elFinder 2.1.70 web file manager

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Select elFinder 2.1.70 Web File Manager on Ubuntu 24.04 as the software version, select your Region, and choose Launch through EC2. Pick m5.large, your key pair, a security group as described above, and a subnet.

The AMI includes an 8 GiB root volume and a separate 20 GiB data volume that holds your files. Raise the data volume under Configure storage if you need more space. You can also grow it later (see Step 9).

To launch with the AWS CLI instead, replace the values in angle brackets. This command sets the data volume to 100 GiB:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=elfinder}]'

Connect to elFinder 2.1.70 Web File Manager on Ubuntu 24.04 as the SSH user ubuntu, with the key pair you chose at launch:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot generates the certificate and the password, and then starts the site. This takes a few seconds:

systemctl is-active elfinder-host elfinder-firstboot php8.3-fpm nginx

active active active active

Only SSH (22) and nginx (80, 443) listen on the network. PHP talks to nginx over a local socket, and the two loopback entries are Ubuntu's local DNS resolver:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

The health helper checks that the site answers and that it demands a sign-in:

sudo /usr/local/sbin/elfinder-health

PRIMARY_HEALTH_OK https://ec2-203-0-113-10.compute-1.amazonaws.com/ (healthz 200, UI 401 without credentials)

If nginx is not running, first boot has not finished, or it failed, in which case the site is never served. Check systemctl status elfinder-host elfinder-firstboot and journalctl -u elfinder-firstboot.

sudo cat /root/elfinder-credentials.txt

Only root can read this file. It holds the address and this instance's sign-in:

# elFinder 2.1.70 Web File Manager - generated on first boot by elfinder-firstboot.service
# This password is unique to this instance; none was baked into the image. Keep this file secret. ELFINDER_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/ ELFINDER_ADMIN_USER=admin ELFINDER_ADMIN_PASSWORD=<ELFINDER_ADMIN_PASSWORD> ...

You can confirm the sign-in from the instance itself. The helper checks the redirect, confirms that an unauthenticated request is refused, confirms that the password opens the page and the connector, and confirms that a wrong password and common defaults are refused:

sudo /usr/local/sbin/elfinder-cred-roundtrip

OK https 301 + unauthenticated 401 + admin opens UI and connector (API 2.1070) + wrong and default passwords refused

The connector reports elFinder's API version, 2.1070 for elFinder 2.1.70.

Open the ELFINDER_URL address in your browser. The certificate is self-signed until you install your own (Step 8), so the browser asks you to accept it once. Compare the fingerprint that the browser shows with the one on the instance:

sudo openssl x509 -in /etc/nginx/ssl/elfinder.crt -noout -fingerprint -sha256

Sign in as admin with the password from Step 4. The file manager opens on the Files volume, which starts with a few sample files that you can delete:

Change the password to one of your own at any time (16 to 128 characters, no spaces). The helper reads the new password from standard input, so it never appears in your shell history or the process list, and it updates the credentials file:

sudo elfinder-set-password --stdin

Run sudo elfinder-set-password without --stdin to generate a new random password instead. Your browser then asks you to sign in again.

Drag files from your desktop into the window to upload them, or use the upload button in the toolbar. Double-click a folder to open it. Select a file and press Space for a quick look:

Right-click a file or folder to see every action: open, download, preview, copy, cut, duplicate, delete, rename, resize and rotate an image, create a zip archive or extract one, and get info:

Keep the following in mind:

• Archives are zip. PHP itself creates and extracts archives, so zip is the only format available. When an archive holds a PHP file, script or executable, those items are refused and the rest is extracted.
• Refused uploads. PHP files (.php, .phtml, .phar and similar), shell, Perl and Python scripts, .htaccess / .user.ini files and executables are refused. Every other type uploads normally, up to 2 GB per file (large files go up in chunks).
• Web pages download. HTML and SVG files are offered as downloads rather than opened in the browser, so a page that you store cannot run as part of the file manager.
• No URL upload or network drives. This image does not support pasting a web address to fetch a file, or mounting FTP, SFTP or cloud storage.
• Direct links. A download link copied into a new browser tab's address bar is refused because it carries no proof that it came from the file manager page. Use the Download action instead.

Your files are in /var/lib/elfinder/files on the data volume, owned by the unprivileged elfinder account that PHP runs as:

sudo ls -la /var/lib/elfinder/files

To copy files in or out over SSH, write them as that account so the file manager can manage them, for example:

sudo -u elfinder cp /home/ubuntu/report.pdf /var/lib/elfinder/files/Documents/

Point a DNS record at the instance (an Elastic IP keeps the address across stop and start), and then tell the instance its name. This creates a new self-signed certificate for that name, updates the nginx host rule, the cross-site guard and the address in the credentials file, and keeps the name across reboots:

sudo elfinder-set-hostname files.example.com

To use a certificate from a public authority instead, replace /etc/nginx/ssl/elfinder.crt (full chain) and /etc/nginx/ssl/elfinder.key (mode 0600, owned by root) with your own, and then run sudo systemctl reload nginx. Running elfinder-set-hostname again later replaces them with a new self-signed pair. Basic authentication sends the password with every request, so keep the site on HTTPS.

Every service is enabled, so elFinder returns after a reboot or a stop and start, and your files and the password stay as they are. Unattended security upgrades keep the operating system, PHP and nginx patched:

systemctl is-enabled nginx php8.3-fpm unattended-upgrades

enabled enabled enabled

The data volume is mounted by its file system UUID. To grow it, enlarge the EBS volume in the EC2 console and then extend the file system online:

sudo resize2fs $(findmnt -no SOURCE /var/lib/elfinder)

To back up your files, take an EBS snapshot of the data volume, or use AWS Backup on the instance. elFinder itself is the release from the project's GitHub repository, and SecureAnyCloud publishes a new version of the image when a newer elFinder release is available.