SecureAnyCloud
Deployment guide

elFinder

Overview

elFinder is a long-established open source web file manager that brings a familiar desktop-style file browser to the browser. Its two-pane interface shows a folder tree beside a file list. You can upload and download, rename, copy, move, search, preview images and text, and create or extract archives without leaving the page.

elFinder is distributed as a library rather than a finished application, and upstream ships a demo connector with no authentication at all. This image closes that gap before the VM is ever reachable. nginx enforces authentication across the entire application, including the PHP connector that performs the actual filesystem operations, so there is no unauthenticated route to your files. The SecureAnyCloud image serves elFinder 2.1.69 through nginx and PHP 8.3 FPM on a hardened Ubuntu 24.04 LTS base, patched at build time.

What you get:

  • elFinder 2.1.69 served by nginx and PHP 8.3 FPM, managed by systemd.
  • HTTP Basic authentication enforced on every path, including the php/connector.php endpoint.
  • A per-VM administrator password generated on first boot and recorded in a root-only file, so no shared or default login ever ships in the image.
  • A connector locked to a single volume, so there is no route from the interface to the wider filesystem.
  • Uploaded files stored outside the web document root and served back as inert downloads, so an uploaded script can never be executed.
  • Cross-site request forgery protection on every write command, enforced by the connector.
  • jQuery and jQuery UI vendored locally, so the interface has no runtime dependency on a public content delivery network.
  • A dedicated Azure data disk at /data holding the managed file tree at /data/elfinder/files.
  • nginx.service, php8.3-fpm.service and elfinder-firstboot.service as enabled systemd units.
  • An open /healthz endpoint for Azure Load Balancer health probes.
  • 24/7 SecureAnyCloud support.

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is a sensible starting point. Choose a larger size for heavier concurrent transfer loads.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. The image serves plain HTTP on port 80 by default. HTTP Basic authentication sends the password in an easily decoded header, so enable TLS before you expose the instance to the public internet, as described in Step 9.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for elFinder by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:elfinder-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name elfinder \
  --image sac1647283583153:elfinder-ubuntu-24-04:default:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web interface:

az vm open-port --resource-group <your-rg> --name elfinder --port 80

Look up the public address to browse to:

az vm show --resource-group <your-rg> --name elfinder --show-details --query publicIps -o tsv

Step 3 - Connect and confirm the services are running

SSH in as azureuser:

ssh azureuser@<vm-public-ip>

Confirm that nginx, PHP FPM and the first-boot unit are all active, and that nginx is listening on port 80:

systemctl is-active nginx php8.3-fpm elfinder-firstboot

Expected output:

active active active
ss -tlnp | grep ':80 ' | sed 's/ */ /g'

Step 4 - Retrieve the per VM administrator password

Each VM generates its own administrator password on first boot. The password, the login user and the managed root are written to a root-only credentials file. Read it with sudo:

sudo cat /root/elfinder-credentials.txt

Sign in with username admin and the ELFINDER_ADMIN_PASSWORD value from this file.

The ELFINDER_URL line records the address the VM sees itself on. Azure does not expose a Standard SKU public IP through the instance metadata service, so on those VMs this line shows the private address. Browse to the public address from Step 2 instead.

Step 5 - Confirm authentication is enforced

On a file manager, the property that matters most is that nothing is reachable without credentials. Confirm that an unauthenticated request to both the interface and the connector is refused with 401, while the health probe endpoint stays open for Azure Load Balancer:

curl -s -o /dev/null -w 'unauthenticated interface -> HTTP %{http_code}\n' http://127.0.0.1/
curl -s -o /dev/null -w 'unauthenticated connector -> HTTP %{http_code}\n' 'http://127.0.0.1/php/connector.php?cmd=open&target=&init=1'
curl -s -o /dev/null -w 'health probe -> HTTP %{http_code}\n' http://127.0.0.1/healthz

Expected output:

unauthenticated interface -> HTTP 401 unauthenticated connector -> HTTP 401 health probe -> HTTP 200

Next, confirm that the per-VM password authenticates:

curl -s -o /dev/null -w 'authenticated interface -> HTTP %{http_code}\n' -u 'admin:<ELFINDER_ADMIN_PASSWORD>' http://127.0.0.1/

Expected output:

authenticated interface -> HTTP 200

Step 6 - Sign in to elFinder

Browse to http://<vm-public-ip>/. Your browser prompts for a username and password in a native sign-in dialog. Enter admin and the password from Step 4. Nothing is served until you do, including the connector, so there is no way to reach the file tree without these credentials.

After you authenticate, elFinder opens on its two-pane interface, with the folder tree on the left, the file list on the right and the toolbar across the top.

Step 7 - Upload and organise files

Use the toolbar to upload files, or drag them onto the file list. Select any item to rename, copy, move, download or delete it, and use the archive commands to create or extract a zip or tar. The connector protects every write command against cross-site request forgery, so it refuses a request that did not originate in your authenticated session.

Select a file and open it to preview its contents in place, without downloading it first.

Everything you manage in the interface lives under the managed root on the dedicated data disk. Confirm it from the shell:

sudo ls -la /data/elfinder/files

Step 8 - Where your data lives

The managed file tree lives on a dedicated Azure data disk mounted at /data, separate from the OS disk. The disk is captured into the image and re-provisioned on every VM. Confirm the mount and the filesystem:

df -h /data | tail -1
findmnt -no SOURCE,TARGET,FSTYPE /data

The output shows the backing device, the /data mount point and the ext4 filesystem. The device node varies with the VM size you chose, so the mount is keyed by filesystem UUID in /etc/fstab rather than by device name.

The managed root sits outside the nginx document root, which is why the web server can never execute an uploaded file. Confirm the elFinder release and that all three units are enabled to start on boot:

grep -m1 '"version"' /var/www/elfinder/package.json
systemctl is-enabled nginx php8.3-fpm elfinder-firstboot

Step 9 - Enable HTTPS with Let's Encrypt

HTTP Basic authentication sends your password in an easily decoded header, so do not use it over plain HTTP on an untrusted network. Before you expose this instance to the public internet, point a DNS name at the VM, open port 443 in the NSG, and issue a certificate. Run these commands on the VM, replacing the example domain and email with your own:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com -m you@example.com --agree-tos --redirect --non-interactive

Certbot edits the nginx server block in place, keeps the existing authentication stanza and installs a renewal timer. When it completes, browse to https://your-domain.example.com/.

Step 10 - Change the administrator password

The credential is an nginx htpasswd entry. To set your own password, run htpasswd and reload nginx:

sudo htpasswd -B /etc/nginx/.htpasswd-elfinder admin
sudo systemctl reload nginx

To add a second account, run the same command with a different username. Every account listed in the file has the same access to the managed tree, so create accounts only for people you intend to give full access.

Server components

Component Version Purpose

elFinder 2.1.69 The web file manager application and its PHP connector

nginx Ubuntu 24.04 package Web server, and the point at which authentication is enforced

PHP FPM 8.3 Runs the elFinder connector

Ubuntu Server 24.04 LTS Base operating system, patched at build time

Filesystem layout

Path Purpose

/var/www/elfinder The elFinder application tree and the nginx document root

/var/www/elfinder/php/connector.php The hardened PHP connector, locked to a single volume

/var/www/elfinder/vendor Locally vendored jQuery and jQuery UI

/data The dedicated Azure data disk

/data/elfinder/files The managed file tree, outside the document root

/data/elfinder/tmp Connector temporary and trash scratch space

/etc/nginx/.htpasswd-elfinder The HTTP Basic credential file

/etc/nginx/sites-available/sac-elfinder The nginx server block

/root/elfinder-credentials.txt The per VM credentials, readable only by root

Managing the service

systemctl status nginx --no-pager | head -3
sudo systemctl restart nginx php8.3-fpm
sudo journalctl -u nginx -n 50 --no-pager

Troubleshooting

The browser keeps asking for a password. The username is admin, and the password is the ELFINDER_ADMIN_PASSWORD value in /root/elfinder-credentials.txt. If you have lost the password, set a new one with sudo htpasswd -B /etc/nginx/.htpasswd-elfinder admin, then run sudo systemctl reload nginx.

The interface loads but the file list stays empty or shows an error. This points at the connector rather than the web server. Check the PHP FPM log with sudo journalctl -u php8.3-fpm -n 50 --no-pager. Then confirm that the managed root exists and is owned by the web user with sudo ls -ld /data/elfinder/files.

Uploads fail for large files. The image allows uploads up to 512 MB. To raise the limit, edit upload_max_filesize and post_max_size in /etc/php/8.3/fpm/conf.d/99-elfinder.ini. Raise client_max_body_size in the nginx server block to match, then restart both services.

The health probe returns 401. The /healthz endpoint is the single deliberately unauthenticated path. If it prompts for credentials, someone has edited the server block. Compare it against /etc/nginx/sites-available/sac-elfinder and run sudo nginx -t.

Security notes

  • Authentication on every path. nginx enforces authentication on every path except /healthz, including the connector endpoint that performs filesystem operations. There is no unauthenticated route to your files.
  • Encrypt web traffic. The image serves plain HTTP by default. Enable TLS as described in Step 9 before you expose the instance to the public internet, and restrict port 80 in the NSG to trusted networks in the meantime.
  • Protect the administrator password. The per-VM administrator password lives in /root/elfinder-credentials.txt, readable only by root. Keep a copy somewhere safe, and change it to a password of your own with htpasswd.
  • One confined volume. The connector is locked to a single volume rooted at /data/elfinder/files, and the commands that could attach another volume are disabled. There is no route from the interface to the wider filesystem.
  • Inert uploads. Uploaded files are stored outside the web document root and served back with Content-Disposition: attachment and X-Content-Type-Options: nosniff, so the web server cannot execute an uploaded script.
  • Shared access level. Everyone listed in the htpasswd file has full access to the managed tree. Give out accounts accordingly, and use a separate instance where you need genuinely isolated storage.
  • Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. For questions about this elFinder image or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch elFinder 2.1 Web File Manager on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure