Stud.IP LMS 6.1.2

Subscribe to the Hardened Moodle & E-Learning Platforms AMIs listing. Choose Stud.IP LMS 6.1.2 on Ubuntu 24.04 as the software version, and launch.

The recommended instance type is m5.large (2 vCPU, 8 GiB) or larger for production. Stud.IP, PHP-FPM and MariaDB run comfortably in 8 GiB.

In the security group, open TCP 22 (SSH, your address only), TCP 80 and TCP 443. Do not open 3306, because MariaDB is loopback only.

# Replace the AMI id with the one shown on the listing in your region, and set your key, subnet and security group.
aws ec2 run-instances \
  --image-id ami-xxxxxxxxxxxxxxxxx \
  --instance-type m5.large \
  --key-name your-key \
  --security-group-ids sg-xxxxxxxx \
  --subnet-id subnet-xxxxxxxx \
  --associate-public-ip-address \
  --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":20,"VolumeType":"gp3"}}]' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=studip}]'

First boot builds the database and provisions the per-instance credentials. Allow a minute or two before the site answers.

Connect as the ubuntu user, which is the SSH login user on the Ubuntu 24.04 variant:

ssh -i /path/to/your-key.pem ubuntu@<instance-address>

The per-instance administrator password is written to a root-only file on first boot:

sudo cat /root/studip-credentials.txt

The file gives the sign-in URL, the administrator username (root@studip) and its per-instance password. The database needs no password (socket authentication).

systemctl is-active mariadb php8.3-fpm nginx curl -sk -o /dev/null -w '%{http_code}\n' https://127.0.0.1/dispatch.php/login

The output shows active three times and 200 for the login page. Only ports 22, 80 and 443 listen beyond loopback. Confirm it:

ss -tlnH | awk '{print $4}' | sort -u

Open https://<instance-address>/ in a browser. The certificate is self-signed per instance, so accept the warning or install your own certificate (Step 10).

Sign in as root@studip with the password from Step 4. On first sign-in, Stud.IP asks you to accept the terms of use and to change the password. Choose a new one.

After sign-in, Stud.IP opens your personal desktop. The interface language follows the browser. Switch it under your profile settings:

As root@studip (the system administrator), open the Admin area. Create your institution, add faculties and institutes, create user accounts (lecturers, tutors, students), and create your first course.

Stud.IP's own help covers the campus workflow. Nothing in this image changes it.

Stud.IP's scheduled tasks (notifications, cleanups, digests) run from a systemd timer. The timer calls cli/studip cronjobs:worker every minute as www-data. It is enabled automatically after first boot, so you do not need to add a cron entry. Check it:

systemctl status studip-cron.timer

Stud.IP's browser installer would let any visitor initialise the database and seize the administrator account. This image builds the database from the command line on first boot and deletes public/install.php and public/web_migrate.php. nginx also refuses any other .php URL. There is nothing to re-run and nothing for a stranger to claim.

Point a DNS A record at the instance. Then pin the name, so Stud.IP's links and certificate use it:

sudo studip-set-hostname lms.example.edu

This rewrites nginx's server_name, the certificate's subject-alternative names and Stud.IP's base URL, and reloads nginx. To go back to the EC2 public name/IP, run sudo studip-set-hostname --auto.

To replace the self-signed certificate with a CA-issued one (for example from Let's Encrypt), install your key and certificate at /etc/ssl/studip/studip.key and /etc/ssl/studip/studip.crt. Delete /etc/ssl/studip/studip.crt.sac-san, so the per-boot certificate manager leaves your certificate alone. Then run sudo systemctl reload nginx.

These features are off by default. Turn them on deliberately when your deployment needs them:

• Self-registration and user password-request mail are configuration flags. In Admin > System > Configuration, set ENABLE_SELF_REGISTRATION and/or ENABLE_REQUEST_NEW_PASSWORD_BY_USER to 1. Alternatively, set them from the command line:

# enable self-registration (example; review before enabling in production)
sudo mariadb --protocol=socket -uroot studip \
  -e "UPDATE config SET value='1' WHERE field='ENABLE_SELF_REGISTRATION';"

• Plugin upload is disabled in config/config_local.inc.php ($PLUGINS_UPLOAD_ENABLE = false;). To allow a root administrator to upload plugin packages, set it to true and reload PHP-FPM. Enable it only on a trusted, access-controlled deployment.

Stud.IP sends notification and password-reset mail through the host's mail transport. Configure a relay or SMTP host in config/config_local.inc.php ($MAIL_TRANSPORT, $MAIL_HOST_NAME), following Stud.IP's documentation. Then reload PHP-FPM.

• Stud.IP 6.1.2: installed at /usr/local/studip, with public/ as the only web root
• nginx (Ubuntu 24.04 package): TLS on 443, and port 80 sends a 301 redirect to HTTPS
• PHP 8.3 (FPM): listens on a unix socket, not a TCP port
• MariaDB 10.11: bound to 127.0.0.1 only, with unix_socket authentication

• Application: /usr/local/studip (root-owned; only data/, public/pictures and public/plugins_packages are writable by www-data)
• Local config: /usr/local/studip/config/config_local.inc.php
• Source and changes to upstream: /usr/share/doc/studip/SOURCE.txt
• Credentials: /root/studip-credentials.txt
• TLS key and certificate: /etc/ssl/studip/

sudo systemctl restart nginx php8.3-fpm mariadb
sudo systemctl status studip-cron.timer

Back up the database and the uploaded files. The database uses socket authentication, so run the dump as root on the instance:

sudo mariadb-dump --protocol=socket -uroot --single-transaction studip > studip-backup.sql
sudo tar czf studip-data.tgz -C /usr/local/studip data chmod 600 studip-backup.sql studip-data.tgz

Store both copies off the instance. To restore, load the SQL into the studip database and unpack data/.

• Site not answering. Check systemctl status studip-firstboot.service, because first boot builds the database. If first boot failed, the web tier stays stopped by design.
• Certificate warning. This is expected with the per-instance self-signed certificate. Install your own (Step 10).
• Logs. Run sudo journalctl -u nginx -u php8.3-fpm -u mariadb -u studip-firstboot.

• Restrict SSH (port 22) to your own address.
• Keep self-registration and plugin upload off unless you need them (Step 11).
• Install a CA-issued certificate and pin your hostname (Step 10).
• Apply OS security updates (unattended-upgrades is enabled), and reboot for a new kernel.
• Keep /root/studip-credentials.txt private, and change the administrator password after first sign-in.

Stud.IP is licensed under the GNU General Public License version 2 or later. The full text ships at /usr/local/studip/COPYING.

SecureAnyCloud provides the image, its hardening and 24/7 support for the packaging. Stud.IP itself is community open-source software. Stud.IP is a trademark of its respective owner, and SecureAnyCloud is not affiliated with or endorsed by the Stud.IP project.

Deploy on AWS

Launch Stud.IP LMS 6.1.2 on Ubuntu 24.04 on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com