ILIAS

Sign in to the Azure Portal, select Create a resource, and search the Marketplace for ILIAS by SecureAnyCloud. Select Create.

On the Basics tab, choose your subscription, resource group, region and size (Standard_B2ms or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443).

Select Review + create, and then Create.

az vm create \
  --resource-group <your-rg> \
  --name ilias \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open HTTPS so that learners can reach the platform:

az vm open-port --resource-group <your-rg> --name ilias --port 443 --priority 900

Connect over SSH:

ssh azureuser@<vm-public-ip>

First boot generates this VM's secrets and only then opens the front door, so if the web server is running, the installation is ready. Check the four units:

systemctl is-active mariadb php8.3-fpm apache2 ilias-cron.timer

All four report active:

active active active active

Confirm that ILIAS answers over HTTPS on the VM itself. The image ships a self-signed certificate, so -k is expected here until you install your own certificate in Step 11:

curl -sk -o /dev/null -w '%{http_code}\n' 'https://127.0.0.1/login.php?client_id=ilias&cmd=force_login'

That prints 200.

Quote the URL, because an unquoted & would background the command in your shell. Requesting login.php without cmd=force_login answers 302 rather than 200, because ILIAS redirects you to the default view.

Only SSH and HTTPS are reachable from off the VM. The database and PHP-FPM are deliberately not reachable:

ss -lntu | grep -E ':(3306|443|80|22) ' | sort

MariaDB appears only on 127.0.0.1:3306, while :22, :80 and :443 are the three ports that the network sees. PHP-FPM does not appear at all, because it listens on a UNIX socket, not a TCP port.

Every secret on this VM was generated on its first boot and written to a file that only root can read. Nothing here is shared with any other deployment:

sudo cat /root/ilias-credentials.txt

# sac :: ILIAS 11 appliance credentials
# Generated on this VM's first boot. This file is readable only by root. # Change the administrator password after your first sign-in. ilias.admin.user=root ilias.admin.pass=<unique to this VM> ilias.client.id=ilias ilias.db.user=ilias ilias.db.pass=<unique to this VM>

root here is ILIAS's own administrator account, not the Linux root user.

ILIAS's documented default password for that account is not present in this image. It is replaced during the build, and replaced again with a value that nobody records before the image is captured. Your VM creates its own password on first boot.

ILIAS builds its links from the address that you browse with. Every time the VM boots, this image tells ILIAS which addresses the VM answers on: the public IP, the private IP, the hostname and localhost. A stop and start that changes your Azure public IP is therefore picked up automatically, with nothing to edit.

You can see the list of addresses that ILIAS accepts:

sudo mariadb -u root ilias -BN -e "SELECT value FROM settings WHERE keyword='allowed_hosts';"

Browse to https://<vm-public-ip>/. Your browser warns about the self-signed certificate. Accept it to continue, or install your own certificate first (Step 11).

Open https://<vm-public-ip>/ and sign in with the username root and the password from Step 5.

Change the password immediately. Click your avatar at the top right, choose Settings, then choose Password. The image enforces a minimum of 12 characters, with upper case, lower case, digits and symbols.

In the left sidebar, choose Repository, then Add New Item, then Course. Give the course a title and select Add Course.

ILIAS opens the new course on its Settings tab and confirms that the course was added. A new course is Offline until you publish it. On the Settings tab, tick Online under Availability and select Save.

Use the Content tab to add learning modules, tests, exercises and files. Use the Members tab to enrol learners.

ILIAS runs background work through its own job runner. This work includes notification mails, expired session cleanup, certificate generation and learning progress recalculation.

On this image, the job runner is a systemd timer that fires every five minutes. It is not a public web endpoint, so nothing outside the VM can trigger it.

systemctl list-timers ilias-cron.timer --no-pager

You can run the jobs immediately and confirm that the run was recorded:

sudo systemctl start ilias-cron.service && sudo mariadb -u root ilias -BN -e "SELECT FROM_UNIXTIME(value) FROM settings WHERE keyword='last_cronjob_start_ts';"

That prints the timestamp of the run that has just happened. Manage the individual jobs in Administration > System Settings and Maintenance > Cron Jobs.

ILIAS sends account, notification and password-reset mail. Azure blocks outbound port 25 on most subscriptions, so relay through an authenticated provider.

Go to Administration > System Settings and Maintenance > Mail > SMTP. Enable SMTP and enter your provider's host, port (587), username and password. Then send yourself a test message from Mail.

Point a DNS A record at the VM's public IP, then obtain a certificate for that name. Once the name resolves publicly, run:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d lms.example.com

Certbot installs the certificate and renews it automatically. Then tell ILIAS to use the name in the links that it builds outside a web request, such as in notification mail:

sudo sed -i 's#^http_path = .*#http_path = "https://lms.example.com"#' /var/www/ilias/ilias.ini.php
sudo systemctl reload apache2

ILIAS accepts your domain automatically, alongside the VM's own addresses.

• No default or shared credential ships in the image. The ILIAS administrator password, the database password, the Web Access Checker and WebDAV URL signing keys, the installation identifiers and the HTTPS certificate are all generated on this VM's first boot.
• ILIAS 11 has no web installation wizard. The setup is a command-line tool that lives above the web root, and the web server also denies /setup and /cli outright.
• The files that carry secrets are denied over HTTP and readable only by the web server user. They are client.ini.php, key_rotation.php and webdav_key_rotation.php.
• Only 22/tcp and 443/tcp are reachable from off the VM. 80/tcp issues a permanent redirect to HTTPS and serves nothing else. MariaDB is bound to 127.0.0.1, and PHP-FPM uses a UNIX socket.
• Self-registration is off by default. Turn it on in Administration > Users and Roles > User Management > New Account Registration only when you intend to accept public sign-ups.
• Ubuntu's unattended security upgrades remain enabled.

ILIAS keeps state in two places: the database, and the file store outside the web root. Back up both:

sudo mariadb-dump --single-transaction --routines ilias | gzip > ~/ilias-db-$(date +%F).sql.gz
sudo tar czf ~/ilias-files-$(date +%F).tar.gz /var/www/files

Copy both off the VM, and take an Azure disk snapshot before any upgrade.

Ubuntu security updates are applied automatically. To move to a later ILIAS 11 point release, back up first (Step 13). Then replace the code and run the setup's update command:

sudo systemctl stop apache2 cd /tmp && curl -fsSLO https://github.com/ILIAS-eLearning/ILIAS/releases/download/v11.5/ILIAS-11.5.tar.gz
sudo tar -xzf ILIAS-11.5.tar.gz -C /var/www/ilias --strip-components=1 ILIAS-11.5/
sudo chown -R www-data:www-data /var/www/ilias cd /var/www/ilias && sudo -u www-data php cli/setup.php update /var/www/config/ilias.json
sudo systemctl start apache2

Check the installation's health at any time. The check reports each component's database schema version and whether an update is outstanding:

cd /var/www/ilias && sudo -u www-data php cli/setup.php status 2>/dev/null | head -20