FileGator 7.16.8

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick FileGator 7.16.8 on Ubuntu 24.04 as the software version, choose your Region, then choose Launch through EC2.

Choose m5.large, your key pair, a security group as described above, and a subnet. The AMI brings an 8 GiB root volume and a separate 20 GiB data volume that holds your files. To get more space, raise the data volume under Configure storage. You can also grow it later (see Step 9).

To launch with the AWS CLI, replace the values in angle brackets. This example sets the data volume to 100 GiB:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=filegator}]'

Connect as the ubuntu user (FileGator 7.16.8 on Ubuntu 24.04):

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot generates the certificate, creates the administrator and starts the site. This takes a few seconds. Check that all four services are active:

systemctl is-active filegator-host filegator-firstboot php8.3-fpm nginx

active active active active

Only SSH (22) and nginx (80, 443) listen on the network. PHP talks to nginx over a local socket, and the two loopback entries are Ubuntu's local DNS resolver:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

Run the health helper. It checks that the site answers and that an anonymous visitor is the powerless guest:

sudo /usr/local/sbin/filegator-health

PRIMARY_HEALTH_OK https://ec2-203-0-113-10.compute-1.amazonaws.com/ (healthz 200, page 200, anonymous = guest)

If nginx is not running, first boot has not finished, or it failed and the site is never served. Check systemctl status filegator-host filegator-firstboot and journalctl -u filegator-firstboot.

sudo cat /root/filegator-credentials.txt

Only root can read this file. It holds the address and this instance's administrator sign-in:

# FileGator 7.16.8 - generated on first boot by filegator-firstboot.service
# This password is unique to this instance; none was baked into the image. Keep this file secret. FILEGATOR_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/ FILEGATOR_ADMIN_USER=admin FILEGATOR_ADMIN_PASSWORD=<FILEGATOR_ADMIN_PASSWORD> ...

You can confirm the sign-in from the instance itself. The helper checks four things. It checks the redirect and that an anonymous visitor has no permissions. It checks that the password signs in through FileGator's own login and lists your files. It also checks that a wrong password, the upstream default admin123 and the guest account are refused:

sudo /usr/local/sbin/filegator-cred-roundtrip

OK https 301 + anonymous = powerless guest + admin signs in and lists the repository + wrong, admin123 and guest refused

Open the FILEGATOR_URL address in your browser. The certificate is self-signed until you install your own (Step 8), so the browser asks you to accept it once. Compare the fingerprint it shows with the one on the instance:

sudo openssl x509 -in /etc/nginx/ssl/filegator.crt -noout -fingerprint -sha256

Sign in as admin with the password from Step 4:

FileGator opens on your file repository, which starts with a few sample files. You can delete them:

Change the administrator password to one of your own whenever you like. In FileGator, click Administrator (top right) and change it there. Or change it on the instance. The password must be 16 to 128 characters with no spaces. The helper reads it from standard input, so it never appears in your shell history or the process list, and it updates the credentials file:

sudo filegator-set-password --stdin

Run sudo filegator-set-password without --stdin to generate a new random password instead. Sessions signed in with the old password are signed out.

Click Add files, or drag files and folders onto the window, to upload. Select files to copy, move, rename, zip, unzip, download or delete them. To get several files as one zip archive, select them and choose Download. Text files open in the built-in editor.

Sign in as admin and open Users to add people. Each user gets a home folder (they see only that folder and what is below it) and the permissions you tick.

The guest account stands for visitors who are not signed in. Leave its permissions empty to keep the site private:

Keep these points in mind:

• Refused names. PHP files (.php, .phtml, .phar and similar), shell, Perl, Python and Ruby scripts, .htaccess / .user.ini files and names that start with a dot are refused when you upload, create, rename, zip or save. Every other type uploads normally, up to 1 GiB per file.
• Downloads. Files are offered as downloads (PDF files open in the browser), so a web page you store cannot run as part of FileGator.
• Unzip. FileGator 7.16.8 reports "Failed" after every unzip even when it worked. This is an upstream quirk. Refresh the folder to see the extracted files.
• Direct links. A FileGator download link pasted into a new browser tab's address bar is refused, because it carries no proof that it came from FileGator's page. Use the Download action instead.

Your files are in /var/lib/filegator/repository on the data volume. The unprivileged filegator account that PHP runs as owns them. Each user's home folder is a folder inside it:

sudo ls -la /var/lib/filegator/repository

To copy files in or out over SSH, write them as that account so FileGator can manage them. For example:

sudo -u filegator cp /home/ubuntu/report.pdf /var/lib/filegator/repository/Documents/

The users, with their bcrypt password hashes, are in /var/lib/filegator/users/users.json. Only filegator can read that file. FileGator's sign-in log is /var/www/filegator/private/logs/app.log.

Point a DNS record at the instance. An Elastic IP keeps the address across stop and start. Then tell the instance its name.

This command creates a new self-signed certificate for that name. It updates the nginx host rule, the cross-site guard and the address in the credentials file, and it keeps the name across reboots:

sudo filegator-set-hostname files.example.com

To use a certificate from a public authority instead, replace /etc/nginx/ssl/filegator.crt (full chain) and /etc/nginx/ssl/filegator.key (mode 0600, owned by root) with your own. Then run sudo systemctl reload nginx. If you run filegator-set-hostname again later, it replaces them with a new self-signed pair.

Every service is enabled, so FileGator returns after a reboot or a stop and start. Your files, users and passwords stay as they are. Unattended security upgrades keep the operating system, PHP and nginx patched:

systemctl is-enabled nginx php8.3-fpm unattended-upgrades

enabled enabled enabled

The data volume is mounted by its file system UUID. To grow it, enlarge the EBS volume in the EC2 console, then extend the file system online:

sudo resize2fs $(findmnt -no SOURCE /var/lib/filegator)

To back up your files and users, take an EBS snapshot of the data volume, or use AWS Backup on the instance. SecureAnyCloud publishes a new version of the image when a newer FileGator release is available.