RosarioSIS

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for RosarioSIS by SecureAnyCloud, and select Create.

On Basics, pick your subscription, resource group, region and size (Standard_B2s or larger). Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTPS (443). Then select Review + create and Create.

SecureAnyCloud images carry a Marketplace purchase plan. Accept its terms once per subscription, then create the VM and open HTTPS:

az vm image terms accept --urn sac1647283583153:rosariosis-ubuntu-24-04:default:latest
az vm create \
  --resource-group my-rosariosis-rg \
  --name rosariosis \
  --image sac1647283583153:rosariosis-ubuntu-24-04:default:latest \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard
az vm open-port --resource-group my-rosariosis-rg --name rosariosis --port 443 --priority 900

ssh azureuser@<vm-public-ip>

First boot generates this VM's secrets and only then opens the front door. If the web server is running, the installation is ready. Check the three services:

systemctl is-active postgresql@16-main php8.3-fpm apache2

All three report active:

active active active

Confirm RosarioSIS answers over HTTPS on the VM itself. The image ships a self-signed certificate, so -k is expected here until you install your own certificate in Step 11:

curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/index.php

That prints 200. Only SSH and HTTPS are reachable from off the VM. The database and PHP-FPM deliberately are not:

sudo ss -lnt | grep -E ':(22|80|443|5432) ' | sort

LISTEN 0 200 127.0.0.1:5432 0.0.0.0:* LISTEN 0 4096 [::]:22 [::]:* LISTEN 0 4096 0.0.0.0:22 0.0.0.0:* LISTEN 0 511 *:443 *:* LISTEN 0 511 *:80 *:*

PostgreSQL appears only on 127.0.0.1:5432. PHP-FPM does not appear at all, because it listens on a UNIX socket, not a TCP port.

Every secret on this VM was generated on its first boot and written to a file that only root can read. Nothing here is shared with any other deployment:

sudo cat /root/rosariosis-credentials.txt

# sac :: RosarioSIS appliance credentials
# Generated on this VM's first boot. This file is readable only by root. # Sign in at https://<this-vm-address>/ and change the password afterwards. rosariosis.admin.user=admin rosariosis.admin.pass=<unique to this VM> rosariosis.db.name=rosariosis rosariosis.db.user=rosariosis rosariosis.db.pass=<unique to this VM>

admin is the RosarioSIS administrator account. Its upstream default password is not present in this image. The build replaces it before the database is ever committed, and your VM generates its own on first boot.

The database password is the one RosarioSIS itself uses. It is stored in /var/www/rosariosis/config.inc.php, which only root and the web server can read. To prove it works, connect the same way RosarioSIS does, over loopback:

PGPASSWORD="$(sudo grep '^rosariosis.db.pass=' /root/rosariosis-credentials.txt | cut -d= -f2-)" psql -h 127.0.0.1 -U rosariosis -d rosariosis -Atc "SELECT config_value FROM config WHERE title = 'VERSION';"

That prints 12.9.4, the schema version of your database.

Browse to https://<vm-public-ip>/. Your browser warns about the self-signed certificate. Accept it to continue, or install your own certificate first (Step 11). Sign in with the username admin and the rosariosis.admin.pass value from Step 5.

On the first sign-in, RosarioSIS shows its Confirm Successful Installation screen. If the VM can reach rosariosis.org, it first offers an optional, anonymous installation poll. Answer it or choose Cancel.

The confirmation screen then requires you to choose a new administrator password before it opens the system, so the random first-boot password is used only once. From then on, sign in with the password you chose. The value in the credentials file no longer works.

The screen suggests checking diagnostic.php. On this image that page is deliberately blocked, because it discloses server configuration to anyone who asks. The checks it performs were already run when the image was built, so a 403 Forbidden there is expected.

After you select OK, the portal opens with the full administrator menu and a dashboard for the default school and the 2026-2027 school year.

RosarioSIS ships with one school (Default School), the 2026-2027 school year with its semesters and quarters, grade levels from Kindergarten upwards, and one template student. Open Students > Student Info and search with no criteria to open that student's record.

To enroll your first real student, choose Students > Add a Student. Enter the first and last name, pick the Grade Level and the Enrollment Code (for example Beginning of Year), and select Save.

RosarioSIS assigns the student an ID and re-opens the record. The Addresses & Contacts and Medical tabs and every other module (scheduling, grades, attendance, billing) now apply to that student.

Rename the school and set its address under School > School Information. Review the calendar and marking periods under School before you enroll students in bulk.

The upstream database seeds four accounts, admin, teacher, parent and student, each with a published password equal to its username. In this image the administrator's password is replaced before it is ever written. The three demo accounts have no password at all, which RosarioSIS always rejects:

sudo -u postgres psql -d rosariosis -c "SELECT username, profile, CASE WHEN password IS NULL THEN 'no password (cannot sign in)' ELSE 'password set' END AS sign_in FROM staff UNION ALL SELECT username, 'student', CASE WHEN password IS NULL THEN 'no password (cannot sign in)' ELSE 'password set' END FROM students WHERE username = 'student' ORDER BY 1;"

username | profile | sign_in ----------+---------+------------------------------ admin | admin | password set parent | parent | no password (cannot sign in) student | student | no password (cannot sign in) teacher | teacher | no password (cannot sign in) (4 rows)

To use one of them, set a password under Users > User Info (or Students > Student Info for the student). Alternatively, delete them and create your own staff under Users > Add a User.

The web installer and the files that carry configuration are refused as well:

for p in /index.php /InstallDatabase.php /diagnostic.php /config.inc.php /rosariosis.sql; do printf '%-22s %s\n' "$p" "$(curl -sk -o /dev/null -w '%{http_code}' https://127.0.0.1$p)"; done

/index.php 200 /InstallDatabase.php 403 /diagnostic.php 403 /config.inc.php 403 /rosariosis.sql 403

RosarioSIS puts absolute links in the email it sends, most importantly password reset links. It builds them from the web server's name. A web server that takes that name from the browser's Host header would let a stranger request a reset for one of your users and have the link point at a site they control.

On this image, Apache always uses a server name that the VM writes for itself. rosariosis-baseurl.service runs on every boot, finds the VM's public IP address (or its private address if it has none), and writes it here:

grep '^ServerName' /etc/apache2/conf-available/rosariosis-servername.conf

That prints ServerName followed by your VM's public IP address. The same service issues the self-signed HTTPS certificate for that address. Because it runs on every boot, an Azure public IP that changes across a stop and start is picked up automatically:

systemctl is-enabled rosariosis-baseurl.service && sudo openssl x509 -in /etc/ssl/rosariosis/rosariosis.crt -noout -subject

The session cookie is issued with Secure, HttpOnly and SameSite=Strict and without a Domain attribute, so it works on the bare IP address in every browser.

RosarioSIS sends password reset links and new account notifications through PHP's mail function. This image does not ship a mail transfer agent, so no mail leaves the VM until you configure one.

Azure blocks outbound port 25 on most subscriptions, so relay through an authenticated SMTP provider on port 587. Two common routes:

• Install the free RosarioSIS Email SMTP plugin. Download it from the RosarioSIS add-ons page, unzip it into /var/www/rosariosis/plugins/ as root, and activate it under School > Configuration > Plugins. Then enter your provider's host, port, username and password.
• Install a relay that provides sendmail, such as msmtp-mta, and point it at your provider.

Install add-ons from the shell on this image. Uploading or deleting modules and plugins through the web interface is switched off in config.inc.php, so a stolen administrator session cannot be turned into code running on your server.

Point a DNS A record at the VM's public IP, then pin that name so Apache (and every link RosarioSIS emails) uses it instead of the IP address:

echo 'sis.example.com' | sudo tee /etc/rosariosis/server-name
sudo /usr/local/sbin/rosariosis-baseurl.sh

With the name resolving publicly, obtain a Let's Encrypt certificate and point Apache at it:

sudo apt-get update && sudo apt-get install -y certbot
sudo certbot certonly --webroot -w /var/www/rosariosis -d sis.example.com --deploy-hook 'systemctl reload apache2'
sudo sed -i -e 's#/etc/ssl/rosariosis/rosariosis.crt#/etc/letsencrypt/live/sis.example.com/fullchain.pem#' \
  -e 's#/etc/ssl/rosariosis/rosariosis.key#/etc/letsencrypt/live/sis.example.com/privkey.pem#' \
  /etc/apache2/sites-available/rosariosis.conf
sudo systemctl reload apache2

Keep port 80 open in your NSG while certbot validates, because the challenge arrives there and is redirected to HTTPS. Certbot renews the certificate automatically and reloads Apache after each renewal.

At the end of the year, run School > Rollover to copy courses, users and enrollment into the next school year. RosarioSIS then asks you to update the default school year in config.inc.php. On this image the web server can read that file but not write it, so make that one change from the shell:

sudo sed -i "s/^\$DefaultSyear = '2026';/\$DefaultSyear = '2027';/" /var/www/rosariosis/config.inc.php

• No default or shared credential ships in the image. The RosarioSIS administrator password, the database password and the HTTPS certificate are all generated on this VM's first boot, and RosarioSIS requires a new administrator password at the first sign in.
• The upstream demo accounts (teacher, parent, student) have no password and cannot sign in until you give them one.
• The web installer (InstallDatabase.php) and diagnostic.php are refused, as are config.inc.php, the SQL schema and the project's metadata files.
• The application code is owned by root and is read-only to the web server. Only the three upload folders (assets/FileUploads, assets/StudentPhotos, assets/UserPhotos) are writable, and nothing uploaded there is executed as code.
• Only 22/tcp and 443/tcp are reachable from off the VM. Port 80/tcp issues a permanent redirect to HTTPS and serves nothing else. PostgreSQL is bound to 127.0.0.1 and PHP-FPM uses a UNIX socket.
• Password reset links use the server name this VM writes for itself, never a host name supplied by a browser.
• SSH refuses root and password logins. Sign in as azureuser with your key. Ubuntu's unattended security upgrades remain enabled.

RosarioSIS keeps its state in the PostgreSQL database and in the three upload folders:

sudo -u postgres pg_dump -Fc rosariosis > ~/rosariosis-db-$(date +%F).dump
sudo tar czf ~/rosariosis-files-$(date +%F).tar.gz -C /var/www/rosariosis assets/FileUploads assets/StudentPhotos assets/UserPhotos config.inc.php

Copy both files off the VM. Take an Azure disk snapshot before any upgrade.

Ubuntu applies security updates automatically. Check which RosarioSIS release is installed:

grep "define( 'ROSARIO_VERSION'" /var/www/rosariosis/Warehouse.php

To move to a later release, back up first (Step 14), then unpack the new release over the existing code. The release archives do not contain config.inc.php, so your configuration is kept.

The example below installs 12.9.5:

cd /tmp && curl -fsSLO https://github.com/francoisjacquet/rosariosis/archive/refs/tags/v12.9.5.tar.gz
sudo tar -xzf v12.9.5.tar.gz -C /var/www/rosariosis --strip-components=1 sudo chown -R root:root /var/www/rosariosis
sudo chown -R www-data:www-data /var/www/rosariosis/assets/FileUploads /var/www/rosariosis/assets/StudentPhotos /var/www/rosariosis/assets/UserPhotos
sudo chown root:www-data /var/www/rosariosis/config.inc.php && sudo chmod 640 /var/www/rosariosis/config.inc.php

Replace 12.9.5 with the release you are installing. RosarioSIS applies any database updates for the new release automatically on the first page request after the code changes.