team.

A proposal, not a promise

1 Today

Inventory and audit

Octo shows what the server has and how it is configured, without touching anything.

  • Version, build, ports and providers
  • Configuration findings by severity
  • List of factory defaults that need a decision
Benefit: know the size of the risk before touching anything
2 Next

Staging and backup verified

A 4.0 staging server built by script and a backup tested by restoring it.

  • Repeatable installation, with a log
  • Cold copy and package with SHA-256
  • Comparison with the production server
Benefit: upgrading stops being a leap in the dark
3 Later

Routine maintenance

Updates like 4.0.1 follow the same runbook: staging, comparison, sign-off, cutover.

  • Versioned upgrade runbook
  • Automatic check after every cutover
  • Record of version and sign-off per server
Benefit: the same server, checked, on every version
05

Confirmed in a source.

Every point below has a source published by OSGeo (project page, official mailing lists, downloads area), by the official repository or by Autodesk. The examples are scripts, not executions. The sources are in the next section.

4

points with a published source, each with its reference shown alongside.

Confirmed4.0 released on Oct 12, 2025
Announcement by Jackie Ng on the project list; the maintainer's post of Oct 12, 2025 counts "6 years, 6 months and 14 days" since 3.1.2, whose final folder is dated Mar 27, 2019.Source: lists.osgeo.org (mapguide-internals), the maintainer's blog (Oct 2025) and download.osgeo.org
Confirmedphp2shell: mitigation only in 4.0
On Oct 22, 2026 the maintainer wrote that earlier versions have no fix and that "the only recourse is to upgrade to 4.0"; on Linux, the mitigation requires a rebuild. 4.0.1, announced on Oct 23, 2026, will ship PHP 8.3.36 or newer, with a planned date but not yet released.Source: lists.osgeo.org (mapguide-users 035198 and 035199) and the maintainer's blog
ConfirmedUbuntu installer defaults
Ports 2810, 2811, 2812 and 8008; Tomcat off; with Tomcat, a fixed AJP secret mapguide4java; SysV services in /etc/init.d; no SQL Server Spatial in the provider list.Source: install.sh in the mapguide-fdo-docker-build repository
ConfirmedLGPL 2.1, community project
OSGeo lists MapGuide Open Source as a "community project" under LGPL 2.1, the same license as the text in the code.Source: osgeo.org and License.txt in the Git mirror
06

What Octo does and what stays with you.

Octo prepares everything, but it does not sign. The document of record stays with whoever is accountable for it.

Octo prepares

Gathers, calculates, organizes and generates the documents: scripts, inventories, reports and maps.

Deliverable: material ready to check

Your team checks

The licensed professional checks what Octo delivered before signing. If something doesn't add up, it goes back to Octo with the correction.

Step: review by the signer

The signer

Octo does not sign. Designs, technical reports, ART/RRT, accountability reports and any official document are still signed by the licensed professional of the company or agency: here, the technical lead for the map or system.

Signature: technical lead for the map or system
07

Sources.

MapGuide project lists and repositories, OSGeo and the maintainer's blog, consulted on Oct 31, 2026.

Your map server on 4.0, checked map by map.

The assessment starts with a server inventory and a configuration audit, without touching anything. You get the list of factory defaults, of what blocks the upgrade and of how to check it, and you decide with it in hand.

Request an assessment