LimeSurvey

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Choose a larger size for bigger studies or busier surveys.

Configure the network security group (NSG) to allow 22/tcp inbound from your management network and 80/tcp for the survey site. LimeSurvey serves plain HTTP on port 80, so terminate TLS in front of it with your own domain. The bundled MariaDB is never exposed. It listens on 127.0.0.1 only, so port 3306 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for LimeSurvey by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:limesurvey-ubuntu-24-04:default:latest
az vm create \
  --resource-group <your-rg> \
  --name limesurvey \
  --image sac1647283583153:limesurvey-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 to the survey site:

az vm open-port --resource-group <your-rg> --name limesurvey --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that nginx, PHP FPM and MariaDB are all active. MariaDB listens only on 127.0.0.1:3306, while nginx serves LimeSurvey on port 80.

systemctl is-active nginx php8.3-fpm mariadb limesurvey-firstboot

ss -tlnp | grep -E ':80 |:3306 ' | sed 's/ */ /g'

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own LimeSurvey administrator password on first boot. It writes the password, the login user and the admin console URL to a root-only credentials file. Read the file with sudo:

sudo cat /root/limesurvey-credentials.txt

Sign in to the administration console as user admin with the LIMESURVEY_ADMIN_PASSWORD from this file. On the VM itself, you can also run sudo mariadb to reach the database directly over the local socket without a password.

Step 5 - Sign in to the administration console

Browse to http://<vm-public-ip>/index.php/admin. The LimeSurvey administration sign-in page opens. Enter the username admin and the password from Step 4.

After you sign in, the survey list dashboard opens. From there you can create surveys, search and manage existing ones, and reach the global settings.

Step 6 - Build a survey

Select Create survey, give it a title and a welcome message, then add question groups and questions.

LimeSurvey offers dozens of question types (single and multiple choice, arrays, free text, ratings, uploads and more), along with conditions and branching, quotas, assessments and multilingual versions. The survey structure editor shows the settings, text elements and sharing options of a survey. Use the Structure tab to organise groups and questions.

Step 7 - Activate and share the survey

When your survey is ready, select Activate survey to open it for responses, then share the public participation link. Respondents complete the survey in a clean, mobile-friendly theme. You collect and analyse the results with the built-in LimeSurvey statistics and exports.

Step 8 - No known or default credentials

LimeSurvey is installed non-interactively, so no default web installer login ships. The SecureAnyCloud image goes further: the first superadmin account is created with a unique per-VM secret on first boot, and no known or blank password authenticates.

You can verify this with the built-in round-trip check. It confirms that the per-VM administrator signs in through the LimeSurvey login form while a blank password and common weak guesses are all rejected:

sudo mariadb --protocol=socket -uroot -N -e "SELECT CONCAT(users_name,' (superadmin account)') FROM limesurvey.lime_users WHERE users_name='admin'"

sudo bash /usr/local/sbin/limesurvey-cred-roundtrip.sh

Step 9 - Verify the stack and where your data lives

Confirm the LimeSurvey version, the health endpoint and the dedicated data disk. The MariaDB database lives on the data disk mounted at /data (bind-mounted onto /var/lib/mysql). The uploaded survey resources and temporary files of LimeSurvey live on the same disk, so all of your survey content is kept separate from the operating system disk and travels with the VM:

php -r "require '/var/www/limesurvey/application/config/version.php'; echo 'LimeSurvey CE '.\$config['versionnumber'].'+'.\$config['buildnumber'].PHP_EOL;"

curl -sI http://127.0.0.1/healthz | head -1

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /data;
findmnt -no SOURCE,TARGET /var/lib/mysql

Adding your own domain and TLS

The appliance serves plain HTTP on port 80. Front LimeSurvey with your own domain and a TLS certificate. LimeSurvey builds its links from the request host, so once you reach it through your domain, the admin and public survey URLs follow automatically.

You can terminate TLS with Azure Application Gateway, an nginx or Caddy reverse proxy, or a managed load balancer with a certificate for your domain.

Security notes

• LimeSurvey serves plain HTTP on port 80. For anything beyond a trusted network, put it behind your own TLS-terminating reverse proxy or an Azure Application Gateway with a certificate for your domain.
• The bundled MariaDB listens on 127.0.0.1 only and is never reachable from the network. Administer it through LimeSurvey or over SSH.
• The administrator password is unique per VM, and no known or blank credential authenticates. Keep /root/limesurvey-credentials.txt protected, and change the password from within LimeSurvey if you share access.
• nginx denies direct web access to the application, framework, vendor, third-party and other private directories.
• Restrict inbound 80/tcp in your NSG to the networks that need the survey site.

Trademark

LimeSurvey is a trademark of LimeSurvey GmbH. SecureAnyCloud packages this image independently from the free, GPL-licensed LimeSurvey Community Edition. It is not affiliated with, sponsored by or endorsed by LimeSurvey GmbH.

Support

SecureAnyCloud maintains this image and provides 24/7 support. If you need help deploying or operating LimeSurvey on Azure, contact us at secureanycloud.com.

Deploy on Azure

Launch LimeSurvey on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Launching the instance

Launch the AMI from AWS Marketplace, or with the EC2 console or CLI. The recommended instance type is m5.large or larger. Configure your security group with these rules:

Port Protocol Purpose Suggested source

22 TCP SSH administration Your management CIDR only

80 TCP LimeSurvey administration and the public survey front end Your respondents' networks, or 0.0.0.0/0 for a public survey

443 TCP HTTPS once you attach a certificate Same as port 80

Port 3306 is never required and should never be opened: MariaDB listens on the loopback interface only.

First boot takes roughly two minutes. It generates the credentials and encryption keys for this instance, so wait for it to finish before you sign in.

Connecting to your instance

OS variant SSH login user Example

Ubuntu 24.04 ubuntu ssh -i your-key.pem ubuntu@<public-ip>

Replace <public-ip> with the public IPv4 address shown for your instance in the EC2 console, and your-key.pem with the private key of the key pair you selected at launch.

Confirming the stack is up

Every service LimeSurvey needs is enabled and starts automatically:

systemctl is-active nginx.service php8.3-fpm.service mariadb.service limesurvey-firstboot.service

active active active active

NGINX serves an unauthenticated static health endpoint at /healthz, which is what you point an Application Load Balancer or an EC2 health check at:

curl -s -o /dev/null -w 'health endpoint: HTTP %{http_code}\n' http://127.0.0.1/healthz

health endpoint: HTTP 200

Confirm the shipped versions:

grep -E "versionnumber|buildnumber" /var/www/limesurvey/application/config/version.php php -r 'echo "PHP ", PHP_VERSION, "\n";' mariadb --version nginx -v

$config['versionnumber'] = '7.0.6'; $config['buildnumber'] = 260722; PHP 8.3.6 mariadb Ver 15.1 Distrib 10.11.14-MariaDB, for debian-linux-gnu (x86_64) using EditLine wrapper nginx version: nginx/1.24.0 (Ubuntu)

Retrieving your administrator credentials

First boot writes this instance's credentials to a root-only file at /root/limesurvey-credentials.txt, mode 0600. The file holds three keys:

sudo grep -oE '^LIMESURVEY_[A-Z_]+=' /root/limesurvey-credentials.txt

LIMESURVEY_ADMIN_URL= LIMESURVEY_ADMIN_USER= LIMESURVEY_ADMIN_PASSWORD=

To read the values, run one of the commands in the table below over SSH. Keep the output private, because it holds the only administrator account on the instance.

What you need Command

The whole credentials file sudo cat /root/limesurvey-credentials.txt

Just the administrator password sudo grep '^LIMESURVEY_ADMIN_PASSWORD=' /root/limesurvey-credentials.txt \| cut -d= -f2-

Just the sign-in URL sudo grep '^LIMESURVEY_ADMIN_URL=' /root/limesurvey-credentials.txt \| cut -d= -f2-

The password is generated from openssl rand on this instance and on no other. Two instances launched from this AMI never share it.

Signing in

Browse to http://<public-ip>/index.php/admin and sign in with user admin and the password from the credentials file.

After you sign in, change the password from admin menu > My account, and add a real email address so password resets work.

The trusted host list, on your first sign-in

LimeSurvey 7 protects against HTTP Host header injection with a trusted host allowlist. The file that holds it, application/config/allowed_hosts.php, does not ship in this image, so a fresh instance answers on any hostname.

On your first successful administrator sign-in, LimeSurvey creates that file and pins the hostname you used at that moment. Every later request that arrives with a different Host header is then rejected with HTTP 400 The requested hostname is invalid.

This has two practical consequences:

• Sign in first on the name you intend to use in production. If you plan to put surveys.example.com in front of the instance, point the DNS record at it and sign in on that name, not on the raw public IP.
• To serve more than one hostname (for example an IP for administration and a domain for respondents), edit the file after that first sign-in:

Task Command

Show the current trusted hosts sudo cat /var/www/limesurvey/application/config/allowed_hosts.php

Edit the list sudo -u www-data nano /var/www/limesurvey/application/config/allowed_hosts.php

Start over (re-pin on the next sign-in) sudo rm /var/www/limesurvey/application/config/allowed_hosts.php

Building your first survey

Select Surveys > Create survey, then give the survey a title and a base language. LimeSurvey creates a first question group and an example question for you.

Each survey has its own settings for text elements, privacy policy, presentation, participant handling, notifications, quotas and permissions:

Add your questions, then use Preview survey to see exactly what a respondent will see:

When the survey is ready, activate it from the survey toolbar. Activation creates the response table of the survey, after which the survey list shows its status and a live response count:

Share the participation link, http://<public-ip>/index.php/<survey-id>, with your respondents. Alternatively, use Survey participants to send tokenised invitations and reminders.

View results under Responses. You can export them to CSV, Excel, PDF, SPSS or R from Responses > Export.

Storage layout

The database tier and the application data tier each sit on their own EBS volume, so you can grow the response store and the uploaded-file store independently of the operating system disk and snapshot them separately.

findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/mysql
findmnt -no SOURCE,TARGET,FSTYPE,SIZE /var/lib/limesurvey df -h --output=target,size,used,avail / /var/lib/mysql /var/lib/limesurvey

/dev/nvme2n1 /var/lib/mysql ext4 29.4G /dev/nvme1n1 /var/lib/limesurvey ext4 29.4G Mounted on Size Used Avail / 38G 3.7G 35G /var/lib/mysql 30G 126M 28G /var/lib/limesurvey 30G 176M 28G

• /var/lib/mysql is the MariaDB data directory. It holds the limesurvey schema, every survey definition and every survey response.
• /var/lib/limesurvey holds LimeSurvey's writable state: upload/ for survey resources and respondent file uploads, and tmp/ for exports, imports, the runtime cache, published assets and the session cache. LimeSurvey reaches them through symlinks from its own tree:

ls -l /var/www/limesurvey/upload /var/www/limesurvey/tmp

lrwxrwxrwx 1 root root 23 /var/www/limesurvey/tmp -> /var/lib/limesurvey/tmp lrwxrwxrwx 1 root root 26 /var/www/limesurvey/upload -> /var/lib/limesurvey/upload

Both volumes are recorded in /etc/fstab by filesystem UUID, not by device name. The layout therefore survives reboots and re-launches, even though NVMe device names are not stable. To grow either tier, resize the EBS volume in the EC2 console, then run sudo growpart on the device and sudo resize2fs on the filesystem.

Security posture

The web installer is blocked

A LimeSurvey installation whose web installer is still reachable can be claimed by the first visitor. On this image the installer is blocked twice over, independently.

First, NGINX denies every installer path outright:

for p in /installer /index.php/installer/welcome; do printf '%s -> HTTP %s\n' "$p" "$(curl -s -o /dev/null -w '%{http_code}' http://127.0.0.1$p)" done

/installer -> HTTP 403 /index.php/installer/welcome -> HTTP 403

Second, LimeSurvey refuses on its own:InstallerController::checkInstallation() aborts with "Installation has been done already. Installer disabled." whenever application/config/config.php exists, which it does on every instance of this image. Removing the NGINX rule would not re-open the installer.

No default or shared credential

The LimeSurvey console installer creates the admin account at build time with a random password. That password is then discarded and re-minted per instance at first boot, so there is no admin/password pairing to find. The image also ships no usable system password hash at all:

sudo awk -F: 'BEGIN{n=0} $2!="" && $2!="*" && $2 !~ /^!/ {n++} END{print "accounts with a usable password hash: " n}' /etc/shadow

accounts with a usable password hash: 0

SSH accepts your EC2 key pair only; password authentication is off.

The database is not on the network

MariaDB is pinned to the loopback interface, so the application database is unreachable from outside the instance whatever your security group says:

sudo ss -tlnp | awk '$4 ~ /:3306$/ {print $1, $4, $6}'

LISTEN 127.0.0.1:3306 users:(("mariadbd",pid=17574,fd=22))

For on-box maintenance, sudo mariadb authenticates over the unix socket as root@localhost; no database password is needed or stored for that path.

Per-instance response-encryption keys

LimeSurvey can encrypt participant and response fields at rest. The keys live in application/config/security.php. First boot mints a fresh libsodium nonce and secret-box key for this instance before LimeSurvey can generate one, so no two instances launched from this AMI share an encryption key.

Once you have collected encrypted responses, back up that file together with the database. If you lose it, you can no longer read those responses.

Enable HTTPS before you collect responses

The image is TLS-ready but ships no certificate, so out of the box the administration console and the survey front end are served over plain HTTP. Survey responses are frequently personal data, so put HTTPS in front of the instance before you publish a survey.

Either terminate TLS on an Application Load Balancer with a certificate from AWS Certificate Manager, or install Certbot on the instance and issue a certificate for your own domain. Once the certificate is live, enable Force HTTPS under Configuration > Global settings > Security.

Maintenance

Task Command

Back up the database sudo mariadb-dump --single-transaction --routines limesurvey \| gzip > ~/limesurvey-$(date +%F).sql.gz

Back up uploaded survey files sudo tar czf ~/limesurvey-uploads-$(date +%F).tar.gz -C /var/lib/limesurvey upload

Back up the encryption keys sudo cp /var/www/limesurvey/application/config/security.php ~/limesurvey-security-$(date +%F).php

Apply operating system updates sudo apt-get update && sudo apt-get -y dist-upgrade

Restart the web tier sudo systemctl restart php8.3-fpm.service nginx.service

Read the first-boot log sudo cat /var/log/limesurvey-firstboot.log

Read the NGINX error log sudo tail -n 50 /var/log/nginx/error.log

Store backups off the instance, for example with aws s3 cp into a bucket in your own account. Take EBS snapshots of both data volumes on a schedule.

To upgrade LimeSurvey itself, follow the official upgrade instructions. Take a database dump and an EBS snapshot first.

Support

SecureAnyCloud provides 24/7 support via email and live chat for this image, covering deployment, configuration and day-to-day operation. We aim to respond within one business day. Contact sales@secureanycloud.com.

LimeSurvey itself is developed by the LimeSurvey project and community; questions about survey design and LimeSurvey features are answered in the LimeSurvey manual and the community forums.

Deploy on AWS

Launch LimeSurvey with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com