Forma LMS

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point for a small team. Step up to a larger size for heavier concurrent use.

In the network security group (NSG), allow inbound 443/tcp for the application (HTTPS, primary), 80/tcp (which redirects to 443), and 22/tcp from your management network. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Forma LMS by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22), HTTP (80) and HTTPS (443).

Select Review + create, then Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:formalms-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name formalms \
  --image sac1647283583153:formalms-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open ports 80 and 443:

az vm open-port --resource-group <your-rg> --name formalms --port 80,443

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that Apache, PHP FPM, MariaDB and the first boot service are all active.

MariaDB listens only on 127.0.0.1:3306. Apache serves Forma over HTTPS on port 443, and port 80 redirects to 443. The unauthenticated /healthz endpoint answers 200 for load balancer probes.

systemctl is-active apache2 php8.1-fpm mariadb formalms-firstboot curl -s -o /dev/null -w 'healthz -> %{http_code}\n' http://127.0.0.1/healthz

Expected output:

active active active active healthz -> 200

Step 4 - Retrieve the per-VM administrator password

On the first boot of every instance, a one-shot service generates a unique administrator password and a unique MariaDB password. It writes them to /root/formalms-credentials.txt, which only root can read. There is no shared default login.

sudo cat /root/formalms-credentials.txt

The file lists the admin login (admin), the generated password, the application URL and the loopback MariaDB details. The keys are shown below. The values are unique to your instance.

FORMALMS_URL=https://<your-instance-ip>/ FORMALMS_ADMIN_USER=admin FORMALMS_ADMIN_PASSWORD=<FORMALMS_ADMIN_PASSWORD> FORMALMS_DB_NAME=forma FORMALMS_DB_USER=formauser FORMALMS_DB_PASSWORD=...

Step 5 - Sign in to Forma LMS

Browse to https://<your-instance-ip>/ and sign in with the username admin and the password from the credentials file. The login form passes your credentials to Forma's own authentication and lands you in the platform.

The certificate is self-signed and generated for your instance, so your browser shows a one-time warning. To serve a DNS name with a matching certificate, run sudo formalms-set-hostname <your-dns-name>.

After you sign in, switch to the Admin area to reach the administration dashboard. It summarizes registered users, super administrators, online users, the installed version, and course and access statistics.

Step 6 - Manage courses

From the E-learning menu, open the course management list. Here you create course categories and courses, import SCORM, AICC and xAPI content, enroll learners, and run classroom and virtual sessions. A fresh appliance starts with an empty course list, ready for your content.

Step 7 - Manage users

From the Users menu, open user management. Here you create users and groups, assign administrator and instructor roles, import users in bulk, and organize your learners across the org chart.

Security model

This image never ships a usable default login and never ships a database. On the first boot of every VM, a fresh database is initialized, and a unique administrator password and a unique MariaDB password are generated and written to the root-only credentials file. No two deployments share a password.

You can check the model on the instance. The per-VM administrator authenticates through the real Forma login form, while a blank password and common weak guesses are rejected.

sudo bash /usr/local/sbin/formalms-cred-roundtrip.sh

Expected output:

OK admin authenticates; blank+weak rejected

Additional hardening in this image:

• Setup routes disabled once installed. The web installer is completed and locked, and Forma's installer and upgrade setup routes are refused on the running image (they return 403), which closes a class of unauthenticated administrator reset through those routes. The read-only system status route stays available.
• HTTPS from first boot with a per-instance certificate. Port 80 redirects to 443. The web server strips forwarded client-IP headers (X-Forwarded-For, X-Real-IP), so the application sees only the real peer address.
• No shared database state. The schema ships as a seed that is imported into a freshly initialized database on first boot. Nothing in the image carries a usable password.
• Cloud metadata endpoints blocked from the application services (MariaDB, PHP FPM, Apache, and the first boot and cron units), while the Azure agent and cloud-init keep the access they need.
• Dependencies patched. The Symfony libraries are updated to their advisory-fixed releases. One residual advisory remains in the Twig 2.x templating library that Forma requires. Forma pins the 2.x line, which has no fixed release. The advisory is not reachable in this image, because Forma loads only its own shipped templates from the filesystem, with no template sandbox and no user-supplied template source. It is documented here rather than suppressed.

Versions and the first boot service

Confirm the installed component versions, the completed and locked install, and the state of the first boot service.

php8.1 -v | head -1 mariadb --version systemctl is-active formalms-firstboot

Where your data lives

The Forma LMS application code lives at /var/www/formalms/html, its configuration at /var/www/formalms/html/config.php (denied to the web by Forma's own rules), and uploaded and generated content under /var/www/formalms/html/files.

No database ships in the image. The MariaDB datadir under /var/lib/mysql is empty until first boot. At first boot it is initialized, and the forma database is created from the shipped schema seed with a password unique to your instance. The database is reachable only on the loopback interface.

The formalms-cron.timer systemd timer runs Forma's scheduled jobs every five minutes.

Support

This image is backed by 24/7 SecureAnyCloud support. Contact sales@secureanycloud.com for help with deployment, course and SCORM configuration, learning plan and certification setup, version upgrades, performance tuning, and MariaDB database administration.

Deploy on Azure

Launch Forma LMS 4.1 on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com