Apache OFBiz 24.09.07

In the AWS Marketplace listing, choose Continue to Subscribe, accept the terms, then choose Continue to Configuration. Pick Apache OFBiz 24.09.07 on Ubuntu 24.04 as the software version, select your region, then choose Continue to Launch.

Choose Launch through EC2. Select an instance type (m5.large or larger), your key pair, and a security group with these inbound rules:

22 tcp <your-admin-ip>/32 80 tcp 0.0.0.0/0 (or your users' networks) 443 tcp 0.0.0.0/0 (or your users' networks)

Keep the second EBS volume that the AMI defines (the 20 GiB OFBiz data volume) and launch. First boot takes about two minutes, and OFBiz then needs another minute to start.

Connect over SSH with your key pair:

ssh -i your-key.pem ubuntu@<public-ip>

Confirm that the services are running:

systemctl is-active ofbiz nginx apache-ofbiz-firstboot

active active active

Only SSH and nginx listen on the network. OFBiz listens on loopback only:

sudo ss -lntp | awk 'NR==1 || /:(22|80|443|8080|8443) /' | sed -E 's/users:.*"([a-z0-9-]+)".*/\1/'

State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 100 127.0.0.1:8080 0.0.0.0:* java LISTEN 0 511 0.0.0.0:443 0.0.0.0:* nginx LISTEN 0 511 0.0.0.0:80 0.0.0.0:* nginx LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* systemd LISTEN 0 100 127.0.0.1:8443 0.0.0.0:* java LISTEN 0 511 [::]:443 [::]:* nginx LISTEN 0 511 [::]:80 [::]:* nginx LISTEN 0 4096 [::]:22 [::]:* systemd

The OFBiz data volume is mounted at /var/lib/ofbiz:

df -h /var/lib/ofbiz | tail -1

/dev/nvme1n1 20G 80M 19G 1% /var/lib/ofbiz

Read the credentials file on the instance:

sudo grep -E '^OFBIZ_(URL|ADMIN_USER|ADMIN_PASSWORD)=' /root/ofbiz-credentials.txt

OFBIZ_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ OFBIZ_ADMIN_USER=admin OFBIZ_ADMIN_PASSWORD=<OFBIZ_ADMIN_PASSWORD>

The URL uses your instance's public DNS name, or its public IP address when the VPC has no DNS host names. The same file also records the instance's internal keys. You never need to type those.

Open https://<your OFBiz URL>/partymgr/control/main (or /accounting, /ordermgr, /catalog, /webtools). Your browser warns about the self-signed certificate that the instance generated on first boot. Accept it for now and replace it with your own in Step 8.

Sign in as admin with the password from Step 4. Each OFBiz application has its own sign-in page. Once you are signed in, the menu at the top moves between the applications without asking again.

• The Party application manages customers, suppliers, employees and their contact details.
• Accounting covers invoices, payments, billing accounts, the general ledger and fixed assets.
• Catalog holds catalogs, categories, products, features, promotions and price rules.
• Web Tools is the administrator's console for the entity engine, the service engine, data import and export, caches and logs.

The database starts with OFBiz's seed data only. This is reference data such as currencies, countries, units and status codes. There are no sample companies, products or orders.

A typical first setup follows these steps:

1. Create your organization as a party group.
2. Set it up under Accounting > Organization GL Settings.
3. Create a product store and catalog under Catalog.
4. Create users under Party and give them security groups.

The Web Tools main page says "try username: admin, password: ofbiz". That is OFBiz's own help text, and no such login exists on this image.

Run these checks on the instance. Port 80 sends browsers to HTTPS, OFBiz answers over HTTPS, and the refused endpoints return 404. nginx closes the connection for a host name the instance does not serve (000 means no answer):

H=$(sudo sed -n 's#^OFBIZ_URL=https://\([^/]*\)/.*#\1#p' /root/ofbiz-credentials.txt)
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/webtools/control/main"
curl -sk -o /dev/null -w 'login page: %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/webtools/control/login" for u in /webtools/control/xmlrpc /webtools/control/SOAPService /webtools/control/ProgramExport /partymgr/control/forgotPassword; do
curl -sk -o /dev/null -w "$u: %{http_code}\n" --resolve "$H:443:127.0.0.1" "https://$H$u" done
curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/webtools/control/main login page: 200 /webtools/control/xmlrpc: 404 /webtools/control/SOAPService: 404 /webtools/control/ProgramExport: 404 /partymgr/control/forgotPassword: 404 unknown host name: 000

OFBiz itself refuses the old demo login, and the administrator can sign in from the command line too. The password is passed to curl from a file, so it never appears on a command line:

H=$(sudo sed -n 's#^OFBIZ_URL=https://\([^/]*\)/.*#\1#p' /root/ofbiz-credentials.txt)
PWF=$(mktemp);
OLD=$(mktemp);
JAR=$(mktemp)
sudo sed -n 's/^OFBIZ_ADMIN_PASSWORD=//p' /root/ofbiz-credentials.txt | tr -d '\n' > "$PWF"; printf ofbiz > "$OLD" try() { : > "$JAR"; curl -sk --resolve "$H:443:127.0.0.1" -c "$JAR" -b "$JAR" -o /dev/null "https://$H/webtools/control/login" curl -sk --resolve "$H:443:127.0.0.1" -c "$JAR" -b "$JAR" --data-urlencode "USERNAME=$1" --data-urlencode "PASSWORD@$2" --data JavaScriptEnabled=Y "https://$H/webtools/control/login"; } try admin "$OLD" | grep -oE 'Password incorrect|User not found' | head -1 | sed 's/^/admin + ofbiz: /' try flexadmin "$OLD" | grep -oE 'Password incorrect|User not found' | head -1 | sed 's/^/flexadmin + ofbiz: /' try admin "$PWF" | grep -qi 'logout' && echo 'admin + instance password: signed in' rm -f "$PWF" "$OLD" "$JAR"

admin + ofbiz: Password incorrect flexadmin + ofbiz: User not found admin + instance password: signed in

OFBiz, nginx and the first boot service are blocked from the instance metadata service:

systemctl show -p IPAddressDeny ofbiz nginx apache-ofbiz-firstboot | grep -c '169.254.169.254'
sudo journalctl -u apache-ofbiz-firstboot --no-pager | grep -o 'imds-egress: blocked.*' | tail -1

3 imds-egress: blocked (169.254.169.254 unreachable from apache-ofbiz-firstboot.service)

The patched libraries are on the class path. The full list with checksums is in the inventory file:

grep -E '^(org.apache.tomcat:tomcat-catalina|com.fasterxml.jackson.core:jackson-databind|org.freemarker:freemarker|org.apache.logging.log4j:log4j-core|org.apache.cxf:cxf-core):' /usr/share/doc/sac/ofbiz-runtime-jars.txt | cut -d' ' -f1

com.fasterxml.jackson.core:jackson-databind:2.21.7 org.apache.cxf:cxf-core:3.6.12 org.apache.logging.log4j:log4j-core:2.25.5 org.apache.tomcat:tomcat-catalina:9.0.121 org.freemarker:freemarker:2.3.35

Point a DNS name at the instance. An Elastic IP keeps the address stable. Then tell OFBiz about the name with the helper, which generates a new self-signed certificate for it, pins it in nginx, adds it to OFBiz's allowed host list and restarts the services:

sudo ofbiz-set-hostname erp.example.com

To use a certificate your browsers trust, replace /etc/nginx/ssl/ofbiz.crt and /etc/nginx/ssl/ofbiz.key with your certificate chain and key, for example from your certificate authority or from certbot with a DNS challenge. Then run sudo systemctl reload nginx.

The name is kept in /etc/sac/ofbiz-hostname.

To set a new random administrator password (recorded in /root/ofbiz-credentials.txt):

sudo ofbiz-set-password

To choose your own (16 to 64 letters and digits), pass it on standard input so it never appears on a command line:

read -rs NEWPW && printf '%s\n' "$NEWPW" | sudo ofbiz-set-password --stdin; unset NEWPW

The helper briefly stops OFBiz, because the embedded database allows one process at a time, and then starts it again.

Users can change their own passwords in OFBiz from the user menu. OFBiz's forgot-password page is refused on this image, because it emails a reset to anyone who knows a user name. Instead, reset a forgotten password as the administrator: Party > Find Party > the user > User Login > Change password.

• XML-RPC, SOAPService and ProgramExport. These endpoints were the entry points of OFBiz's pre-authentication remote code execution vulnerabilities (CVE-2023-49070, CVE-2023-51467, CVE-2024-32113, CVE-2024-38856, CVE-2024-45195 and others). nginx refuses them in any spelling, and SOAPService and ProgramExport are removed from the Web Tools controller. If you need SOAP or REST integration, use OFBiz's REST API plugin (/rest), which authenticates with tokens signed by your instance's own key.
• The AJP connector and the admin port. A stock OFBiz opens AJP on port 8009 on every interface with no secret, and an admin socket on 10523 with a key printed in its configuration. Both are removed, and systemd stops OFBiz cleanly.
• The example, exampleext and LDAP plugins. The example plugins are developer samples. The LDAP plugin is an optional authenticator that is inactive until configured and pulls in an older CAS and Spring stack with known vulnerabilities. Re-enabling a plugin means setting enabled="true" in /opt/ofbiz/plugins/<name>/ofbiz-component.xml and rebuilding OFBiz with a JDK and Gradle, which this image does not include.

These are the main locations on the instance:

• OFBiz application: /opt/ofbiz (read-only to the service)
• Derby database, indexes, uploads, logs: /var/lib/ofbiz/runtime (the data volume)
• OFBiz logs: /var/lib/ofbiz/runtime/logs and journalctl -u ofbiz
• nginx configuration and certificate: /etc/nginx/sites-available/sac-ofbiz, /etc/nginx/ssl/
• Security settings: /opt/ofbiz/framework/security/config/security.properties
• First boot service: /usr/local/sbin/apache-ofbiz-firstboot
• Helpers: /usr/local/sbin/ofbiz-set-hostname, /usr/local/sbin/ofbiz-set-password
• Library inventory: /usr/share/doc/sac/ofbiz-runtime-jars.txt
• Credentials: /root/ofbiz-credentials.txt (mode 0600)

The simplest consistent backup is an EBS snapshot of the data volume. For a file-level copy, stop OFBiz first, because Derby is an embedded database:

sudo systemctl stop ofbiz
sudo tar -C /var/lib/ofbiz -czf /root/ofbiz-runtime-$(date +%F).tar.gz runtime
sudo systemctl start ofbiz

Embedded Derby suits evaluation, small teams and single-instance use. For heavier production use, OFBiz supports PostgreSQL and MySQL through framework/entity/config/entityengine.xml. See the OFBiz documentation for moving the data across.

• Allow port 22 from your admin network only, and ports 80 and 443 only from the networks your users work from.
• Use your own DNS name and a certificate your browsers trust (Step 8).
• Create a named user for each person with the security groups their job needs, and keep admin for administration.
• Change the admin password if it may have been shared (Step 9), keep the operating system patched, and snapshot the data volume regularly.
• Follow the Apache OFBiz security page (https://ofbiz.apache.org/security.html) and move to newer SecureAnyCloud versions as OFBiz releases fixes.