Gibbon school Mis

Sign in to the Azure portal, choose Create a resource, search for the SecureAnyCloud Gibbon School MIS offering, and select Create.

Pick your subscription, resource group and region, and set the VM size to Standard_B2s. Choose SSH public key authentication with the username azureuser. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Select Review + create, then Create.

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:gibbon-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-resource-group \
  --name gibbon-01 \
  --image sac1647283583153:gibbon-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --storage-sku StandardSSD_LRS \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open the two ports you need:

az vm open-port --resource-group my-resource-group --name gibbon-01 --port 443 --priority 1001
az vm open-port --resource-group my-resource-group --name gibbon-01 --port 22 --priority 1002

ssh azureuser@<vm-public-ip>

The build account is removed before the image is captured. azureuser, or whichever admin name you chose at launch, is the only login on the VM.

First boot generates this VM's secrets and only then starts the web server, so allow two to three minutes after launch. Apache is held closed until that finishes. A VM that answers on 443 therefore already has its secrets in place.

systemctl is-active mysql apache2 gibbon-firstboot gibbon-baseurl

All four services report active. Next, check which ports are listening and confirm that the database is not exposed:

sudo ss -lnt | grep -E ':(22|80|443|3306) ' | sort

MySQL appears only on 127.0.0.1:3306. Confirm that Gibbon answers and check its version:

curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/index.php grep '^\$version' /var/www/gibbon/version.php

Every secret on this VM was generated on its first boot and written to a file that only root can read:

sudo cat /root/gibbon-credentials.txt

# sac :: Gibbon School MIS appliance credentials
# Generated on this VM's first boot. This file is readable only by root. # Sign in at https://<this-vm-address>/ and change the password afterwards. gibbon.admin.user=admin gibbon.admin.pass=<unique to this VM> gibbon.db.name=gibbon gibbon.db.user=gibbon gibbon.db.pass=<unique to this VM>

The credentials file is 0600 root:root, Gibbon's own config.php is 0640 root:www-data, and the TLS private key is 0600. Verify the permissions:

sudo stat -c '%a %U:%G %n' /root/gibbon-credentials.txt /var/www/gibbon/config.php /etc/ssl/gibbon/gibbon.key

Browse to https://<vm-public-ip>/. Your browser warns about the self-signed certificate until you install your own (Step 13). Sign in with the username admin and the password from Step 5.

Change the administrator password now. Open the user menu at the top right, choose Preferences, and set a password only you know. The password in /root/gibbon-credentials.txt gets you in the first time. It is not meant to be your long-term credential.

Gibbon ships with the system name Gibbon and the default organisation name Your School. Set your own under Admin > System Admin > System Settings, where you can also set your country, timezone and currency.

Year groups Year 7 to Year 13 are already created. Rename or replace them under Admin > School Admin > Manage Year Groups to match your school's naming.

Two school years are seeded, 2025-2026 and 2026-2027. Use the Year Switcher on the dashboard to move between them.

Gibbon builds enrolment, timetabling and reporting on a small amount of school structure, so create it first. Open Admin > School Admin and use Manage Year Groups, Manage Form Groups, Manage Houses and Manage Departments. Houses, form groups and departments start empty.

Add your people under Admin > User Admin > Manage Users. The image ships with exactly one account, the administrator you signed in as, so you create every other user.

Gibbon's installer (installer/install.php) is an unauthenticated three-step wizard. Upstream ships it with no guard against running again on an installed system, so a stranger who reaches it on a live server could point the site at their own database and create an administrator.

This image installs the database during the build and then blocks the installer at the web server. The installer is refused however the path is spelled and whatever state the database is in. Test several paths:

for p in /index.php /installer/install.php /installer/ /Installer/install.php /config.php /gibbon.sql; do printf '%-30s %s\n' "$p" "$(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1$p)" done

/index.php answers 200 and every other path answers 403. A POST is refused too:

curl -sk -o /dev/null -w '%{http_code}\n' -d 'step=4' https://127.0.0.1/installer/install.php

Confirm that the image contains a single account:

sudo mysql --protocol=socket -u root -D gibbon -e "SELECT username, status, canLogin FROM gibbonPerson;"

Gibbon locks an account after three failed sign-in attempts and then refuses even the correct password, showing "Too many failed logins: please reset password." This is Gibbon's own brute-force protection, and it applies to the administrator too.

If outbound email is configured (Step 12), use the Forgot Password? link on the sign-in page to get back in. If it is not, clear the failure counter from the VM:

sudo mysql --protocol=socket -u root -D gibbon -e "UPDATE gibbonPerson SET failCount=0 WHERE username='admin';"

If you have also forgotten the password, set a new one from the VM. Gibbon stores sha256(salt + password):

sudo NEWPW='<new-password>' php -r ' $pw = getenv("NEWPW"); $a = "./aAbBcCdDeEfFgGhHiIjJkKlLmMnNoOpPqQrRsStTuUvVwWxXyYzZ0123456789"; $salt = ""; for ($i=0;$i<22;$i++) { $salt .= $a[random_int(0, strlen($a)-1)]; } $h = hash("sha256", $salt.$pw); echo "UPDATE gibbonPerson SET passwordStrong=\"$h\", passwordStrongSalt=\"$salt\", failCount=0 WHERE username=\"admin\";\n"; ' | sudo mysql --protocol=socket -u root -D gibbon

Gibbon stores an absolute base URL and builds password reset and notification links from it. A fixed URL cannot be baked into a reusable image, so this image writes it on every boot from the VM's own address. It does the same for Apache's ServerName and the HTTPS certificate. Check the current values:

grep '^ServerName' /etc/apache2/conf-available/gibbon-servername.conf
sudo mysql --protocol=socket -u root -D gibbon -N -B -e "SELECT CONCAT('absoluteURL = ', value) FROM gibbonSetting WHERE scope='System' AND name='absoluteURL';"

Both name this VM's public address. Azure's instance metadata service returns an empty value for a Standard SKU public IP, so the image reads the load balancer endpoint first. It falls back to the private address only if there is no public one. A VM that is stopped, deallocated and restarted with a new public IP therefore picks up the new address by itself.

The certificate names the same address, and port 80 only redirects. Verify both:

openssl x509 -in /etc/ssl/gibbon/gibbon.crt -noout -subject -ext subjectAltName curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' http://127.0.0.1/

Gibbon sends password resets, notifications and messenger mail. Open Admin > System Admin > Third Party Settings, go to the Email section, and enter your SMTP host, port, username and password. Choose whether to use TLS.

Azure blocks outbound port 25 on most subscriptions, so use a relay on port 587 or an email API rather than direct delivery. When the settings are saved, send yourself a test from Other > Messenger.

Point a DNS A record at the VM's public IP. Then pin the name so that Gibbon and Apache use it instead of the IP address:

echo '<your-domain>' | sudo tee /etc/gibbon/server-name
sudo /usr/local/sbin/gibbon-baseurl.sh

Replace the self-signed certificate with a trusted one:

sudo apt-get update && sudo apt-get install -y certbot
sudo certbot certonly --webroot -w /var/www/gibbon -d <your-domain>
sudo ln -sf /etc/letsencrypt/live/<your-domain>/fullchain.pem /etc/ssl/gibbon/gibbon.crt
sudo ln -sf /etc/letsencrypt/live/<your-domain>/privkey.pem /etc/ssl/gibbon/gibbon.key
sudo systemctl reload apache2

On later boots, the base URL helper leaves your pinned name and your certificate unchanged.

• Only 22/tcp, 80/tcp and 443/tcp are reachable from outside the VM. MySQL listens on 127.0.0.1 only, and MySQL's X Protocol plugin is switched off, so nothing answers on 33060
• Port 80 issues a permanent redirect to HTTPS and serves no content of its own
• The web server refuses requests for the setup wizard, the database configuration, the SQL schema and Gibbon's application source directories
• Files uploaded through Gibbon are served as files and never executed. The code tree is read-only to the web server, and only uploads/ is writable
• root cannot sign in over SSH, and password authentication is disabled
• MySQL's root account authenticates through the local UNIX socket and has no password to ship
• Every per-VM secret (administrator password, database password, database maintenance password, installation ID and TLS key) is generated on this VM's first boot, so two VMs from this image never share one

Gibbon's state is the MySQL database plus everything uploaded into /var/www/gibbon/uploads. Back up both:

sudo mysqldump --protocol=socket -u root --single-transaction --routines gibbon \
  | gzip > "<backup-dir>/gibbon-db-$(date +%F).sql.gz"
sudo tar czf "<backup-dir>/gibbon-uploads-$(date +%F).tar.gz" -C /var/www/gibbon uploads

Copy both files off the VM. For a whole-machine restore point, also take Azure disk snapshots.

The image receives Ubuntu security updates automatically through unattended-upgrades.

For Gibbon itself, upstream publishes a new major release each year and patch releases in between. Read the release notes, back up first (Step 15), then follow upstream's upgrade instructions.

Gibbon's in-application "cutting edge" auto-updater is switched off in this image on purpose, so the appliance never pulls code at runtime. Usage statistics reporting is also off, so this VM does not phone home.