SecureAnyCloud
Deployment guide

OpenList 4.2.9

Overview

OpenList is the open-source, community-maintained successor of AList: a self-hosted file list and file manager. It shows the instance's own disk and any storage accounts you connect (S3-compatible object storage, WebDAV, FTP and SFTP servers, OneDrive, Google Drive and many more) as one folder tree in the browser. Your users can browse, preview, upload, rename, move, copy and delete files, create share links, and mount the whole tree as a WebDAV drive. An administrator decides who may see and do what.

This guide covers launching and using the OpenList 4.2.9 on Ubuntu 24.04 AMI from SecureAnyCloud on Amazon EC2. It is one version of the SecureAnyCloud file sharing and sync listing on AWS Marketplace. You pick it as the software version when you subscribe and launch.

The SecureAnyCloud image locks OpenList down. What you get:

  • No default administrator and no setup wizard. The image ships no database, no configuration file and no password. First boot creates the admin account with a password unique to your instance and writes it to /root/openlist-credentials.txt (root only). The setup wizard is reached only over the loopback address while the web server is still stopped. Afterwards the web server answers it with 404.
  • Per-instance secrets. OpenList's JWT signing secret (64 characters), its admin API token, the administrator password and the TLS key are all generated on your instance's first boot. None of them exists in the image.
  • Guest access closed. OpenList's built-in guest account is disabled, and its upstream default password is replaced with a random one that nobody holds, so anonymous visitors see nothing.
  • HTTPS from the first boot. nginx serves OpenList on port 443 with a certificate generated on your instance. Port 80 redirects to HTTPS, and requests for a host name the instance does not serve are dropped. OpenList itself listens on 127.0.0.1:5244 only, as the unprivileged openlist account. A certificate you install yourself is never replaced (Step 10).
  • No third-party services and no third-party code in the browser. The instance itself serves the site logo, favicon and audio cover. Upstream's online document viewers, OCR service and media metadata lookups are switched off, so the server sends no file, link or image to anyone by default. The web interface loads nothing from other sites either. The Word, Excel, PowerPoint, Flash, EPUB and PDF preview libraries that upstream downloads from public CDNs at run time are shipped inside the image and served by your instance. You can switch each outside service back on deliberately (see Third party services under Security notes).
  • Cross-site requests refused. A request that changes something and comes from another website's page is refused, and OpenList only answers browser requests from its own address (CORS). The server-side media proxy and the sign-out link additionally refuse cross-site navigation. Signed download and share links keep working when you send them to someone.
  • Metadata service blocked. OpenList fetches URLs on the server for its storage drivers and for offline downloads. OpenList, nginx and the first-boot step cannot reach the EC2 instance metadata service, so nobody can use those features to read the instance's role credentials.
  • Rebuilt with current security fixes. SecureAnyCloud compiles OpenList 4.2.9 from its source tag with Go 1.27.3 and updated Go modules (see Source code and licence below). govulncheck reports no affecting vulnerability in the shipped binary.
  • Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

The image contains the following components:

  • OpenList 4.2.9 (GNU AGPL 3.0), built by SecureAnyCloud from the unmodified upstream source
  • Its web interface (MIT): upstream's release build, with 21 files patched by SecureAnyCloud so that previews load their libraries from your instance
  • The open-source preview libraries that the web interface uses, listed with their licences under Third party services
  • nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent

The complete source is on the image in /usr/share/doc/sac/openlist/source. It is offered to every user of your OpenList at https://<your-host>/sac-source/.

Default user: ubuntu
Architecture: x86_64
Recommended instance type: m5.large

Prerequisites

  • An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet.
  • A security group that allows TCP 22 (SSH), TCP 443 (OpenList) and TCP 80 (redirects to HTTPS) from your own networks only.
1

Launch the instance

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick OpenList 4.2.9 on Ubuntu 24.04 as the software version and select your Region. Then choose Launch through EC2.

Choose m5.large, your key pair, a security group as described above and a subnet.

Files you upload to the instance itself are stored on the root volume (8 GiB in the AMI). If you will keep files on the instance rather than only in connected cloud storage, raise the root volume under Configure storage. Ubuntu grows the file system to the volume size at boot.

To launch with the AWS CLI instead, replace the values in angle brackets. This command sets the root volume to 50 GiB:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=50,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=openlist}]'
2

Connect to your instance

For OpenList 4.2.9 on Ubuntu 24.04, the SSH user is ubuntu. Connect with your key pair:

ssh -i <your-key.pem> ubuntu@<public-ip>
3

Check the services

First boot works out the instance's name, generates the certificate and the secrets, creates the administrator and then starts the site. This takes a few seconds. Check the services:

systemctl is-active openlist-set-host openlist-firstboot openlist nginx
active inactive active active

openlist-firstboot runs once. It shows active during the first boot and inactive after any later reboot, as here. The other three are active on every boot.

Only SSH (22) and nginx (80, 443) listen on the network. OpenList listens on the loopback address only, and the two :53 entries are Ubuntu's local DNS resolver. OpenList's own S3, FTP and SFTP servers are switched off. List the listeners:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u
0.0.0.0:22 0.0.0.0:443 0.0.0.0:80 127.0.0.1:5244 127.0.0.53%lo:53 127.0.0.54:53 [::]:22 [::]:443 [::]:80

If nginx is not running, first boot has not finished, or it has failed, in which case the site is never served. Check systemctl status openlist-firstboot and journalctl -u openlist-firstboot.

4

Get your URL and password

Print the credentials file:

sudo cat /root/openlist-credentials.txt

The file is readable by root only. It holds the address and this instance's administrator sign-in:

# OpenList on Ubuntu 24.04 (sac AWS Marketplace image) - this instance's administrator sign-in. # Generated on this instance at first boot; unique to it and not known to sac or the OpenList project. ... OPENLIST_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/ openlist.admin.user=admin openlist.admin.pass=<OPENLIST_ADMIN_PASSWORD>

You can confirm the sign-in from the instance itself. The helper checks, through nginx, that OpenList answers and reports version 4.2.9. It also checks that anonymous access and a wrong password are refused, that the setup wizard is closed, and that the password from the credentials file signs in as an administrator:

sudo /usr/local/sbin/openlist-verify.sh
openlist: ping pong, v4.2.9, anonymous refused, wrong password refused, setup wizard 404, per-instance admin signed in (role 2) OPENLIST_ROUNDTRIP_OK
5

Sign in

Open the OPENLIST_URL address in your browser. The certificate is self-signed (see Step 10), so the browser asks you to accept it once. Compare the fingerprint it shows with the one on the instance:

sudo openssl x509 -in /etc/ssl/openlist/openlist.crt -noout -fingerprint -sha256

Sign in as admin with the password from Step 4. A new instance always shows the sign-in page, never a setup form. Browse as a guest is refused, because the guest account is disabled.

Next, change the administrator password to one of your own under Manage, Profile. The credentials file is not updated when you do. Delete it (sudo rm /root/openlist-credentials.txt) once you no longer need it. openlist-verify.sh reads this file, so the check stops working after you delete it.

6

Browse and upload files

OpenList opens on the root folder, which is the instance's own storage (/var/lib/openlist/files). The notice at the top right tells every user what the server runs and where its source is: "This server runs OpenList 4.2.9 (GNU AGPL-3.0), built by SecureAnyCloud from the upstream source with updated Go modules; its web interface (MIT) is patched to load preview libraries from this server. Complete source, changes and build details: /sac-source/." (see Source code and licence below). Close the notice with the cross.

The round button at the bottom right opens the toolbar. It offers refresh, new file, new folder, move, batch rename, upload, offline download and the local settings. Upload accepts several files or a whole folder, and shows each file's progress.

Click a file to preview it or download it. Text, Markdown, images, audio, video, PDF, Word, Excel, PowerPoint, EPUB and Flash files open in the browser. Select files with the check boxes to move, copy, rename, delete or download them together.

Things to know:

  • Download links are signed. A file's direct link carries a signature made with this instance's own key. A link without the signature, or with a changed one, is refused. You can paste a signed link into another application or a media player.
  • Share links. Create a share for a file or folder from its menu, optionally with a password and an expiry. Manage shares under Manage, Shares.
  • Offline download fetches a URL on the server straight into a folder (OpenList's built-in HTTP downloader). It and every storage driver can reach the internet but not the EC2 instance metadata service.
  • Previews render in your browser, from this server alone. Text, Markdown (with formulas and diagrams), the code editor, images, audio and video, PDF files (OpenList's own PDF component and its WebAssembly engine), Word, Excel and PowerPoint documents, EPUB books and Flash (.swf) files are all shown with code that this instance serves. For example, a Word document opens in the DOC previewer. No online viewer is configured and the web interface downloads nothing from other sites, so neither your files nor links to them leave the server.
7

Connect storage

Open Manage, Storages. The image ships one storage: Local, mounted at /, which is the instance's /var/lib/openlist/files folder.

Choose Add to connect more. OpenList offers S3-compatible object storage (Amazon S3 included), WebDAV, FTP, SFTP, SMB, OneDrive, Google Drive, Dropbox and other drivers. Each storage is mounted at a path you choose and appears as a folder in the tree.

For Amazon S3, create an IAM user (or access key) limited to the bucket you mount, and enter its access key in the storage form. The instance's own IAM role is not available to OpenList, because OpenList cannot reach the instance metadata service.

8

Add users

Open Manage, Users and add an account for each person. Choose its base path (the folder it sees as its root) and its permissions: upload, rename, move, copy, delete, create shares, WebDAV read and write, and so on.

The built-in guest account is listed as not available. Leave it that way unless you want anonymous visitors to browse.

After five wrong passwords from one address, OpenList refuses further sign-ins from that address for five minutes. nginx also limits how fast sign-ins can be attempted.

9

Mount OpenList as a WebDAV drive

OpenList serves the same folder tree over WebDAV at https://<your-host>/dav/, for users whose permissions include WebDAV. Sign in with the OpenList user name and password.

On macOS, choose Go, Connect to Server in Finder and enter the address. On Linux, use davfs2 or rclone. On Windows, map a network drive. Windows needs a certificate it trusts (see Step 10).

10

Use your own host name and certificate

Point a DNS record at the instance. An Elastic IP keeps the address across stop and start. Then tell the instance its name with the helper below.

The helper updates the nginx host rule, the cross-site guard, OpenList's site address and allowed origin, and the address in the credentials file. It keeps the name across reboots. While the instance still uses the certificate it generated itself, the helper also generates a new self-signed certificate for the name:

sudo openlist-set-hostname files.example.com

Which certificate is in use. The image records the SHA-256 fingerprint of every certificate it generates in /var/lib/sac/data/openlist-cert.sha256 (owned by root). Only a certificate whose fingerprint matches that record is ever replaced, and only when the name changes.

Any other certificate in /etc/ssl/openlist, including a symbolic link to a certificate kept elsewhere, is treated as yours. It is kept exactly as it is on every reboot and every name change. To see which certificate the instance is serving, run:

[ "$(sudo head -n1 /var/lib/sac/data/openlist-cert.sha256)" = "$(sudo openssl x509 -in /etc/ssl/openlist/openlist.crt -noout -fingerprint -sha256 | cut -d= -f2)" ] && echo "self-signed certificate minted by this image (replaced when the host name changes)" || echo "your own certificate (kept unchanged on every boot and host name change)"
self-signed certificate minted by this image (replaced when the host name changes)

Install your own certificate. Copy your certificate (with its intermediate certificates, leaf first) and its private key over the two files. Keep the key readable by root only, then reload nginx:

sudo cp fullchain.pem /etc/ssl/openlist/openlist.crt
sudo cp privkey.pem /etc/ssl/openlist/openlist.key
sudo chown root:root /etc/ssl/openlist/openlist.crt /etc/ssl/openlist/openlist.key
sudo chmod 0644 /etc/ssl/openlist/openlist.crt
sudo chmod 0600 /etc/ssl/openlist/openlist.key
sudo nginx -t && sudo systemctl reload nginx

SecureAnyCloud tests this on the build instance with a real reboot. Afterwards, the installed certificate and key are byte-for-byte the same, and nginx serves that certificate.

If you later run openlist-set-hostname with a new name, your certificate is still kept. The command says that the certificate in /etc/ssl/openlist is not one this helper minted and is kept unchanged. Make sure your certificate names the new host. To renew it, repeat the same copy and reload.

Go back to a self-signed certificate. Remove your two files and run the helper with the instance's name. It generates a new certificate, records its fingerprint and reloads nginx:

sudo rm /etc/ssl/openlist/openlist.crt /etc/ssl/openlist/openlist.key
sudo openlist-set-hostname files.example.com
openlist-set-hostname: OpenList is served at https://files.example.com/ openlist-set-hostname: certificate SHA-256 fingerprint <the new certificate's fingerprint>

Alternatively, put a load balancer or reverse proxy that holds a publicly trusted certificate (for example an AWS Certificate Manager certificate) in front of the instance and forward to it on 443. Behind a proxy, every sign-in arrives from the proxy's address, so the five-failure lockout applies to everyone behind it.

11

Where your data lives, backups and updates

OpenList's configuration (config.json, with this instance's JWT secret) and its database (data.db: users, password hashes, storages, shares and settings) are in /var/lib/openlist/data. Files stored on the Local storage are in /var/lib/openlist/files. Both folders belong to the openlist account, and nobody else can read them:

sudo ls -la /var/lib/openlist
total 16 drwxr-xr-x 4 root root 4096 Oct 31 01:38 . drwxr-xr-x 49 root root 4096 Oct 31 01:33 .. drwx------ 3 openlist openlist 4096 Oct 31 01:48 data drwx------ 2 openlist openlist 4096 Oct 31 01:55 files

To copy files in over SSH, write them as the account that owns the folders, so that OpenList can manage them. For example:

sudo -u openlist cp /home/ubuntu/report.pdf /var/lib/openlist/files/

Every service is enabled, so OpenList returns after a reboot or a stop and start, with your users, storages and files as they were. Unattended security upgrades keep the operating system and nginx patched. Confirm that all services are enabled:

systemctl is-enabled openlist-set-host openlist-firstboot openlist nginx unattended-upgrades
enabled enabled enabled enabled enabled

To back up, take an EBS snapshot of the root volume, or use AWS Backup on the instance. Manage, Backup & Restore also exports OpenList's settings, users and storages as a file.

SecureAnyCloud publishes a new version of the image when a newer OpenList release is available.

Security notes

Secrets. The credentials file, config.json (JWT secret), the database (admin API token, password hashes) and the TLS key are each readable by one account only. The root-owned /etc/openlist/openlist.env holds no secret. It pins the settings that OpenList must not change:

sudo stat -c '%a %U:%G %n' /root/openlist-credentials.txt /var/lib/openlist/data/config.json /var/lib/openlist/data/data.db /etc/openlist/openlist.env /etc/ssl/openlist/openlist.key
600 root:root /root/openlist-credentials.txt 600 openlist:openlist /var/lib/openlist/data/config.json 600 openlist:openlist /var/lib/openlist/data/data.db 640 root:openlist /etc/openlist/openlist.env 600 root:root /etc/ssl/openlist/openlist.key

The JWT secret that signs every OpenList session is generated on your instance. This command prints only its length:

sudo python3 -I -c 'import json; c = json.load(open("/var/lib/openlist/data/config.json")); print("jwt_secret:", len(c["jwt_secret"]), "characters")'
jwt_secret: 64 characters

Pinned listener and servers. OpenList reads these settings after its own config.json, so a change made in the web interface cannot reopen a port:

sudo grep -E '^OPENLIST_(ADDR|HTTP_PORT|HTTPS_PORT|S3_ENABLE|FTP_ENABLE|SFTP_ENABLE|MCP_ENABLE|TLS_INSECURE_SKIP_VERIFY)=' /etc/openlist/openlist.env
OPENLIST_ADDR=127.0.0.1 OPENLIST_HTTP_PORT=5244 OPENLIST_HTTPS_PORT=-1 OPENLIST_S3_ENABLE=false OPENLIST_FTP_ENABLE=false OPENLIST_SFTP_ENABLE=false OPENLIST_MCP_ENABLE=false OPENLIST_TLS_INSECURE_SKIP_VERIFY=false

Certificate. The per-instance certificate names the instance and cannot sign other certificates:

sudo openssl x509 -in /etc/ssl/openlist/openlist.crt -noout -subject -ext basicConstraints,extendedKeyUsage
subject=CN = ec2-203-0-113-10.compute-1.amazonaws.com, O = sac X509v3 Basic Constraints: critical CA:FALSE X509v3 Extended Key Usage: TLS Web Server Authentication

Redirect and unknown names. Port 80 answers the instance's own name with a redirect to HTTPS. It closes the connection for any other name (000 means no response):

H=$(cat /etc/sac/openlist-served-host)
curl -s -o /dev/null -w '%{http_code}\n' -H "Host: $H" http://127.0.0.1/
curl -s -o /dev/null -w '%{http_code}\n' -H 'Host: not-this-server.example' http://127.0.0.1/ || true
301 000

Guest disabled. An anonymous request is refused:

H=$(cat /etc/sac/openlist-served-host)
curl -s --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/openlist/openlist.crt "https://$H/api/me"; echo
{"code":401,"message":"Guest user is disabled, login please","data":null}

Cross-site guard. A request that changes something and carries another website's Origin is refused before it reaches OpenList. So is a cross-site request to the media proxy, which would otherwise fetch a URL on the server:

H=$(cat /etc/sac/openlist-served-host)
curl -s -o /dev/null -w '%{http_code}\n' --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/openlist/openlist.crt -X POST -H 'Origin: https://attacker.example' -H 'Content-Type: application/json' -d '{"path":"/x"}' "https://$H/api/fs/mkdir"
curl -s -o /dev/null -w '%{http_code}\n' --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/openlist/openlist.crt -H 'Sec-Fetch-Site: cross-site' "https://$H/api/public/media/proxy?url=http://169.254.169.254/latest/meta-data/"
403 403

OpenList's API authenticates with an Authorization header, never a cookie, so another website cannot borrow a signed-in user's session. Native clients (WebDAV drives and scripts that use the API) send no Origin and are not affected.

Metadata service blocked. OpenList, nginx and the first-boot step run with a systemd address filter that drops traffic to the EC2 instance metadata service (and its IPv6 address):

systemctl show -p IPAddressDeny openlist nginx openlist-firstboot
IPAddressDeny=168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 IPAddressDeny=168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128 IPAddressDeny=168.63.129.16/32 169.254.169.254/32 fd00:ec2::254/128

SecureAnyCloud tests this on every build from inside the running services. An offline download of a public URL succeeds, and the same download from http://169.254.169.254/ is refused. OpenList 4.2.9 also refuses cloud metadata addresses itself. Only openlist-set-host, which looks up the instance's public name at boot, uses the metadata service (IMDSv2).

Sandbox. OpenList runs as openlist with no capabilities. It can write only /var/lib/openlist/data and /var/lib/openlist/files, and it cannot read the credentials file or the TLS key. Its program in /opt/openlist is owned by root.

Security fixes and remaining advisories. OpenList 4.2.9 includes the fixes for every published OpenList advisory (all fixed in 4.2.6 or earlier). Upstream's 4.2.9 release binary carries Go modules with published advisories that its code reaches (golang.org/x/net HTTP/2 and HTML). SecureAnyCloud's rebuild raises golang.org/x/net to 0.62.0, google.golang.org/grpc to 1.85.0 and filippo.io/edwards25519 to 1.1.1. govulncheck finds no affecting vulnerability in the source or the shipped binary.

Three Go advisories have no fix and are not called by OpenList: GO-2022-0635 and GO-2022-0646 (AWS S3 client-side encryption, which OpenList does not use) and GO-2026-5932 (an OpenPGP module). In the web interface, copies of DOMPurify bundled inside the diagram and code editor components carry advisories that only affect options OpenList never sets. KaTeX carries a low-severity advisory. These components run in your browser, not on the server.

Third party services. Upstream OpenList ships with several settings that send your files, links to them or images to outside services. The image starts with all of them switched off or pointed at the instance itself. The public settings show this, with no sign-in needed:

H=$(cat /etc/sac/openlist-served-host)
curl -s --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/openlist/openlist.crt "https://$H/api/public/settings" | python3 -c 'import json, sys; d = json.load(sys.stdin)["data"]; [print(k, "=", repr(d[k])) for k in ("logo", "favicon", "audio_cover", "iframe_previews", "external_previews", "ocr_api", "media_enabled")]'
logo = '/sac-assets/logo.svg' favicon = '/sac-assets/logo.svg' audio_cover = '/sac-assets/logo.svg' iframe_previews = '{}' external_previews = '{}' ocr_api = '' media_enabled = 'false'
  • Logo, favicon and audio cover are /sac-assets/logo.svg, an image SecureAnyCloud drew, served by nginx from /usr/share/sac/openlist/assets. (Upstream's logo, on the OpenList project's server, is licensed for non commercial use only, so it is not shipped.) Use your own under Manage, Settings, Style (Logo, Favicon) and Preview (Audio cover).
  • Iframe previews are empty. Upstream opens Office documents in Microsoft's or Google's online viewer and PDF and EPUB files in viewers hosted by the OpenList project, and each of those is handed a signed link to the file. PDF files still preview without them, through OpenList's own PDF component.
  • External previews are empty, and so is Ocr api (upstream sends the captcha images that some storage drivers, such as Cloudreve and 189 Cloud, meet when signing in to their provider to a public OCR service on Hugging Face).
  • Media library is off (Enable media library and Media cover gateway are false), so no titles are looked up on TMDB, Discogs, Douban or Google Books and no cover images go through wsrv.nl.

To switch one back on, edit it deliberately and remember that the service you name receives a link to the file (or the image) whenever a user previews it, and must be able to reach your instance:

  • Online viewers: Manage, Settings, Preview, Iframe previews takes JSON mapping file extensions to viewer names and addresses, where $e_url stands for the signed link of the file, for example {"pdf":{"PDF.js":"https://pdfjs.example.com/web/viewer.html?file=$e_url"}}. External previews works the same way for links that open in a new tab.
  • OCR: Manage, Settings, Global, Ocr api.
  • Media library: Manage, Media Library, Media Settings, Enable media library (and Media cover gateway for cover images).

The web interface loads nothing from other sites. Upstream's web interface downloads several preview components into the viewer's browser at run time, from the OpenList project's res.oplist.org.cn, registry.npmmirror.com, jsDelivr, npm.elemecdn.com and Google Fonts. This image ships those components inside the image instead, at the exact upstream releases (each file checked against its SHA-256 when the image was built), and your instance serves them under /static/sac-res/. To make that work, the web interface your users get is a patched copy: upstream's OpenList-Frontend 4.2.9 release build (MIT), served from /usr/share/sac/openlist/dist, with 21 of its files changed by SecureAnyCloud so that those addresses point at the instance (the same changes point the logo at the instance's own copy and drop the YouTube poster images and the README's pictures; see Known limits below). Every change is listed, with the checksum of each changed file before and after, in /usr/share/doc/sac/openlist/FRONTEND-PATCHES.txt, which every user can also read at https://<your-host>/sac-source/FRONTEND-PATCHES.txt. The copy of the web interface built into the OpenList program itself is upstream's, unchanged, and is not the one served.

Preview Library and version Licence

Word (.docx) docx-preview 0.4.1, JSZip 3.10.1 Apache 2.0; MIT (JSZip is MIT or GPL 3.0, used under MIT)

Excel (.xlsx) ExcelJS 4.4.0 MIT

PowerPoint (.pptx) PPTXjs 1.21.1 with divs2slides, filereader.js, jQuery 1.11.3, d3 3.5.10, nvd3 1.8.1 and JSZip 2.6.1 MIT; d3 BSD 3 clause; nvd3 Apache 2.0

Flash (.swf) Ruffle 0.7.1 MIT or Apache 2.0

EPUB epub.js 0.3.93, JSZip 3.10.1 BSD 2 clause; MIT

PDF OpenList's own PDF component (pdfium WebAssembly engine), EmbedPDF default stamps 0.0.1, Noto Sans fallback fonts for Latin, Arabic and Hebrew 1.0.0 MIT (stamps); SIL Open Font License 1.1 (fonts)

Plugin ZIP files (Manage, Plugins) fflate 0.8.2 MIT

The code editor (Monaco) and the Manage, About page also load from the instance: the editor from the copy already inside the web interface, and the About page from a copy of the OpenList README shipped in the image. The licence texts are in /usr/share/sac/openlist/dist/static/sac-res/LICENSES/, and SOURCES.txt next to it lists each library's upstream address and the SHA-256 of every file (it is also served at https://<your-host>/static/sac-res/SOURCES.txt):

ls /usr/share/sac/openlist/dist/static/sac-res/LICENSES/
d3-3.5.10-BSD-3-Clause.txt docx-preview-0.4.1-Apache-2.0.txt embedpdf-default-stamps-0.0.1-MIT.txt embedpdf-fonts-arabic-OFL-1.1.txt embedpdf-fonts-hebrew-OFL-1.1.txt embedpdf-fonts-latin-OFL-1.1.txt epubjs-0.3.93-BSD-2-Clause.txt exceljs-4.4.0-MIT.txt fflate-0.8.2-MIT.txt filereader.js-MIT.txt jquery-1.11.3-MIT.txt jszip-2.6.1-MIT-or-GPL-3.0.txt jszip-3.10.1-MIT-or-GPL-3.0.txt nvd3-1.8.1-Apache-2.0-notice.txt pptxjs-MIT.txt ruffle-0.7.1-Apache-2.0.txt ruffle-0.7.1-MIT.txt

No upstream content delivery address is left in the files the instance serves (plain text files are left out of the search, because SOURCES.txt names those addresses as the download sources), and the served web interface still matches the manifest written when the image was built:

grep -rlE --exclude='*.txt' 'res\.oplist\.org\.cn|registry\.npmmirror\.com|cdn\.jsdelivr\.net|npm\.elemecdn\.com|fonts\.googleapis\.com' /usr/share/sac/openlist/dist | wc -l cd /usr/share/sac/openlist/dist && sha256sum --quiet -c ../dist.sha256 && echo "web interface matches its manifest ($(wc -l < ../dist.sha256) files)"
0 web interface matches its manifest (664 files)

nginx serves the logo and the preview libraries from the instance, and sends Referrer-Policy: same-origin:

H=$(cat /etc/sac/openlist-served-host) for p in /sac-assets/logo.svg /static/sac-res/docxjs/dist/docx-preview.min.js /static/sac-res/ruffle/ruffle.js /static/sac-res/SOURCES.txt; do curl -s -o /dev/null -w "%{http_code} %{content_type} $p\n" --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/openlist/openlist.crt "https://$H$p"; done curl -s -I --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/openlist/openlist.crt "https://$H/" | grep -i '^referrer-policy'
200 image/svg+xml /sac-assets/logo.svg 200 text/javascript; charset=utf-8 /static/sac-res/docxjs/dist/docx-preview.min.js 200 text/javascript; charset=utf-8 /static/sac-res/ruffle/ruffle.js 200 text/plain; charset=utf-8 /static/sac-res/SOURCES.txt referrer-policy: same-origin

How SecureAnyCloud checks it. Every build scans the 645 files of the served web interface that are not plain text for absolute web addresses. Every host found must be on a reviewed list (XML namespaces, licence headers and documentation links inside the libraries, and OpenList's own help links), and test addresses planted in a copy must be caught, otherwise the build fails. A headless browser then signs in as the administrator, uploads a Word, Excel, PowerPoint, Flash, PDF, Markdown, text and image file, opens each preview, the code editor, the administration pages, the About page and the EPUB viewer, and records every request to another site. On this image there were none, and every preview rendered. SecureAnyCloud repeated both checks after a real reboot of the build instance.

Known limits of the local previews. Keeping everything on the instance has four visible effects:

  • PDF fonts from Google Fonts are off. The PDF viewer's handwriting fonts for signatures and its interface font are no longer loaded from Google Fonts, so it uses fonts already on the viewer's computer.
  • No fallback font for Chinese, Japanese or Korean text in PDFs. The fallback fonts for Latin, Arabic and Hebrew are shipped; the CJK ones (about 145 MB) are not, so a PDF whose Chinese, Japanese or Korean text is not embedded in the file shows that text without a fallback font. PDFs that embed their fonts, which is most of them, are not affected.
  • No YouTube poster images in the image gallery. The gallery viewer no longer fetches thumbnails from img.youtube.com.
  • The About page shows the README without images. The badges and pictures of the README, which upstream loads from other sites, are removed from the shipped copy.

Cloud drive storage drivers that need it talk to their providers and, for some, to the OpenList project's token renewal service, but only when you add such a storage.

Restrict 22/tcp to your management network, and 80/443 to the networks that use OpenList.

Source code and licence

OpenList is licensed under the GNU Affero General Public License 3.0, and its web interface (OpenList-Frontend) under the MIT licence. Under the AGPL, the users of your OpenList server are entitled to its source code. This image carries the source and offers it to every user. The notice on the home page links to https://<your-host>/sac-source/, which nginx serves read-only from /usr/share/doc/sac/openlist/source:

ls -l /usr/share/doc/sac/openlist/source/
total 1476 -rw-r--r-- 1 root root 28856 Oct 31 02:55 BUILD-PROVENANCE.txt -rw-r--r-- 1 root root 10317 Oct 31 02:55 FRONTEND-PATCHES.txt -rw-r--r-- 1 root root 34523 Oct 31 02:55 LICENSE -rw-r--r-- 1 root root 2572 Oct 31 02:55 SOURCE.txt -rw-r--r-- 1 root root 15676 Oct 31 02:55 go.mod.sac -rw-r--r-- 1 root root 956 Oct 31 02:55 go.mod.sac.diff -rw-r--r-- 1 root root 107775 Oct 31 02:55 go.sum.sac -rw-r--r-- 1 root root 1293420 Oct 31 02:55 openlist-v4.2.9-source.tar.gz

The OpenList program (/opt/openlist/openlist) is built by SecureAnyCloud from the unmodified upstream Go source:

  • openlist-v4.2.9-source.tar.gz is the upstream source of tag v4.2.9 (commit 0497ee8538), unchanged.
  • go.mod.sac and go.sum.sac are the module files the binary was built with; go.mod.sac.diff shows the only change from the tag. It is the three module raises described above (newer patch or minor releases of golang.org/x/net, google.golang.org/grpc and filippo.io/edwards25519, for their security fixes) and the dependency versions they bring with them. No OpenList Go source file is changed.
  • BUILD-PROVENANCE.txt lists the Go toolchain, the build commands and flags, and the checksums (the build is reproducible). SOURCE.txt explains all of this, gives the upstream addresses and is SecureAnyCloud's written offer of the complete source. LICENSE is the AGPL text.

The web interface that your users get is patched. The copy built into the program is upstream's OpenList-Frontend 4.2.9 release build, unchanged, but that copy is not the one served.

Your users get the same release build (MIT), served from /usr/share/sac/openlist/dist, with 21 of its files changed by SecureAnyCloud. The changes make the document, spreadsheet, presentation, Flash, EPUB and PDF previews load their libraries from your instance instead of from public CDNs (see Third party services above). Anyone can read the changes:

  • FRONTEND-PATCHES.txt (in this directory, so also at https://<your-host>/sac-source/FRONTEND-PATCHES.txt) names every replacement made and lists each changed file with its SHA-256 before and after.
  • https://<your-host>/static/sac-res/SOURCES.txt lists the preview libraries shipped in the image, with their versions, upstream addresses and the SHA-256 of every file; their licence texts are under /static/sac-res/LICENSES/.
awk '/^files changed/{f=1;next} f&&NF==3' /usr/share/doc/sac/openlist/FRONTEND-PATCHES.txt | wc -l
H=$(cat /etc/sac/openlist-served-host)
curl -s -o /dev/null -w "%{http_code} %{content_type} /sac-source/FRONTEND-PATCHES.txt\n" --resolve "$H:443:127.0.0.1" --cacert /etc/ssl/openlist/openlist.crt "https://$H/sac-source/FRONTEND-PATCHES.txt"
21 200 text/plain /sac-source/FRONTEND-PATCHES.txt

The source archive's checksum matches the one recorded in BUILD-PROVENANCE.txt:

sha256sum /usr/share/doc/sac/openlist/source/openlist-v4.2.9-source.tar.gz
a762ff50b71b384f03af2996cac2aba471b0d5ec44aad0255e646a41c8af7f49 /usr/share/doc/sac/openlist/source/openlist-v4.2.9-source.tar.gz

If you change OpenList's code and let others use your server, the AGPL asks you to offer them your changed source in the same way.

Architecture summary

  • File manager: OpenList 4.2.9 (AGPL 3.0, web interface MIT), SecureAnyCloud rebuild in /opt/openlist, account openlist.
  • Listener: 127.0.0.1:5244 only. The S3, FTP, SFTP and MCP servers are off (/etc/openlist/openlist.env).
  • Web server: nginx on 443 (HTTPS, with a per-instance certificate in /etc/ssl/openlist, or your own, which is never replaced). Port 80 redirects to HTTPS.
  • Sign-in: OpenList users are in /var/lib/openlist/data/data.db. The administrator is admin, and the guest account is disabled.
  • Your files: Local storage at / = /var/lib/openlist/files on the root volume. Add more storages under Manage, Storages.
  • Credentials: /root/openlist-credentials.txt, mode 0600, root only.
  • First boot: openlist-set-host.service (host name and certificate) and openlist-firstboot.service (secrets and administrator).
  • Tools: openlist-set-hostname and openlist-verify.sh.
  • Web interface: /usr/share/sac/openlist/dist (upstream OpenList-Frontend 4.2.9 release build, MIT, with 21 files patched by SecureAnyCloud). The preview libraries are shipped in static/sac-res/ with their licences and SOURCES.txt, and the changes are listed in FRONTEND-PATCHES.txt.
  • Third party services: none switched on. The logo is local, there are no iframe or external previews, OCR is off and the media library is off. The browser loads nothing from other sites.
  • Source: /usr/share/doc/sac/openlist/source, served at /sac-source/.
  • Ports: 22 SSH, 80 redirect, 443 OpenList (web, API and WebDAV at /dav/).
  • Base image: Ubuntu 24.04 LTS, fully patched, with unattended security upgrades enabled and IMDSv2 required.

Support

SecureAnyCloud images come with 24/7 support. Email sales@secureanycloud.com with your AWS account ID and the instance ID. For OpenList itself, see the OpenList project on GitHub and its documentation.

OpenList is an open source project by the OpenList team and contributors. SecureAnyCloud is not affiliated with or endorsed by the OpenList project.

Deploy on AWS

Launch OpenList 4.2.9 on Ubuntu 24.04 on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS