Claroline Connect LMS 15.0.15

• Open the Hardened Moodle & E-Learning Platforms AMIs listing by SecureAnyCloud, choose View purchase options, then subscribe.
• Choose Continue to Configuration. Under Software version, choose Claroline Connect LMS 15.0.15 on Ubuntu 24.04. Pick your Region, then choose Continue to Launch.
• Under Choose Action, select Launch through EC2.
• Set the instance type to m5.large and choose your key pair. Use the seller's security group settings (ports 22, 80 and 443), narrowing port 22 to your management network. Keep the image's data volume.
• Launch. First boot finishes within about a minute of the instance reaching the running state.

Run these commands on your workstation. Replace <ami-id> with the AMI ID shown for the Claroline Connect LMS 15.0.15 on Ubuntu 24.04 software version on the listing's launch page. Use your own VPC, subnet, key pair and address ranges.

aws ec2 create-security-group --group-name claroline-sg \
  --description "Claroline Connect" --vpc-id <vpc-id>
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 22 --cidr <your-ip>/32
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 80 --cidr <users-cidr>
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 443 --cidr <users-cidr>
aws ec2 run-instances --image-id <ami-id> --instance-type m5.large \
  --key-name <key-name> --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> --associate-public-ip-address \
  --metadata-options HttpTokens=required \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=claroline}]'
aws ec2 describe-instances --instance-ids <instance-id> \
  --query "Reservations[].Instances[].[PublicDnsName,PublicIpAddress]" --output text

ssh -i <key.pem> ubuntu@<public-dns>

The login user is ubuntu.

First boot writes your instance's credentials to a root-only file:

sudo cat /root/claroline-credentials.txt

It looks like this (your values differ):

CLAROLINE_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/ CLAROLINE_ADMIN_USER=admin CLAROLINE_ADMIN_PASSWORD=<generated-per-instance>

CLAROLINE_URL is the platform address. First boot takes it from /etc/sac/claroline-hostname if that file exists. Otherwise it takes the instance's public DNS name from IMDSv2, then its public IPv4 address, then its private IPv4 address. If you keep credentials centrally, copy them into AWS Secrets Manager.

systemctl is-active nginx php8.3-fpm mysql ls /var/lib/sac/data/claroline-firstboot.done

All three services print active, and the first-boot marker exists. First boot runs once, and after a reboot its unit shows as skipped, which is expected. Only 22, 80 and 443 listen on a public address. MySQL is on 127.0.0.1:3306:

sudo ss -Hltn | awk '{print $4}' | sort -u

The health endpoint and the HTTPS front end on the configured name both answer 200, and port 80 redirects to HTTPS:

SITE=$(sed -n 's/^set \$cl_host "\(.*\)";$/\1/p' /etc/nginx/claroline-host.conf)
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1/healthz
curl -sk -o /dev/null -w "%{http_code}\n" --resolve "${SITE}:443:127.0.0.1" "https://${SITE}/"
curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" --resolve "${SITE}:80:127.0.0.1" "http://${SITE}/"

MySQL holds no password. Every account uses socket authentication or is locked, and Claroline's own connections arrive over the socket as www-data:

sudo mysql -e "SELECT user, host, plugin, account_locked FROM mysql.user;"
sudo -u www-data mysql -u www-data -N -e "SELECT CURRENT_USER();" claroline

The platform cannot reach the instance metadata service. These commands run the same request from inside php8.3-fpm.service and from your shell. The first prints 000 (blocked) and the second prints 200:

CG=$(systemctl show -p ControlGroup --value php8.3-fpm.service)
sudo bash -c "echo \$\$ > /sys/fs/cgroup${CG}/cgroup.procs; exec curl -s -m 5 -o /dev/null -w '%{http_code}\n' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token" curl -s -m 5 -o /dev/null -w '%{http_code}\n' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token

• Open the CLAROLINE_URL from Step 4 in a browser. Plain http:// redirects to HTTPS.
• The certificate is self-signed and unique to your instance, so the browser warns you the first time. Accept it, or install a trusted certificate (Step 8).
• When the sign-in form opens, enter admin as the username and the CLAROLINE_ADMIN_PASSWORD value, then choose Login.

You land on your desktop. The menu at the top left opens the desktop tools: Workspaces, Trainings, Community, Badges, Agenda, Progress and the rest.

The platform answers only on its configured name, the instance's own IP addresses and localhost. A request naming any other host is dropped. Browse to the CLAROLINE_URL address, or to the name you set in Step 7.

Claroline builds the links in emails and notifications from its platform URL, which this image sets from configuration. To serve the platform on your own DNS name, point a DNS record (for example in Amazon Route 53) at the instance's public IP. An Elastic IP keeps the address stable. Then run this on the instance:

sudo claroline-set-hostname learn.example.org

The helper writes the name to /etc/sac/claroline-hostname and issues a new self-signed certificate for it. It rewrites the nginx server name, Symfony's TRUSTED_HOSTS and Claroline's platform URL, updates CLAROLINE_URL in the credentials file, and reloads nginx.

An instance without an Elastic IP gets a new public DNS name when it is stopped and started. Run the helper with the new name so that links and the certificate follow it.

The site certificate is /etc/ssl/claroline/claroline.crt and its key is /etc/ssl/claroline/claroline.key (mode 600, root). To use Let's Encrypt, first set your DNS name (Step 7) and open port 80 to the internet. Then run:

sudo apt-get install -y certbot
sudo certbot certonly --standalone -d learn.example.org \
  --pre-hook "systemctl stop nginx" --post-hook "systemctl start nginx" \
  --deploy-hook "install -m 644 \$RENEWED_LINEAGE/fullchain.pem /etc/ssl/claroline/claroline.crt && install -m 600 \$RENEWED_LINEAGE/privkey.pem /etc/ssl/claroline/claroline.key"

certbot keeps the hooks for every renewal. Running claroline-set-hostname again replaces the certificate with a self-signed one, so run sudo certbot renew --force-renewal afterwards.

• Open Workspaces from the desktop tool menu. My workspaces lists the ones you belong to, and All workspaces lists every workspace on the platform. Choose the add button to create one. A workspace holds a course's resources, tools and members.
• Inside the workspace, add resources (documents, web pages, exercises, learning paths, forums) and register learners and trainers.
• To run scheduled training, use the Trainings tool to create a course and sessions that learners enrol in.
• Create learner accounts with Register users in the Community tool, or import them from a CSV file with the Import tool.
• Set your administrator's e-mail address under My account, because first boot sets a temporary address. Configure outgoing mail before you rely on notifications or password resets.

These are the server components and their versions:

• Claroline Connect 15.0.15: github.com/claroline/Claroline, AGPL-3.0-or-later. See /var/www/claroline/VERSION.txt.
• PHP 8.3 (FPM): Ubuntu 24.04 packages.
• nginx 1.24: TLS front end on 80/443.
• MySQL 8.0: localhost only, with socket authentication and no password.

The image updates the shipped PHP libraries to the releases that fix their published advisories (Symfony 7.4, Twig 3, Guzzle, Dompdf 3).

The browser bundle includes MathJax 2.7.4, which Claroline pins. Its only advisory (GHSA-v638-q856-grg8, a regular-expression denial of service) has no 2.x fix. The MathJax maintainers dispute it, because those patterns are never applied to user input.

cat /var/www/claroline/VERSION.txt php -v | head -n 1 mysql --version

These are the key paths and what each holds:

• /var/www/claroline: the Claroline application. Code is owned by root, and runtime directories are owned by www-data.
• /var/www/claroline/config/parameters.yml: database and application secret settings (mode 640).
• /data/mysql (mounted at /var/lib/mysql): the MySQL database on the data volume.
• /data/claroline/files (mounted at /var/www/claroline/files): Claroline files and platform configuration.
• /data/claroline/uploads (mounted at /var/www/claroline/public/uploads): uploaded files.
• /etc/nginx/sites-available/sac-claroline: the nginx site.
• /etc/ssl/claroline/: the site certificate and key.
• /root/claroline-credentials.txt: your credentials (mode 600, root).
• /var/log/claroline-firstboot.log: the first-boot log.
• /var/lib/sac/data/claroline-firstboot.done: the first-boot marker. nginx and PHP-FPM start only when it exists.

for m in /data /var/lib/mysql /var/www/claroline/files /var/www/claroline/public/uploads; do findmnt -no TARGET,SOURCE "$m"; done

systemctl status nginx php8.3-fpm mysql --no-pager -n 0

Restart PHP-FPM with sudo systemctl restart php8.3-fpm and reload nginx with sudo systemctl reload nginx.

Logs are in /var/log/nginx/claroline-*.log and /var/www/claroline/var/log/. The Amazon CloudWatch agent can ship them to CloudWatch Logs.

Claroline's console runs as the web user, for example:

sudo -u www-data php /var/www/claroline/bin/console list claroline

Custom themes are compiled with Node.js, which the image does not include. If you build your own theme, first install Node.js 22 and run npm ci in /var/www/claroline.

Dump the database as root over the socket (no password), and keep the files with it:

sudo mysqldump --single-transaction --routines --triggers claroline > ~/claroline-$(date +%Y%m%d).sql
sudo tar -czf ~/claroline-files-$(date +%Y%m%d).tar.gz -C /data/claroline files uploads

Copy both to an Amazon S3 bucket or another durable destination. EBS snapshots of the data volume are a simple whole-platform backup:

aws ec2 create-snapshot --volume-id <data-volume-id> --description "claroline $(date +%F)"

The browser cannot connect, or the connection is dropped. Browse to the configured name (shown in CLAROLINE_URL). Other host names are dropped by design. Check that ports 80 and 443 are open in the security group.

nginx or PHP-FPM is not running after launch. Both start only after first boot completes:

ls -la /var/lib/sac/data/claroline-firstboot.done
sudo tail -n 20 /var/log/claroline-firstboot.log

If the marker is missing, first boot did not finish. Fix the cause, then run it again:

sudo systemctl restart claroline-firstboot
sudo systemctl start php8.3-fpm nginx

Confirm that the administrator login works. The round-trip check signs in through the real login endpoint and confirms that wrong passwords are refused:

sudo /usr/local/sbin/claroline-cred-roundtrip.sh

It prints a line starting with OK.

• Keep port 22 limited to your management network.
• Change the administrator password from your user menu (My account) if you share it with anyone. Give trainers their own accounts instead of the administrator login.
• Keep MySQL on socket authentication. If a reporting tool must connect over the network, create a separate read-only account with its own password for it, bind it to the tool's address, and keep port 3306 closed in the security group.
• Apply Ubuntu security updates regularly (sudo apt-get update && sudo apt-get upgrade). Unattended upgrades are enabled for security updates.

Claroline Connect is licensed under the GNU Affero General Public License version 3 or later (AGPL-3.0-or-later). Its source is at github.com/claroline/Claroline.

You are responsible for the data protection of the learner records you enter. Claroline is a trademark of its owner. SecureAnyCloud is not affiliated with or endorsed by the Claroline Consortium.

SecureAnyCloud provides 24/7 technical support by email and live chat at sales@secureanycloud.com. Every product in this listing is on the Hardened Moodle & E-Learning Platforms AMIs guide hub.

Deploy on AWS

Launch Claroline Connect LMS 15.0.15 on Ubuntu 24.04 on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com