RosarioSIS 13.0.2

• Open the Hardened Moodle & E-Learning Platforms AMIs listing by SecureAnyCloud, choose View purchase options and subscribe.
• Choose Continue to Configuration. Under Software version, choose RosarioSIS 13.0.2 on Ubuntu 24.04. Pick your Region and choose Continue to Launch.
• Under Choose Action, select Launch through EC2.
• Set the instance type to m5.large and choose your key pair.
• Use the seller's security group settings (ports 22, 80 and 443), and narrow port 22 to your management network.
• Launch the instance. First boot finishes within two to three minutes.

Run these commands on your workstation. Replace <ami-id> with the AMI ID shown for the RosarioSIS 13.0.2 on Ubuntu 24.04 software version on the listing's launch page. Use your own VPC, subnet, key pair and address ranges.

aws ec2 create-security-group --group-name rosariosis-sg \
  --description "RosarioSIS" --vpc-id <vpc-id>
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 22 --cidr <your-ip>/32
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 80 --cidr <users-cidr>
aws ec2 authorize-security-group-ingress --group-id <security-group-id> \
  --protocol tcp --port 443 --cidr <users-cidr>
aws ec2 run-instances --image-id <ami-id> --instance-type m5.large \
  --key-name <key-name> --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> --associate-public-ip-address \
  --metadata-options HttpTokens=required \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=rosariosis}]'
aws ec2 describe-instances --instance-ids <instance-id> \
  --query "Reservations[].Instances[].[PublicDnsName,PublicIpAddress]" --output text

ssh -i <key.pem> ubuntu@<public-dns>

The login user is ubuntu.

First boot writes your instance's credentials to a root-only file:

sudo cat /root/rosariosis-credentials.txt

It looks like this (your values differ):

rosariosis.admin.user=admin rosariosis.admin.pass=<generated-per-instance> rosariosis.db.name=rosariosis rosariosis.db.user=rosariosis rosariosis.db.auth=peer (no password: PHP-FPM as www-data over the unix socket)

The site address is written to /var/lib/sac/data/rosariosis-address. First boot takes it from /etc/sac/rosariosis-hostname if that file exists. Otherwise it comes from IMDSv2: the instance's public DNS name, else its public IPv4 address, else its private IPv4 address.

If you keep credentials centrally, copy the administrator password into AWS Secrets Manager. There is no database password to store.

systemctl is-active postgresql@16-main php8.3-fpm apache2 rosariosis-baseurl ls /var/lib/sac/data/rosariosis-firstboot.done

All four services print active, and the first-boot marker exists. First boot runs once, so after a reboot its unit shows as skipped, which is expected. Only ports 22, 80 and 443 listen on a public address, and PostgreSQL listens on localhost:

sudo ss -Hltn | awk '{print $4}' | sort -u

The HTTPS front end answers 200, and port 80 redirects to HTTPS on the same name:

SITE=$(cat /var/lib/sac/data/rosariosis-address)
curl -sk -o /dev/null -w "%{http_code}\n" "https://${SITE}/index.php"
curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" "http://${SITE}/index.php"

The web application reaches PostgreSQL as rosariosis over the local socket with peer authentication, and no database role carries a password:

sudo -u www-data psql -h /var/run/postgresql -U rosariosis -d rosariosis -Atqc "SELECT current_user"
sudo -u postgres psql -Atqc "SELECT count(*) FROM pg_authid WHERE rolpassword IS NOT NULL"

The first command prints rosariosis and the second prints 0.

The web application cannot reach the instance metadata service. The next commands run the same request from inside apache2.service and from your shell. The first fails because it is blocked, and the second returns a token:

CG=$(systemctl show -p ControlGroup --value apache2.service)
sudo bash -c "echo \$\$ > /sys/fs/cgroup${CG}/cgroup.procs; exec curl -s -m 5 -o /dev/null -w '%{http_code}\n' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token" curl -s -m 5 -o /dev/null -w '%{http_code}\n' -X PUT -H 'X-aws-ec2-metadata-token-ttl-seconds: 60' http://169.254.169.254/latest/api/token

Browse to https://<instance-address>/ and sign in as admin with the password from /root/rosariosis-credentials.txt. The certificate is self-signed per instance, so your browser warns once. Step 11 installs a trusted certificate.

The first sign-in shows RosarioSIS's Confirm Successful Installation screen. Change the administrator password there, and later from the user menu.

After signing in you land on the RosarioSIS portal:

Sign in as the administrator and work through these areas:

• Open School Info to enter your school's name, marking periods and calendar.
• Open Students and Users to add students, staff and parents, individually or by file import.
• Open Scheduling to build the course catalog and student schedules.

The three demo template accounts (teacher, parent, student) ship with no password and cannot sign in until you set one for a real account.

A stock RosarioSIS exposes InstallDatabase.php, an unauthenticated endpoint that still accepts a request while the install is fresh. On this image, first boot creates the database from the command line. Apache denies the installer and the diagnostic page outright, and every GET and POST returns 403. You never run the installer.

RosarioSIS locks an account after repeated failed sign-ins. To clear the administrator's counter, run this on the instance:

sudo -u postgres psql -d rosariosis -c "UPDATE staff SET failed_login=NULL WHERE username='admin';"

By default the instance serves on its EC2 address. To serve on your own DNS name, point the name at the instance, then run:

sudo rosariosis-set-hostname sis.example.com

This rewrites RosarioSIS's $RosarioURL, Apache's server name and the certificate, and the change persists across reboots. RosarioSIS then answers only that name, plus the instance's own addresses, and builds all reset and notification links from it.

The per-instance certificate is self-signed. Once the instance serves on a public DNS name you control, install a trusted certificate with Certbot:

sudo snap install --classic certbot
sudo certbot --apache -d sis.example.com

Certbot writes the Apache vhost and sets up automatic renewal. Keep 443 reachable from the internet for the HTTP-01 challenge.

RosarioSIS sends password-reset and notification mail through the host's mail transport. Configure an SMTP relay, for example Amazon SES with SMTP credentials. Then set the notification and error addresses under School Info > System Preferences.

The site address is pinned to this instance, so the links in that mail always point back at your RosarioSIS.

Component Version Notes

RosarioSIS 13.0.2 /var/www/rosariosis, root-owned, read-only to the web server

PHP 8.3 PHP-FPM behind Apache (mpm_event), Unix socket

Apache 2.4 HTTPS vhost + a default reject vhost for unknown Host

PostgreSQL 16 127.0.0.1 only, peer auth over the Unix socket, no password

Path Purpose

/var/www/rosariosis Application code (read-only to the web server)

/var/www/rosariosis/assets/FileUploads Uploaded files (web-server owned); scripts there are never executed

/var/www/rosariosis/config.inc.php Database connection and $RosarioURL (0640 root:www-data; no password)

/root/rosariosis-credentials.txt Per-instance administrator credential (root only), written on first boot

/etc/sac/rosariosis-hostname Your configured DNS name, if set

/var/lib/sac/data/rosariosis-address The address currently served

sudo systemctl restart apache2 php8.3-fpm
# web tier
sudo systemctl restart postgresql@16-main
# database
sudo journalctl -u apache2 -e
# web logs
sudo journalctl -u rosariosis-firstboot
# first-boot log

Back up the database and the uploads tree:

sudo -u postgres pg_dump --no-owner --no-privileges rosariosis | gzip > /var/backups/rosariosis-$(date +%F).sql.gz
sudo tar czf /var/backups/rosariosis-uploads-$(date +%F).tar.gz -C /var/www/rosariosis assets/FileUploads assets/StudentPhotos assets/UserPhotos

The dump holds your school's records, so make both files root-only straight away with sudo chmod 600 /var/backups/rosariosis-*. Copy them off the instance, for example to Amazon S3, and take EBS snapshots on a schedule.

To restore, create an empty rosariosis database owned by the rosariosis role and load the SQL dump. Then unpack the uploads archive.

• Browser certificate warning: expected until Step 11 installs a trusted certificate.
• Locked out after failed sign-ins: clear the counter as in Step 9.
• Site shows the wrong address in emails: set your DNS name with rosariosis-set-hostname (Step 10).
• Site is down right after launch: first boot has not finished. Wait two to three minutes, then check sudo journalctl -u rosariosis-firstboot.

• Restrict 22/tcp to your management network and front the instance with your own DNS name and a trusted certificate (Steps 10-11).
• Change the administrator password on the first sign-in and create named staff accounts rather than sharing the administrator.
• Keep the instance patched: sudo apt update && sudo apt full-upgrade.
• Known residual advisory. RosarioSIS's rich-text editor is TinyMCE 4.9.11, the last release of the TinyMCE 4.x line. Three cross-site-scripting issues in that line (CVE-2026-47759, CVE-2026-47761, CVE-2026-47762) are fixed only in TinyMCE 5+/7+/8+, which RosarioSIS 13.0.2 does not yet integrate. They require an authenticated teacher to author crafted content that an administrator then opens in the editor, and they are mitigated on this image on three independent layers, so they are not reachable by students, parents or the public:
• every page that loads the editor sends an enforced Content-Security-Policy (script-src 'self' 'unsafe-eval', with no 'unsafe-inline' and object-src 'none'), which blocks injected inline scripts, javascript: URLs and media-object injection in the browser;
• RosarioSIS runs server-side HTML sanitisation (xss_clean) on every saved field, which strips scripts, inline event handlers and javascript: URLs; and
• the rich-text editor is reachable only to teachers and administrators, never to students, parents or unauthenticated visitors.

This build also replaces the bundled DOMPurify 2.3.6 (which carried a critical and several high-severity advisories) with DOMPurify 3.4.17, which has none. The TinyMCE residual is tracked and will be adopted once RosarioSIS integrates a supported TinyMCE major.

RosarioSIS is free software under the GNU General Public License version 2, and its source is published upstream. This image ships the GPL core only. None of the commercial add-on modules sold upstream is installed.

SecureAnyCloud packages the upstream release with the provisioning and hardening described in this guide. It provides 24/7 support for this image by email and live chat at sales@secureanycloud.com.

Deploy on AWS

Launch RosarioSIS 13.0.2 on Ubuntu 24.04 on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com