Admidio 5.0.18 on AWS User Guide

Overview

This guide covers launching and using the Admidio 5.0.18 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg ERP and CRM listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

Admidio is an open source membership management platform for clubs, associations and non profit organisations. It centres on a member database with freely definable profile fields, and adds groups and roles with fine grained permissions, events with participant registration, documents and files, announcements, photo albums, a forum, messages and mailings, an inventory manager and category reports, all in one web application.

What the cloudimg image adds:

• No default login. The administrator password is generated on your instance's first boot and written to /root/admidio-credentials.txt (root only). The image ships no known password, no database and no configuration file: Admidio's own installer runs once, on your instance, on first boot.
• No database password. Admidio signs in to MariaDB as the database user admidio over the local unix socket, authenticated by the operating system (unix_socket): only processes running as the admidio user get in, so there is no database password to store, leak or rotate. MariaDB has no network listener at all.
• No install wizard. The web installer only ever runs on first boot, behind a loopback server that needs a one time token, and its URL answers 404 for good, so nobody who reaches the instance first can take it over.
• HTTPS from the first boot. nginx serves Admidio on port 443 with a certificate generated on your instance, port 80 redirects to HTTPS, and requests for a host name the instance does not serve are dropped.
• Fail closed. nginx starts only after first boot has finished. If it cannot finish, nothing is served.
• Sign in works on an IP address. Admidio marks its session cookie for its host name, which browsers refuse for an IP address; the image makes the cookie host only, so you can sign in on the instance's IP address or DNS name. Sign in, password reset and registration requests are rate limited per client address on top of Admidio's own lock after three wrong passwords.
• Closed by default. Public registration is off, single sign on (SAML and OpenID Connect) is off until you set it up, phpinfo is not served, and every page carries a Content Security Policy.
• Hardened defaults. nginx, PHP-FPM, MariaDB and the first boot service are blocked from the instance metadata service, the AMI requires IMDSv2, Admidio's PHP runs as its own user with its code read only, and Admidio is handed the configured host name and the real client address from the connection (never values a client sends).
• Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on.

What is on the image: Admidio 5.0.18 (the upstream release, checksum verified, with its PHP libraries built from the release's own lock file), nginx 1.24, PHP 8.3 FPM with OPcache and MariaDB 10.11 (all from Ubuntu 24.04), cloud-init and the AWS Systems Manager agent. PHP is Ubuntu's 8.3.6-0ubuntu0.24.04.13 build or later, which fixes CVE-2026-109618 and CVE-2026-109619 (USN-8948-1).

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet with a route to the internet (or a private route you use for management).
• A security group that allows TCP 22 (SSH) from your admin network, and TCP 443 (Admidio) and TCP 80 (redirects to HTTPS) from the networks your members work from. MariaDB has no network port to open.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick Admidio 5.0.18 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair and a security group as above. The root volume holds the database, photos and documents, so give it room to grow (for example 30 GiB or more for an active club).

With the AWS CLI (replace the values in angle brackets):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --block-device-mappings 'DeviceName=/dev/sda1,Ebs={VolumeSize=30,VolumeType=gp3}' \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=admidio}]'

First boot takes well under a minute after the instance is running.

Step 2: Connect to your instance

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot creates the database, runs Admidio's installer, sets the password and the certificate, then nginx starts:

systemctl is-active nginx php8.3-fpm mariadb admidio-firstboot
sudo test -f /var/lib/cloudimg/admidio-firstboot.done && echo FIRSTBOOT_DONE

All four units are active and the first boot marker is present:

active
active
active
active
FIRSTBOOT_DONE

Only SSH and nginx listen on network ports. MariaDB has no TCP listener and PHP-FPM uses a local socket:

sudo ss -lntp | awk 'NR>1 {print $4, $6}' | grep -v ':53 ' | sed -E 's/,pid=[0-9]+,fd=[0-9]+//g' | sort

0.0.0.0:22 users:(("sshd"),("systemd"))
0.0.0.0:443 users:(("nginx"),("nginx"),("nginx"))
0.0.0.0:80 users:(("nginx"),("nginx"),("nginx"))
[::]:22 users:(("sshd"),("systemd"))
[::]:443 users:(("nginx"),("nginx"),("nginx"))
[::]:80 users:(("nginx"),("nginx"),("nginx"))

Step 4: Get your URL and password

sudo cat /root/admidio-credentials.txt

The file is readable by root only:

# Admidio 5.0.18 - generated on first boot by admidio-firstboot.service
# These credentials are unique to this instance; none was baked into the image. Keep this file secret.

ADMIDIO_URL=https://<public-dns-name>/
ADMIDIO_ADMIN_USER=admin
ADMIDIO_ADMIN_PASSWORD=<ADMIDIO_ADMIN_PASSWORD>
ADMIDIO_ADMIN_EMAIL=admin@example.com
#
# Open ADMIDIO_URL in a browser (self-signed certificate minted on this instance's first boot; port 80 and this
# instance's other addresses redirect to it) and sign in as 'admin' with the password above. Set your organisation's
# name and e-mail and your own e-mail address (Settings, your profile) and an SMTP server (Settings > E-mail dispatch)
# before you rely on mail. Public registration is off (Settings > Registration).
# MariaDB: unix socket only (no TCP listener, no database password: Admidio runs as the OS user admidio);
#          sudo mysql admidio   (root signs in over the socket)
# Change the password:            sudo admidio-set-password
# Change the name it serves as:   sudo admidio-set-hostname <your-dns-name>
# User guide: https://www.cloudimg.co.uk/guides/admidio-5-0-18-on-ubuntu-24-04-aws/

The URL uses the instance's public DNS name from the EC2 instance metadata (its public IP address when the subnet gives no DNS name). The certificate also names the public and private IP addresses, and those addresses redirect to the URL, because Admidio builds every link from one configured address. If you stop and start the instance without an Elastic IP, its public name changes: set the new one with admidio-set-hostname (Step 7), or use your own DNS name.

Step 5: Sign in

Browse to the URL from the credentials file. Your browser warns once about the self signed certificate; accept it (or install your own certificate, Step 7). Sign in as admin with the password from the credentials file.

After signing in you land on the overview, with the modules (announcements, events, messages, groups and roles, contacts, documents and files, inventory, photos, category report, web links and forum) and the administration pages on the left.

First, under Administration > Organization, set your organisation's name and e-mail address (the installer names it "My Organisation" with admin@example.com), then open your own profile from the menu at the top right and set your real e-mail address. Set up outgoing mail under Preferences > Email delivery so password resets, event notifications and mailings reach your members.

Step 6: Members, groups and roles

Contacts is the member database. Use Create contact to add a member, Import contacts to load a CSV file, and Edit profile fields to add the fields your club needs (membership number, emergency contact, licence, and so on).

Groups & roles decides who can do what: each role carries rights (edit contacts, manage events, upload documents, send mail) and a member list. The installer creates the Administrator, Association's board and Member roles; add teams, committees or departments as further roles.

Preferences holds the system settings: security (password strength, sign in options, two factor authentication), registration, captcha, single sign on, the module settings and the regional settings. The Information tab shows the version and offers a database backup download.

Step 7: Your own DNS name and certificate

Point a DNS record at the instance (an Elastic IP keeps the address stable), then set the name Admidio is served as. This mints a new self signed certificate for the name, updates nginx, Admidio's configured address (used in every link, redirect and e-mail) and the URL in /root/admidio-credentials.txt, and keeps the name across reboots:

sudo admidio-set-hostname <your-domain>

To use a certificate from a public or internal certificate authority instead (for example one issued by Let's Encrypt for <your-domain>), copy it over the generated pair and reload nginx (running admidio-set-hostname again replaces it with a self signed one):

sudo install -m 0644 <your-domain>.crt /etc/nginx/ssl/admidio.crt
sudo install -m 0600 <your-domain>.key /etc/nginx/ssl/admidio.key
sudo nginx -t && sudo systemctl reload nginx

Step 8: Security checks

The shipped round trip checks that port 80 redirects to HTTPS, that the installer, the data folder, the sources, the PHP libraries and phpinfo are refused, and that the administrator signs in through Admidio's own sign in form with this instance's password while a wrong password and a default password are refused. Passwords are handed to curl in root only temporary files, never on a command line:

sudo /usr/local/sbin/admidio-cred-roundtrip

OK https 301 + no installer/data folder/sources/vendor/phpinfo + administrator sign-in (Admidio's own form) + wrong and default passwords refused

The installer, the data folder (which holds the configuration link), phpinfo, the PHP libraries and the sources answer 404, plain HTTP redirects to HTTPS on the configured name, and a host name the instance does not serve gets no answer at all:

H=$(sudo grep '^ADMIDIO_URL=' /root/admidio-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#')
for p in /system/login.php /install/ /install/installation.php /adm_my_files/config.php /system/phpinfo.php /vendor/autoload.php /src/; do
  curl -sk -o /dev/null -w "%{http_code}  $p\n" --resolve "$H:443:127.0.0.1" "https://$H$p"
done
curl -s -o /dev/null -w 'http:// -> %{http_code}\n' --resolve "$H:80:127.0.0.1" "http://$H/"
curl -sk -o /dev/null -w 'unknown host name -> %{http_code}\n' --resolve "other.example:443:127.0.0.1" https://other.example/ || true

200  /system/login.php
404  /install/
404  /install/installation.php
404  /adm_my_files/config.php
404  /system/phpinfo.php
404  /vendor/autoload.php
404  /src/
http:// -> 301
unknown host name -> 000

The certificate was generated on this instance and names its own addresses:

H=$(sudo grep '^ADMIDIO_URL=' /root/admidio-credentials.txt | cut -d= -f2- | sed -E 's#https://([^/]+)/#\1#')
echo | openssl s_client -connect 127.0.0.1:443 -servername "$H" 2>/dev/null | openssl x509 -noout -subject -ext subjectAltName

subject=CN = <public-dns-name>, O = cloudimg
X509v3 Subject Alternative Name:
    DNS:<public-dns-name>, IP Address:<public-ip>, IP Address:<private-ip>, IP Address:127.0.0.1, DNS:localhost

None of the services can reach the instance metadata service:

systemctl show nginx php8.3-fpm mariadb admidio-firstboot -p Id -p IPAddressDeny

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128
Id=nginx.service

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128
Id=php8.3-fpm.service

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128
Id=mariadb.service

IPAddressDeny=169.254.169.254/32 168.63.129.16/32 fd00:ec2::254/128
Id=admidio-firstboot.service

nginx hands PHP the configured host name and blanks every forwarded client header, so Admidio's links always use the configured address and its sign in records and lockouts use the real address of the connection:

grep -hE 'fastcgi_param (HTTP_HOST|SERVER_NAME|HTTP_X_FORWARDED_HOST|HTTP_X_FORWARDED_FOR|HTTP_CLIENT_IP|HTTP_FORWARDED) ' /etc/nginx/snippets/cloudimg-admidio-fastcgi.conf

fastcgi_param HTTP_HOST $adm_host;
fastcgi_param SERVER_NAME $adm_host;
fastcgi_param HTTP_X_FORWARDED_HOST $adm_host;
fastcgi_param HTTP_X_FORWARDED_FOR "";
fastcgi_param HTTP_CLIENT_IP "";
fastcgi_param HTTP_FORWARDED "";

MariaDB runs without networking, and Admidio's database user admidio signs in over the unix socket with no password. root works only from the instance itself (sudo mysql):

sudo mysql -e "SELECT @@skip_networking, @@local_infile, @@log_bin, @@general_log; SELECT user, host FROM mysql.global_priv WHERE user <> 'mariadb.sys' ORDER BY user;"

@@skip_networking   @@local_infile  @@log_bin   @@general_log
1   0   0   0
user    host
admidio localhost
mysql   localhost
root    localhost

Step 9: Versions and where things are

grep -E '^const ADMIDIO_VERSION_(MAIN|MINOR|PATCH)' /var/www/admidio/system/bootstrap/constants.php
php -r 'echo PHP_VERSION."\n";'
mariadbd --version
nginx -v
head -4 /usr/share/doc/admidio/SOURCE.txt

const ADMIDIO_VERSION_MAIN = 5;
const ADMIDIO_VERSION_MINOR = 0;
const ADMIDIO_VERSION_PATCH = 18;
8.3.6
mariadbd  Ver 10.11.14-MariaDB-0ubuntu0.24.04.1 for debian-linux-gnu on x86_64 (Ubuntu 24.04)
nginx version: nginx/1.24.0 (Ubuntu)
Admidio 5.0.18 on Ubuntu 24.04 by cloudimg - source and changes

Upstream: the Admidio v5.0.18 tag archive, https://github.com/Admidio/admidio/archive/refs/tags/v5.0.18.tar.gz
(commit bb3d5b5039a0de54f16e6b5a47ff9c08fc2335f5; sha256 52a76659987007be7957a73688fe0430a9e2b8c14057460f4bca03f6c1a7b526). Licence: GPL-2.0-only (LICENSE, shipped here and in /var/www/admidio).

Step 10: Changing passwords

• Admidio admin: change it in Admidio (your profile, Change password), or on the instance. The helper below sets a new random password with Admidio's own password scheme, clears any lock from wrong passwords, signs every session out and writes the new password to /root/admidio-credentials.txt. To choose the password yourself, pipe it in with --stdin (20 to 72 letters and digits), so it never appears on a command line:

sudo admidio-set-password
sudo grep '^ADMIDIO_ADMIN_PASSWORD=' /root/admidio-credentials.txt

• Members reset their own password from the sign in page (Password forgotten?) once outgoing mail is set up; the reset link always points at the configured address, never a host name taken from the request.

Step 11: Backup and maintenance

The database lives in MariaDB (/var/lib/mysql) and uploaded files, photos and documents under /var/lib/admidio/adm_my_files. The simplest backup is an EBS snapshot of the root volume. Preferences > Information > Download database backup downloads the database from the browser. For a backup on the instance while Admidio is running:

sudo mariadb-dump --single-transaction --routines --triggers admidio | gzip > <backup-dir>/admidio-$(date +%F).sql.gz
sudo tar -czf <backup-dir>/admidio-files-$(date +%F).tar.gz -C /var/lib/admidio adm_my_files

Operating system, nginx, PHP and MariaDB security updates install automatically from Ubuntu; run sudo apt-get update && sudo apt-get upgrade to apply everything else. Admidio's code is read only to PHP, so its in browser update check cannot replace files on this image; to move to a newer Admidio release, launch the newer version from the listing and restore your database and data folder into it, or contact cloudimg support. Take a snapshot first.

Step 12: Security recommendations

• Allow port 22 from your admin network only, and ports 80 and 443 only from the networks your members work from.
• Use your own DNS name and a certificate your browsers trust (Step 7).
• Give each person their own account and the smallest role that fits, and keep admin for administration.
• Turn on two factor authentication under Preferences > Security, change the admin password if it may have been shared (Step 10), keep the operating system patched, and snapshot the volume regularly.
• The rich text editor bundled with Admidio 5.0.18 (CKEditor 5 41.3.0) has published cross site scripting advisories of medium and low severity in the editor itself. Only give the rights to write announcements, events and other rich text to members you trust.

Support and licensing

Admidio is open source software licensed under the GNU General Public License version 2; cloudimg ships it unmodified, and the source location and checksums are in /usr/share/doc/admidio/SOURCE.txt. There is no per user licence fee. The AMI price covers cloudimg's hardening, first boot setup and support. Admidio is a trademark of its owners; cloudimg is not affiliated with or endorsed by the Admidio Team.

• Email: support@cloudimg.co.uk
• Website: https://www.cloudimg.co.uk
• Support: 24/7, with a 24 hour response SLA