Deming 2026.10.20

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick Deming 2026.10.20 ISMS on Ubuntu 24.04 as the software version, pick your Region, and choose Launch through EC2. Choose m5.large, your key pair and the security group from Prerequisites. The ISMS database lives on the root volume.

To launch with the AWS CLI instead, run the following and replace the values in angle brackets.

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=deming}]'

For the Deming 2026.10.20 ISMS on Ubuntu 24.04 version, the SSH user is ubuntu.

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot takes about a minute. MariaDB creates its data directory. First boot then creates the Deming database and its user with a password generated on your instance, imports the ISO 27001:2022 controls and the demonstration data, replaces the default password and starts the web server. When it finishes, all four units are active.

systemctl is-active deming-firstboot mariadb php8.4-fpm nginx

active active active active

nginx serves ports 80 and 443, and MariaDB listens on loopback only. PHP FPM does not appear because it uses a local socket.

sudo ss -tlnp | awk 'NR==1 || /nginx|mariadbd|sshd/' | awk '{print $1, $4, $6}' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g'

State Local Peer LISTEN 0.0.0.0:80 users:(("nginx"),("nginx"),("nginx")) LISTEN 0.0.0.0:22 users:(("sshd"),("systemd")) LISTEN 0.0.0.0:443 users:(("nginx"),("nginx"),("nginx")) LISTEN 127.0.0.1:3306 users:(("mariadbd")) LISTEN [::]:80 users:(("nginx"),("nginx"),("nginx")) LISTEN [::]:22 users:(("sshd"),("systemd")) LISTEN [::]:443 users:(("nginx"),("nginx"),("nginx"))

These commands show the versions on the image and the PHP libraries that SecureAnyCloud updated.

sudo cat /var/www/deming/version.txt php -r 'echo "PHP ".PHP_VERSION."\n";' mariadb --version | cut -d' ' -f1-6 nginx -v 2>&1 cat /usr/share/doc/sac/deming-dependency-updates.txt

2026.10.20 PHP 8.4.27 mariadb Ver 15.1 Distrib 10.11.14-MariaDB, nginx version: nginx/1.24.0 (Ubuntu) Deming 2026.10.20: PHP packages updated by sac (composer audit = 0 advisories at build time) laravel/framework 13.38.0 league/commonmark 2.10.4 league/flysystem 3.36.0 league/flysystem-local 3.35.3 maatwebsite/excel 3.1.70 phpseclib/phpseclib 3.0.57 symfony/http-foundation 8.1.9

PHP 8.4 comes from the ondrej/php PPA. apt trusts it only through its pinned signing key, and a preferences pin limits it to PHP packages. The libraries PHP uses come from Ubuntu. The installed build is the release that fixes PHP2Shell (CVE-2026-109618 and CVE-2026-109619).

grep -E '^(URIs|Suites|Signed-By):' /etc/apt/sources.list.d/sac-ondrej-php.sources gpg --no-default-keyring --keyring /usr/share/keyrings/sac-ondrej-php.gpg --with-colons --fingerprint 2>/dev/null | awk -F: '$1=="fpr"{print "pinned key: "$10; exit}'
grep -E '^(Package|Pin-Priority):' /etc/apt/preferences.d/sac-ondrej-php dpkg-query -W -f='${Package} ${Version}\n' php8.4-fpm php8.4-cli php8.4-common zgrep -o 'CVE-2026-10961[89]' /usr/share/doc/php8.4-common/changelog.Debian.gz | sort -u

URIs: https://ppa.launchpadcontent.net/ondrej/php/ubuntu Suites: noble Signed-By: /usr/share/keyrings/sac-ondrej-php.gpg pinned key: B8DC7E53946656EFBCE4C1DD71DAEAAB4AD4CAB6 Package: php* Pin-Priority: 500 Package: * Pin-Priority: -1 php8.4-cli 8.4.27-1+ubuntu24.04.1+deb.sury.org+1 php8.4-common 8.4.27-1+ubuntu24.04.1+deb.sury.org+1 php8.4-fpm 8.4.27-1+ubuntu24.04.1+deb.sury.org+1 CVE-2026-109618 CVE-2026-109619

The credentials file holds the address Deming is served as (your instance's public DNS name by default), the administrator login and password, and the database login. All of them are generated on this instance. The command below shows the file with the two passwords hidden. To see them, run sudo cat /root/deming-credentials.txt.

sudo sed -E 's/^(deming\.(admin|db)\.password=).*/\1<hidden>/' /root/deming-credentials.txt

# Deming on Ubuntu 24.04 - generated on first boot by deming-firstboot.service.
# These credentials are unique to THIS instance. Store them somewhere safe, then sign in and change the
# administrator password from Deming (top-right user menu -> Profile). DEMING_URL=https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ deming.admin.login=admin@admin.localhost deming.admin.password=<hidden> deming.db.name=deming deming.db.user=deming_user deming.db.password=<hidden>
# The site uses a per-instance self-signed TLS certificate (your browser warns once). To serve a DNS name:
#
sudo deming-set-hostname <your-dns-name>
# The Laravel application key (APP_KEY) in /var/www/deming/.env is unique to this instance.

Open DEMING_URL in your browser. The certificate is self-signed and generated on your instance, so accept the browser warning once, or install your own certificate (Step 11). Sign in with the login admin@admin.localhost and the password from Step 4.

You land on the dashboard. The menu on the left holds the whole ISMS: Controls, Measurements, Planning, Action plans, Risks, the Risk matrix, Exceptions, Analysis, Reports and Configuration. The tiles count your domains, controls, measurements, action plans, risks and exceptions. They are populated from the ISO 27001:2022 catalog and the demonstration data.

Open the user menu (your initials) in the top right, choose Profile and use the change password form. Enter the password from Step 4 as the current password. Deming stores only a bcrypt hash.

After you change the password, the copy in /root/deming-credentials.txt is out of date. Keep the file for the database password, or remove the administrator line.

Open Controls. Deming lists the ISO 27001:2022 catalog that first boot imported, by domain and clause, with the number of measurements recorded against each. Open a control to see its objective, or use Plan to schedule a measurement.

The image also carries other frameworks ready to import, including DORA, NIS2, PCI DSS 4.0, NIST SP 800-53, ISO 22301 and ISO 27001:2013.

sudo ls /var/www/deming/storage/app/repository/ | grep -E 'DORA_en|NIS2.en|PCI|sp800|ISO27001-2022.en'

DORA_en.xlsx ISO27001-2022.en.xlsx NIS2.en.xlsx PCI.DSS.4.0.EN.xlsx sp800-53r5-control-catalog-full.xlsx

Import a framework from Configuration > Import, or from the command line. Either way, the framework is added to your controls.

sudo -u www-data php /var/www/deming/artisan deming:import-framework \
  /var/www/deming/storage/app/repository/NIS2.en.xlsx

Open Risks for the register and Risk matrix for the likelihood-by-impact heat map. The demonstration data places ten scored risks on the matrix, with a breakdown by risk level and by treatment status.

To add your own risk, choose New, score its probability and impact, and choose a treatment.

This check confirms the following. Port 80 sends browsers to HTTPS. The sign-in page answers over HTTPS. Signed-out visitors are sent to the sign-in page. Self-registration and .env are not served. nginx closes the connection for a host name the instance does not serve, shown as 000, which means no answer.

H=$(sudo sed -n 's#^DEMING_URL=https://\([^/]*\)/.*#\1#p' /root/deming-credentials.txt)
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/"
curl -sk -o /dev/null -w 'sign-in page: %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/login"
curl -sk -o /dev/null -w 'dashboard (signed out): %{http_code} -> %{redirect_url}\n' --resolve "$H:443:127.0.0.1" "https://$H/"
curl -sk -o /dev/null -w 'self registration: %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/register"
curl -sk -o /dev/null -w '.env: %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/.env"
curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/ sign-in page: 200 dashboard (signed out): 302 -> https://ec2-<public-ip-dashed>.<region>.compute.amazonaws.com/login self registration: 404 .env: 404 unknown host name: 000

A built-in check signs in through nginx with the password from the credentials file. It reads the password from the file, never from a command line. It proves that the default admin password and other common passwords are refused, and it checks the application key and the database login.

sudo /usr/local/sbin/deming-cred-roundtrip.sh

OK per-instance APP_KEY 32 bytes; DB password works + wrong one refused; datadir initialised on this instance; admin login round trips over HTTPS; seeded admin@admin.localhost/'admin' DEAD; demo accounts scrambled; 80->301, unknown Host->444; env unreachable

The certificate was generated on this instance and names its own addresses.

H=$(sudo sed -n 's#^DEMING_URL=https://\([^/]*\)/.*#\1#p' /root/deming-credentials.txt)
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.<region>.compute.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

None of the services can reach the instance metadata service.

for u in nginx php8.4-fpm mariadb deming-firstboot; do systemctl show "$u" -p IPAddressDeny; done

IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32 IPAddressDeny=fd00:ec2::254/128 169.254.169.254/32 168.63.129.16/32

The image ships MariaDB with an empty data directory. A small helper, /usr/local/sbin/sac-mariadb-datadir-init, runs before MariaDB starts. It creates the data directory on your instance's first boot and records when it did so.

cat /var/lib/sac/data/mariadb-datadir-initialised

MariaDB datadir initialised on this instance at 2026-10-25T19:04:27Z (the image ships none)

MariaDB listens on loopback and keeps no binary log. root signs in through the local socket only (sudo mysql, no password), and the only password account is Deming's own.

sudo mysql -e "SELECT @@bind_address AS bind_address, @@log_bin AS binary_log; SELECT CONCAT(User,'@',Host) AS account, IF(Priv LIKE '%unix_socket%','local socket','password') AS sign_in FROM mysql.global_priv WHERE User IN ('root','deming_user') ORDER BY 1;"

bind_address binary_log 127.0.0.1 0 account sign_in deming_user@127.0.0.1 password deming_user@localhost password root@localhost local socket

nginx hands Deming a fixed host name and the real client address from the connection. Laravel trusts forwarded headers only from the instance itself. A client therefore cannot make Deming build links, such as password reset links, for another host, or record a forged address in the audit log.

grep -E 'fastcgi_param (HTTP_HOST|HTTP_X_FORWARDED_FOR|HTTP_X_FORWARDED_HOST|HTTP_X_REAL_IP) ' /etc/nginx/sites-available/deming | sed 's/^ *//'
sudo grep -F 'protected $proxies' /var/www/deming/app/Http/Middleware/TrustProxies.php | sed 's/^ *//'

fastcgi_param HTTP_HOST $deming_host; fastcgi_param HTTP_X_FORWARDED_HOST $deming_host; fastcgi_param HTTP_X_FORWARDED_FOR $remote_addr; fastcgi_param HTTP_X_REAL_IP $remote_addr; protected $proxies = ['127.0.0.1'];

nginx and PHP FPM start only after first boot has written the marker that says every secret exists.

grep ConditionPathExists /etc/systemd/system/nginx.service.d/sac-bootstrap-gate.conf ls /var/lib/sac/data/

ConditionPathExists=/var/lib/sac/data/deming-bootstrap-ready deming-bootstrap-ready deming-firstboot.done mariadb-datadir-initialised

Deming reads its settings from /var/www/deming/.env (mode 0640, root:www-data, because it holds this instance's application key and database password). Edit the file with sudo, then clear Laravel's cached configuration.

sudo nano /var/www/deming/.env
sudo -u www-data php /var/www/deming/artisan config:clear

• Mail (notifications and password reset email): set MAIL_HOST, MAIL_PORT, MAIL_USERNAME, MAIL_PASSWORD and MAIL_FROM_ADDRESS for your SMTP server, for example MAIL_HOST=<your-smtp-host>.
• LDAP: set LDAP_ENABLED=true and LDAP_HOST=<ldap-host>, LDAP_PORT, LDAP_USERNAME, LDAP_PASSWORD and LDAP_BASE_DN for your directory. LDAP_FALLBACK_LOCAL=true keeps local logins working alongside LDAP.
• Keycloak or OpenID Connect: add keycloak (or oidc) to SOCIALITE_PROVIDERS and fill in the matching KEYCLOAK_ (or OIDC_) values.

REST API (optional). Deming's API uses Laravel Passport, and its signing keys are never baked into the image. Generate this instance's own keys and client once.

cd /var/www/deming && sudo -u www-data php artisan passport:install

Point a DNS record at the instance, then set the name Deming is served as. The command creates a new self-signed certificate for the name, updates nginx, APP_URL and the URL in /root/deming-credentials.txt, and keeps the name across reboots.

sudo deming-set-hostname <your-domain>

To use a certificate from your own certificate authority instead, copy it over the generated pair and reload nginx. Running deming-set-hostname again replaces it with a self-signed certificate.

sudo install -m 0644 <your-fullchain.pem> /etc/ssl/deming/deming.crt
sudo install -m 0600 <your-private-key.pem> /etc/ssl/deming/deming.key
sudo nginx -t && sudo systemctl reload nginx

The instance ships with demonstration measures, risks and action plans. When you are ready to run your own program, clear them and keep only the ISO 27001:2022 controls. This deletes every record, so take a backup first (Step 13).

nginx is stopped while the database is rebuilt, because rebuilding recreates the seeded admin@admin.localhost / admin account. The last two commands give that account a new password before nginx starts again.

sudo systemctl stop nginx cd /var/www/deming
sudo -u www-data env LANG=en php artisan migrate:fresh --seed --force sudo -u www-data env LANG=en php artisan deming:import-framework storage/app/repository/ISO27001-2022.en.xlsx --clean read -rs -p 'New administrator password: ' PW; echo printf '%s' "$PW" | php -r '$h = password_hash(stream_get_contents(STDIN), PASSWORD_BCRYPT); echo "UPDATE users SET password=\x27$h\x27 WHERE login=\x27admin@admin.localhost\x27;";' | sudo mysql deming; unset PW
sudo systemctl start nginx

Everything you record is in the MariaDB database deming. Keep /var/www/deming/.env with it, because its application key signs your sessions. root dumps the database through the local socket, with no password on the command line.

sudo mysqldump --single-transaction deming > deming-$(date +%F).sql
sudo cp /var/www/deming/.env deming-env-$(date +%F).backup && sudo chmod 0600 deming-env-$(date +%F).backup

A snapshot of the root volume is the simplest full backup.

The image ships the Deming release named in the listing. Ubuntu's unattended upgrades keep the operating system, MariaDB and nginx patched, and PHP 8.4 from the ondrej/php PPA. To move to a newer Deming release later, take a snapshot and a dump first. Then follow the upstream upgrade notes, or launch a newer SecureAnyCloud version and restore your dump into it.

These are the main components and where they live on the instance.

• Deming application (web root is public/ only): /var/www/deming
• Per-instance configuration (application key, database password): /var/www/deming/.env (mode 0640, root:www-data)
• Uploaded documents and Laravel logs: /var/www/deming/storage
• nginx site and host name include: /etc/nginx/sites-available/deming, /etc/nginx/deming-host.conf
• Certificate and key: /etc/ssl/deming/
• PHP settings: /etc/php/8.4/fpm/conf.d/99-sac-deming.ini
• MariaDB settings: /etc/mysql/mariadb.conf.d/99-sac-bind.cnf
• MariaDB first start helper (creates the data directory on an empty /var/lib/mysql): /usr/local/sbin/sac-mariadb-datadir-init, /etc/systemd/system/mariadb.service.d/20-sac-datadir-init.conf
• First boot and host name helpers: /usr/local/sbin/deming-firstboot.sh, /usr/local/sbin/deming-set-hostname
• Service gates and metadata blocks: /etc/systemd/system/{nginx,php8.4-fpm,mariadb,deming-firstboot}.service.d/
• Credentials: /root/deming-credentials.txt (mode 0600)

• Allow SSH (port 22) from your own networks only, and open 80 and 443 only to the people who use your ISMS.
• Change the administrator password after your first sign-in (Step 6), and give each person their own account with the least role they need.
• Give edit roles to trusted staff only. Deming shows the text that users enter in controls, measures and action plans as formatted content to other signed-in users.
• Use your own DNS name and a certificate that your browsers trust (Step 11).
• Keep the operating system patched. Unattended security upgrades are on for Ubuntu's security updates and for PHP 8.4 from the ondrej/php PPA. Run sudo apt-get update && sudo apt-get upgrade to apply everything else.
• Back up the database and .env on a schedule (Step 13).