webERP 5.0.1

In the AWS Marketplace listing, choose Continue to Subscribe, then Continue to Configuration. Pick webERP 5.0.1 Accounting on Ubuntu 24.04 as the software version, select your Region, and choose Launch through EC2.

Choose m5.large, your key pair and a security group as described above. The database lives on the root volume, so for production give the root volume room to grow (20 GiB or more).

To launch with the AWS CLI instead, replace the values in angle brackets:

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=20,VolumeType=gp3}' \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=weberp}]'

First boot takes well under a minute after the instance is running.

Connect over SSH as the user ubuntu, the SSH user for webERP 5.0.1 Accounting on Ubuntu 24.04:

ssh -i <your-key.pem> ubuntu@<public-ip>

First boot creates the company database and sets the passwords and the certificate. Then nginx and PHP-FPM start. Check the units:

systemctl is-active nginx php8.3-fpm mariadb weberp-firstboot
sudo test -f /var/lib/sac/data/weberp-firstboot.done && echo FIRSTBOOT_DONE

All four units are active and the first boot marker is present:

active active active active FIRSTBOOT_DONE

Only SSH and nginx listen on network ports. MariaDB listens on the loopback address, and PHP-FPM uses a local socket:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v '127.0.0.5' | sort

0.0.0.0:22 users:(("sshd",...)) 0.0.0.0:443 users:(("nginx",...)) 0.0.0.0:80 users:(("nginx",...)) 127.0.0.1:3306 users:(("mariadbd",...)) [::]:22 users:(("sshd",...)) [::]:443 users:(("nginx",...)) [::]:80 users:(("nginx",...))

Read the credentials file with sudo:

sudo cat /root/weberp-credentials.txt

Only root can read the file. It looks like this:

# webERP 5.0.1 - generated on first boot by weberp-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret. WEBERP_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ WEBERP_COMPANY=weberp WEBERP_ADMIN_USER=admin WEBERP_ADMIN_PASSWORD=<WEBERP_ADMIN_PASSWORD> MARIADB_DATABASE=weberp MARIADB_USER=weberp MARIADB_PASSWORD=<MARIADB_PASSWORD>
# The certificate is self signed (minted on this instance); port 80 redirects to https.
# Change the name webERP is served as:
sudo weberp-set-hostname <your-dns-name>
# MariaDB listens on 127.0.0.1 only; on-box maintenance:
sudo mariadb
# User guide: https://secureanycloud.com/stacks/weberp-5-0-1/

The URL uses the instance's public DNS name from the EC2 instance metadata. The certificate also names the public and private IP addresses, so https://<public-ip>/ works too.

If you stop and start the instance without an Elastic IP, the boot service picks up the new address and issues a new certificate for it. To serve webERP under your own DNS name, see Step 8.

You need the MariaDB password only for your own tools. webERP already has it in /var/www/weberp/config.php.

Open the WEBERP_URL in your browser. The certificate is self-signed, so your browser asks you to confirm it the first time. You can also install your own certificate (Step 8).

The company webERP Company is preselected. Sign in as admin with the password from Step 4.

The main menu has a tab for each module: Sales, Receivables, Purchases, Payables, Inventory, Manufacturing, General Ledger, Asset Manager, Petty Cash, Setup and Utilities. The footer shows the webERP version.

Open General Ledger, then GL Account (under Maintenance). The list shows the chart of accounts the company ships with, and you can add, rename or remove accounts.

Reports such as the trial balance, profit and loss and balance sheet run from the General Ledger tab. You can view them on screen or export them as PDF or as a spreadsheet.

You can also check the sign-in from the instance. The script below signs in through the real login form over HTTPS with the instance's password. It then shows that a blank password, the upstream default weberp and common weak passwords are refused. Each attempt uses a new session, so the checks never lock the account.

sudo weberp-cred-roundtrip.sh

OK per-instance admin signs in over HTTPS; blank, admin/weberp and weak guesses refused

Open Setup. Work through these options first, in order:

• Company Preferences: company name, address, tax reference, home currency and the default GL accounts.
• System Parameters: date format, credit limits, overdue terms and other defaults.
• Currency Maintenance, Tax Authorities and Rates Maintenance and Tax Group Maintenance: your tax rules.
• Sales Types (price lists) and Customer Types: webERP requires at least one of each before you can add a customer. Likewise, create Supplier Types before you add suppliers.
• Inventory Locations Maintenance and Inventory Categories Maintenance: create these before you add stock items.
• Users Maintenance: add a user for each person, with a security role that matches their job.

webERP sends e-mail for statements, purchase orders and alerts. Set your SMTP relay under Setup, then SMTP Server Details.

Amazon SES works as the relay (port 587 with STARTTLS). If you restrict egress, allow outbound port 587 in your security group or network ACLs.

Point a DNS record at the instance. An Elastic IP keeps the address stable.

Then set the name that webERP is served as. The command below creates a new self-signed certificate for the name, updates nginx and the URL in /root/weberp-credentials.txt, and keeps the name across reboots:

sudo weberp-set-hostname <your-domain>

To use a certificate from a public or internal certificate authority instead, for example one issued by Let's Encrypt for <your-domain>, copy it over the generated pair and reload nginx. Running weberp-set-hostname again replaces your certificate with a self-signed one:

sudo install -m 0644 <your-domain>.crt /etc/ssl/weberp/weberp.crt
sudo install -m 0600 <your-domain>.key /etc/ssl/weberp/weberp.key
sudo nginx -t && sudo systemctl reload nginx

The installer is gone, and nginx serves only the application. The vendor debugger, the configuration file, SQL scripts and company data files answer 404, and plain HTTP redirects to HTTPS. Check the responses:

H=$(sudo grep '^WEBERP_URL=' /root/weberp-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#') for p in /index.php /install/ /vendor/phpxmlrpc/phpxmlrpc/debugger/ /config.php /sql/config.sql /companies/weberp/Companies.php; do curl -sk -o /dev/null -w "%{http_code} $p\n" --resolve "$H:443:127.0.0.1" "https://$H$p" done curl -s -o /dev/null -w 'http:// -> %{http_code} %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/" ls /var/www/weberp/install 2>&1 | sed 's/^ls: //' [ "$(curl -sk -o /dev/null -w '%{http_code}' --resolve "$H:443:127.0.0.1" "https://$H/install/")" = "404" ]

200 /index.php 404 /install/ 404 /vendor/phpxmlrpc/phpxmlrpc/debugger/ 404 /config.php 404 /sql/config.sql 404 /companies/weberp/Companies.php http:// -> 301 https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/ cannot access '/var/www/weberp/install': No such file or directory

PHP is the fixed Ubuntu build on every package, and MariaDB is 10.11.19 from the MariaDB repository:

dpkg-query -W -f='${db:Status-Abbrev} ${Package} ${Version}\n' 'php8.3*' | awk '$1 == "ii" {print $2, $3}' dpkg-query -W -f='${Package} ${Version}\n' mariadb-server

php8.3-cli 8.3.6-0ubuntu0.24.04.13 php8.3-common 8.3.6-0ubuntu0.24.04.13 php8.3-curl 8.3.6-0ubuntu0.24.04.13 php8.3-fpm 8.3.6-0ubuntu0.24.04.13 php8.3-gd 8.3.6-0ubuntu0.24.04.13 php8.3-mbstring 8.3.6-0ubuntu0.24.04.13 php8.3-mysql 8.3.6-0ubuntu0.24.04.13 php8.3-opcache 8.3.6-0ubuntu0.24.04.13 php8.3-readline 8.3.6-0ubuntu0.24.04.13 php8.3-xml 8.3.6-0ubuntu0.24.04.13 php8.3-zip 8.3.6-0ubuntu0.24.04.13 mariadb-server 1:10.11.19+maria~ubu2404

Later Ubuntu security updates raise these versions. Any version at or above these is fixed.

webERP reports version 5.0.1 and runs with its "HTTPS only" setting on:

grep "VersionNumber'\] =" /var/www/weberp/includes/GetConfig.php
sudo mariadb -N -B weberp -e "SELECT confname, confvalue FROM config WHERE confname IN ('VersionNumber','HTTPS_Only');"

$_SESSION['VersionNumber'] = '5.0.1'; HTTPS_Only 1 VersionNumber 5.0.1

The certificate was generated on this instance and names its own addresses:

H=$(sudo grep '^WEBERP_URL=' /root/weberp-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = ec2-<public-ip-dashed>.compute-1.amazonaws.com, O = sac X509v3 Subject Alternative Name: DNS:ec2-<public-ip-dashed>.compute-1.amazonaws.com, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

None of these services can reach the instance metadata service:

systemctl show nginx php8.3-fpm mariadb weberp-firstboot -p Id -p IPAddressDeny

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 Id=nginx.service IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 Id=php8.3-fpm.service IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 Id=mariadb.service IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128 Id=weberp-firstboot.service

SSH accepts keys only, refuses root logins and does not forward X11. These effective settings are pinned in /etc/ssh/sshd_config.d/00-sac.conf:

sudo sshd -T | grep -E '^(permitrootlogin|passwordauthentication|kbdinteractiveauthentication|x11forwarding) '

permitrootlogin no passwordauthentication no kbdinteractiveauthentication no x11forwarding no

nginx hands PHP the configured host name and the client address from the connection, never values a client sends:

grep -E 'fastcgi_param (HTTP_HOST|HTTPS|HTTP_X_FORWARDED_FOR|HTTP_X_REAL_IP|HTTP_CLIENT_IP) ' /etc/nginx/sites-available/sac-weberp

fastcgi_param HTTP_HOST $weberp_host; fastcgi_param HTTPS on; fastcgi_param HTTP_X_FORWARDED_FOR $remote_addr; fastcgi_param HTTP_X_REAL_IP $remote_addr; fastcgi_param HTTP_CLIENT_IP $remote_addr;

nginx also refuses a form post whose Origin is another web site (HTTP 403). webERP's XML-RPC API clients send no Origin and are unaffected.

Files that webERP writes for download under companies/weberp/reports (sales and GL graph images, CSV exports) stay on the instance. Upstream webERP links to them without a login, so this image does not serve them over the web. When you need them, copy them with scp from /var/www/weberp/companies/weberp/reports/.

• webERP admin password: sign in as admin and open Setup, then Users Maintenance. Select Edit on the admin row, enter a new password and save the record. Then update or delete WEBERP_ADMIN_PASSWORD in /root/weberp-credentials.txt, so the file does not hold an old password.
• Individual users: give each person their own webERP user rather than sharing admin. After five wrong passwords in one session, webERP blocks the account until an administrator unblocks it in Users Maintenance.
• MariaDB password: change it only together with $DBPassword in /var/www/weberp/config.php, then restart PHP-FPM.

The company database lives in MariaDB (/var/lib/mysql). Logos, part pictures and generated files live under /var/www/weberp/companies/weberp.

The simplest backup is an EBS snapshot of the root volume. For a consistent file-level copy while webERP is running, run:

sudo mariadb-dump --single-transaction --routines --triggers weberp | gzip > <backup-dir>/weberp-$(date +%F).sql.gz
sudo tar -czf <backup-dir>/weberp-companies-$(date +%F).tar.gz -C /var/www/weberp companies/weberp

Operating system security updates install automatically. Run sudo apt-get update && sudo apt-get upgrade to apply everything else.

MariaDB updates come from the MariaDB 10.11 repository configured on the image (/etc/apt/sources.list.d/mariadb.sources, signed by MariaDB's release key), so you receive each new 10.11 point release. nginx, PHP-FPM and MariaDB restart cleanly, and webERP keeps all of its data.

Key locations on the instance:

• webERP: /var/www/weberp
• Configuration: /var/www/weberp/config.php (mode 0640)
• Company files: /var/www/weberp/companies/weberp
• Database: MariaDB database weberp (/var/lib/mysql)
• nginx site: /etc/nginx/sites-available/sac-weberp
• Certificate and key: /etc/ssl/weberp/
• Boot service: /usr/local/sbin/weberp-firstboot.sh
• Host name helper: /usr/local/sbin/weberp-set-hostname
• Credentials: /root/weberp-credentials.txt (mode 0600)

• Allow port 22 from your admin network only, and ports 80 and 443 only from the networks your users work from. Never open port 3306.
• Use your own DNS name and a certificate your users' browsers trust (Step 8).
• Give each person their own webERP user and role, and change the admin password if it may have been shared (Step 10).
• Keep the operating system patched, and snapshot the root volume regularly.