Admidio 5.0.18

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Select Admidio 5.0.18 on Ubuntu 24.04 as the software version, pick your Region, and choose Launch through EC2.

Choose m5.large, your key pair and a security group as described in the prerequisites. The root volume holds the database, photos and documents, so give it room to grow (for example, 30 GiB or more for an active club).

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=30,VolumeType=gp3}' \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=admidio}]'

First boot completes in well under a minute after the instance is running.

Connect over SSH with your key pair. The SSH user for Admidio 5.0.18 on Ubuntu 24.04 is ubuntu.

ssh -i <your-key.pem> ubuntu@<public-ip>

On first boot, the instance creates the database, runs Admidio's installer, sets the password and generates the certificate. Then nginx starts. Check the first boot service:

systemctl is-active nginx php8.3-fpm mariadb admidio-firstboot
sudo test -f /var/lib/sac/data/admidio-firstboot.done && echo FIRSTBOOT_DONE

All four units report active, and the first boot marker is present:

active active active active FIRSTBOOT_DONE

Only SSH and nginx listen on network ports. MariaDB has no TCP listener, and PHP-FPM uses a local socket:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v ':53 ' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort

0.0.0.0:22 users:(("sshd"),("systemd")) 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) [::]:22 users:(("sshd"),("systemd")) [::]:443 users:(("nginx"),("nginx"),("nginx")) [::]:80 users:(("nginx"),("nginx"),("nginx"))

sudo cat /root/admidio-credentials.txt

The file is readable by root only:

# Admidio 5.0.18 - generated on first boot by admidio-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret. ADMIDIO_URL=https://<public-dns-name>/ ADMIDIO_ADMIN_USER=admin ADMIDIO_ADMIN_PASSWORD=<ADMIDIO_ADMIN_PASSWORD> ADMIDIO_ADMIN_EMAIL=admin@example.com
#
# Open ADMIDIO_URL in a browser (self-signed certificate minted on this instance's first boot; port 80 and this # instance's other addresses redirect to it) and sign in as 'admin' with the password above. Set your organisation's # name and e-mail and your own e-mail address (Settings, your profile) and an SMTP server (Settings > E-mail dispatch) # before you rely on mail. Public registration is off (Settings > Registration). # MariaDB: unix socket only (no TCP listener, no database password: Admidio runs as the OS user admidio); # sudo mysql admidio (root signs in over the socket) # Change the password:
sudo admidio-set-password
# Change the name it serves as:
sudo admidio-set-hostname <your-dns-name>
# User guide: https://secureanycloud.com/stacks/admidio-5-0-18/

The URL uses the instance's public DNS name from the EC2 instance metadata, or its public IP address when the subnet provides no DNS name. The certificate also names the public and private IP addresses. Those addresses redirect to the URL, because Admidio builds every link from one configured address.

If you stop and start the instance without an Elastic IP, its public name changes. Set the new name with admidio-set-hostname (Step 7), or use your own DNS name.

Browse to the URL from the credentials file. Your browser warns once about the self-signed certificate. Accept it, or install your own certificate (Step 7). Sign in as admin with the password from the credentials file.

After you sign in, you land on the overview. The modules (announcements, events, messages, groups and roles, contacts, documents and files, inventory, photos, category report, web links and forum) and the administration pages are listed on the left.

Under Administration > Organization, set your organization's name and e-mail address. The installer names it "My Organisation" with admin@example.com. Then open your own profile from the menu at the top right and set your real e-mail address.

Set up outgoing mail under Preferences > Email delivery, so that password resets, event notifications and mailings reach your members.

Contacts is the member database. Use Create contact to add a member and Import contacts to load a CSV file. Use Edit profile fields to add the fields your club needs, such as membership number, emergency contact or license.

Groups & roles controls who can do what. Each role carries rights (edit contacts, manage events, upload documents, send mail) and a member list. The installer creates the Administrator, Association's board and Member roles. Add teams, committees or departments as further roles.

Preferences holds the system settings: security (password strength, sign-in options, two-factor authentication), registration, captcha, single sign-on, the module settings and the regional settings. The Information tab shows the version and offers a database backup download.

Point a DNS record at the instance. An Elastic IP keeps the address stable. Then set the name that Admidio is served as.

This command creates a new self-signed certificate for the name. It updates nginx, Admidio's configured address (used in every link, redirect and e-mail) and the URL in /root/admidio-credentials.txt. The name persists across reboots:

sudo admidio-set-hostname <your-domain>

To use a certificate from a public or private certificate authority instead, for example one issued by Let's Encrypt for <your-domain>, copy it over the generated pair and reload nginx. Running admidio-set-hostname again replaces it with a self-signed certificate:

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/admidio.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/admidio.key
sudo nginx -t && sudo systemctl reload nginx

The image includes a round-trip check. It confirms that port 80 redirects to HTTPS and that requests for the installer, the data folder, the sources, the PHP libraries and phpinfo are refused. It also confirms that the administrator can sign in through Admidio's own sign-in form with this instance's password, while a wrong password and a default password are refused. Passwords are passed to curl in root-only temporary files, never on a command line:

sudo /usr/local/sbin/admidio-cred-roundtrip

OK https 301 + no installer/data folder/sources/vendor/phpinfo + administrator sign-in (Admidio's own form) + wrong and default passwords refused

The installer, the data folder (which holds the configuration link), phpinfo, the PHP libraries and the sources answer 404. Plain HTTP redirects to HTTPS on the configured name. A host name that the instance does not serve gets no answer at all:

H=$(sudo grep '^ADMIDIO_URL=' /root/admidio-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#') for p in /system/login.php /install/ /install/installation.php /adm_my_files/config.php /system/phpinfo.php /vendor/autoload.php /src/; do curl -sk -o /dev/null -w "%{http_code} $p\n" --resolve "$H:443:127.0.0.1" "https://$H$p" done curl -s -o /dev/null -w 'http:// -> %{http_code}\n' --resolve "$H:80:127.0.0.1" "http://$H/" curl -sk -o /dev/null -w 'unknown host name -> %{http_code}\n' --resolve "other.example:443:127.0.0.1" https://other.example/ || true

200 /system/login.php 404 /install/ 404 /install/installation.php 404 /adm_my_files/config.php 404 /system/phpinfo.php 404 /vendor/autoload.php 404 /src/ http:// -> 301 unknown host name -> 000

The certificate is generated on this instance and names its own addresses:

H=$(sudo grep '^ADMIDIO_URL=' /root/admidio-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = <public-dns-name>, O = sac X509v3 Subject Alternative Name: DNS:<public-dns-name>, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

None of the services can reach the instance metadata service. Confirm it:

systemctl show nginx php8.3-fpm mariadb admidio-firstboot -p Id -p IPAddressDeny

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 Id=nginx.service IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 Id=php8.3-fpm.service IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 Id=mariadb.service IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 Id=admidio-firstboot.service

nginx passes PHP the configured host name and blanks every forwarded client header. As a result, Admidio's links always use the configured address, and its sign-in records and lockouts use the real address of the connection:

grep -hE 'fastcgi_param (HTTP_HOST|SERVER_NAME|HTTP_X_FORWARDED_HOST|HTTP_X_FORWARDED_FOR|HTTP_CLIENT_IP|HTTP_FORWARDED) ' /etc/nginx/snippets/sac-admidio-fastcgi.conf

fastcgi_param HTTP_HOST $adm_host; fastcgi_param SERVER_NAME $adm_host; fastcgi_param HTTP_X_FORWARDED_HOST $adm_host; fastcgi_param HTTP_X_FORWARDED_FOR ""; fastcgi_param HTTP_CLIENT_IP ""; fastcgi_param HTTP_FORWARDED "";

MariaDB runs without networking. Admidio's database user admidio signs in over the unix socket with no password. The root user works only from the instance itself (sudo mysql):

sudo mysql -e "SELECT @@skip_networking, @@local_infile, @@log_bin, @@general_log; SELECT user, host FROM mysql.global_priv WHERE user <> 'mariadb.sys' ORDER BY user;"

@@skip_networking @@local_infile @@log_bin @@general_log 1 0 0 0 user host admidio localhost mysql localhost root localhost

grep -E '^const ADMIDIO_VERSION_(MAIN|MINOR|PATCH)' /var/www/admidio/system/bootstrap/constants.php php -r 'echo PHP_VERSION."\n";' mariadbd --version nginx -v head -4 /usr/share/doc/admidio/SOURCE.txt

const ADMIDIO_VERSION_MAIN = 5; const ADMIDIO_VERSION_MINOR = 0; const ADMIDIO_VERSION_PATCH = 18; 8.3.6 mariadbd Ver 10.11.14-MariaDB-0ubuntu0.24.04.1 for debian-linux-gnu on x86_64 (Ubuntu 24.04) nginx version: nginx/1.24.0 (Ubuntu) Admidio 5.0.18 on Ubuntu 24.04 by sac - source and changes Upstream: the Admidio v5.0.18 tag archive, https://github.com/Admidio/admidio/archive/refs/tags/v5.0.18.tar.gz (commit bb3d5b5039a0de54f16e6b5a47ff9c08fc2335f5; sha256 52a76659987007be7957a73688fe0430a9e2b8c14057460f4bca03f6c1a7b526). Licence: GPL-2.0-only (LICENSE, shipped here and in /var/www/admidio).

Component Path

Admidio (read only, owned by root) /var/www/admidio

Admidio data folder (uploads, photos, documents, logs) /var/lib/admidio/adm_my_files

Admidio configuration /etc/admidio/config.php (root, readable by the admidio group)

PHP sessions /var/lib/admidio/sessions

MariaDB database /var/lib/mysql (database admidio)

PHP-FPM pool /etc/php/8.3/fpm/pool.d/admidio.conf (runs as the user admidio)

nginx site /etc/nginx/sites-available/sac-admidio

Certificate and key /etc/nginx/ssl/

Boot service /usr/local/sbin/admidio-firstboot.sh

Helpers /usr/local/sbin/admidio-set-hostname, admidio-set-password, admidio-cred-roundtrip

Credentials /root/admidio-credentials.txt (mode 0600)

• Change the Admidio admin password. Change it in Admidio (your profile, then Change password) or on the instance. The helper below sets a new random password with Admidio's own password scheme. It also clears any lock caused by wrong passwords, signs every session out and writes the new password to /root/admidio-credentials.txt. To choose the password yourself, pipe it in with --stdin (20 to 72 letters and digits), so it never appears on a command line:

sudo admidio-set-password
sudo grep '^ADMIDIO_ADMIN_PASSWORD=' /root/admidio-credentials.txt

• Members reset their own passwords. Once outgoing mail is set up, members use Password forgotten? on the sign-in page. The reset link always points at the configured address, never at a host name taken from the request.

The database lives in MariaDB (/var/lib/mysql). Uploaded files, photos and documents live under /var/lib/admidio/adm_my_files. The simplest backup is an EBS snapshot of the root volume. To download the database from your browser, go to Preferences > Information > Download database backup.

To back up on the instance while Admidio is running:

sudo mariadb-dump --single-transaction --routines --triggers admidio | gzip > <backup-dir>/admidio-$(date +%F).sql.gz
sudo tar -czf <backup-dir>/admidio-files-$(date +%F).tar.gz -C /var/lib/admidio adm_my_files

Security updates for the operating system, nginx, PHP and MariaDB install automatically from Ubuntu. To apply all other updates, run sudo apt-get update && sudo apt-get upgrade.

Admidio's code is read-only to PHP, so its in-browser update check cannot replace files on this image. To move to a newer Admidio release, launch the newer version from the listing and restore your database and data folder into it, or contact SecureAnyCloud support. Take a snapshot first.

• Allow port 22 from your admin network only, and ports 80 and 443 only from the networks your members work from.
• Use your own DNS name and a certificate that your browsers trust (Step 7).
• Give each person their own account and the smallest role that fits. Keep admin for administration.
• Turn on two-factor authentication under Preferences > Security. Change the admin password if it may have been shared (Step 10). Keep the operating system patched, and snapshot the volume regularly.
• The rich text editor bundled with Admidio 5.0.18 (CKEditor 5 41.3.0) has published cross-site scripting advisories of medium and low severity. Grant the rights to write announcements, events and other rich text only to members you trust.