Apache OFBiz 24.09.07 on AWS User Guide

Overview

This guide covers launching and using the Apache OFBiz 24.09.07 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg ERP and CRM listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

Apache OFBiz is an open source enterprise resource planning suite from the Apache Software Foundation: accounting and general ledger, order management, product catalog and pricing, party and customer relationship management, inventory and facilities, manufacturing, work effort and a web shop, all in one Java application with a web interface for each area. This image builds the official, signed Apache OFBiz 24.09.07 release (the newest release at build time, which fixes every vulnerability on the project's security page) and runs it on OpenJDK 17 with its embedded Apache Derby database.

The cloudimg image adds:

• No demo logins. The image loads OFBiz's seed data only, never the demo data set, so the well known demo accounts (admin, flexadmin, demoadmin and the others, all with the password ofbiz) do not exist. First boot creates one administrator, admin, with a password generated on your instance and stored only as a salted SHA-512 hash; the password itself is written to /root/ofbiz-credentials.txt.
• Per instance keys. First boot generates OFBiz's token signing key (security.token.key), its login secret (login.secret_key_string) and the password of the keystore that protects OFBiz's own internal HTTPS port. Nothing secret is baked into the image, and the publicly known keystores that ship inside the OFBiz release are removed.
• HTTPS from the first boot. nginx serves OFBiz on port 443 with a certificate generated on your instance's first boot. Port 80 redirects to HTTPS.
• Risky endpoints refused. The XML-RPC, SOAPService and ProgramExport (Groovy script execution) endpoints that were behind OFBiz's past pre-authentication remote code execution vulnerabilities, and the unauthenticated forgot password flow, are refused by nginx and SOAPService and ProgramExport are removed from OFBiz itself.
• OFBiz on loopback only. OFBiz listens on 127.0.0.1:8080 and 127.0.0.1:8443 behind nginx. The AJP connector (which listens on every interface with no secret in a stock install) and the admin shutdown port are removed. The only open ports are 22, 80 and 443.
• Patched dependencies. The build pins newer patch releases of the libraries OFBiz 24.09.07 ships (Apache Tomcat 9.0.121, Jackson 2.21.7, FreeMarker 2.3.35, Log4j 2.25.5, Apache CXF 3.6.12 and others) to clear their published vulnerabilities, and records every shipped library with its checksum in /usr/share/doc/cloudimg/ofbiz-runtime-jars.txt.
• Fail closed. OFBiz refuses to start until first boot has generated the keys and the administrator, and nginx refuses to start until first boot has finished.
• Hardened defaults. OFBiz runs as its own unprivileged user in a systemd sandbox that can write only its data volume; the application and its configuration belong to root. OFBiz, nginx and the first boot service are blocked from the instance metadata service; the AMI requires IMDSv2. The site's address comes from your configuration, never from a request, and requests for a host name the instance does not serve are dropped.
• A separate data volume. The OFBiz database, search indexes, uploaded content and logs live on their own 20 GiB EBS volume mounted at /var/lib/ofbiz, which you can grow independently.
• Fully patched Ubuntu 24.04 LTS at build time, with unattended security upgrades switched on (they also keep OpenJDK patched).

What is on the image: Apache OFBiz 24.09.07 (built from the signed release, checksum verified), OpenJDK 17 runtime from Ubuntu, nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent. The example and LDAP plugins are switched off (see Step 10).

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large (m5.xlarge for production use)

Prerequisites

• An AWS account subscribed to the cloudimg ERP and CRM listing in AWS Marketplace.
• An EC2 key pair in the region you launch in.
• A security group that allows SSH (port 22) from your own IP address, and HTTPS (443) and HTTP (80) from the networks your users work from.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, accept the terms, then Continue to Configuration. Pick Apache OFBiz 24.09.07 on Ubuntu 24.04 as the software version and your region, then Continue to Launch. Choose Launch through EC2, select an instance type (m5.large or larger), your key pair, and a security group with these inbound rules:

22   tcp  <your-admin-ip>/32
80   tcp  0.0.0.0/0   (or your users' networks)
443  tcp  0.0.0.0/0   (or your users' networks)

Keep the second EBS volume the AMI defines (the 20 GiB OFBiz data volume) and launch. First boot takes about two minutes; OFBiz then needs another minute to start.

Step 2: Connect to your instance

ssh -i your-key.pem ubuntu@<public-ip>

Step 3: Check the services

systemctl is-active ofbiz nginx apache-ofbiz-firstboot

active
active
active

Only SSH and nginx listen on the network; OFBiz listens on loopback only:

sudo ss -lntp | awk 'NR==1 || /:(22|80|443|8080|8443) /' | sed -E 's/users:.*"([a-z0-9-]+)".*/\1/'

State  Recv-Q Send-Q Local Address:Port Peer Address:PortProcess
LISTEN 0      100        127.0.0.1:8080      0.0.0.0:*    java
LISTEN 0      511          0.0.0.0:443       0.0.0.0:*    nginx
LISTEN 0      511          0.0.0.0:80        0.0.0.0:*    nginx
LISTEN 0      4096         0.0.0.0:22        0.0.0.0:*    systemd
LISTEN 0      100        127.0.0.1:8443      0.0.0.0:*    java
LISTEN 0      511             [::]:443          [::]:*    nginx
LISTEN 0      511             [::]:80           [::]:*    nginx
LISTEN 0      4096            [::]:22           [::]:*    systemd

The OFBiz data volume is mounted at /var/lib/ofbiz:

df -h /var/lib/ofbiz | tail -1

/dev/nvme1n1     20G   80M   19G   1% /var/lib/ofbiz

Step 4: Get your URL and password

sudo grep -E '^OFBIZ_(URL|ADMIN_USER|ADMIN_PASSWORD)=' /root/ofbiz-credentials.txt

OFBIZ_URL=https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/
OFBIZ_ADMIN_USER=admin
OFBIZ_ADMIN_PASSWORD=<OFBIZ_ADMIN_PASSWORD>

The URL uses your instance's public DNS name (or its public IP address when the VPC has no DNS host names). The same file also records the instance's internal keys; you never need to type those.

Step 5: Sign in from your browser

Open https://<your OFBiz URL>/partymgr/control/main (or /accounting, /ordermgr, /catalog, /webtools). Your browser warns about the self-signed certificate the instance generated on first boot; accept it for now and replace it with your own in Step 8. Sign in as admin with the password from Step 4.

Each OFBiz application has its own sign in; once you are signed in, the menu at the top moves between them without asking again.

Step 6: Find your way around

The Party application manages customers, suppliers, employees and their contact details:

Accounting covers invoices, payments, billing accounts, the general ledger and fixed assets:

Catalog holds catalogs, categories, products, features, promotions and price rules:

Web Tools is the administrator's console for the entity engine, the service engine, data import and export, caches and logs:

The database starts with OFBiz's seed data only (reference data such as currencies, countries, units and status codes) and no sample companies, products or orders. A typical first setup is: create your organisation as a party group, set it up under Accounting > Organization GL Settings, create a product store and catalog under Catalog, then create users under Party and give them security groups. The Web Tools main page says "try username: admin, password: ofbiz"; that is OFBiz's own help text, and no such login exists on this image.

Step 7: Security checks

Port 80 sends browsers to HTTPS, OFBiz answers over HTTPS, the refused endpoints return 404 and nginx closes the connection for a host name the instance does not serve (000 means no answer):

H=$(sudo sed -n 's#^OFBIZ_URL=https://\([^/]*\)/.*#\1#p' /root/ofbiz-credentials.txt)
curl -s -o /dev/null -w 'port 80: %{http_code} -> %{redirect_url}\n' --resolve "$H:80:127.0.0.1" "http://$H/webtools/control/main"
curl -sk -o /dev/null -w 'login page: %{http_code}\n' --resolve "$H:443:127.0.0.1" "https://$H/webtools/control/login"
for u in /webtools/control/xmlrpc /webtools/control/SOAPService /webtools/control/ProgramExport /partymgr/control/forgotPassword; do
  curl -sk -o /dev/null -w "$u: %{http_code}\n" --resolve "$H:443:127.0.0.1" "https://$H$u"
done
curl -s -o /dev/null -w 'unknown host name: %{http_code}\n' -H 'Host: example.com' http://127.0.0.1/ || true

port 80: 301 -> https://ec2-<public-ip-dashed>.compute-1.amazonaws.com/webtools/control/main
login page: 200
/webtools/control/xmlrpc: 404
/webtools/control/SOAPService: 404
/webtools/control/ProgramExport: 404
/partymgr/control/forgotPassword: 404
unknown host name: 000

The old demo login is refused by OFBiz itself, and the administrator can sign in from the command line too. The password is passed to curl from a file, so it never appears on a command line:

H=$(sudo sed -n 's#^OFBIZ_URL=https://\([^/]*\)/.*#\1#p' /root/ofbiz-credentials.txt)
PWF=$(mktemp); OLD=$(mktemp); JAR=$(mktemp)
sudo sed -n 's/^OFBIZ_ADMIN_PASSWORD=//p' /root/ofbiz-credentials.txt | tr -d '\n' > "$PWF"; printf ofbiz > "$OLD"
try() { : > "$JAR"; curl -sk --resolve "$H:443:127.0.0.1" -c "$JAR" -b "$JAR" -o /dev/null "https://$H/webtools/control/login"
        curl -sk --resolve "$H:443:127.0.0.1" -c "$JAR" -b "$JAR" --data-urlencode "USERNAME=$1" --data-urlencode "PASSWORD@$2" --data JavaScriptEnabled=Y "https://$H/webtools/control/login"; }
try admin "$OLD" | grep -oE 'Password incorrect|User not found' | head -1 | sed 's/^/admin + ofbiz: /'
try flexadmin "$OLD" | grep -oE 'Password incorrect|User not found' | head -1 | sed 's/^/flexadmin + ofbiz: /'
try admin "$PWF" | grep -qi 'logout' && echo 'admin + instance password: signed in'
rm -f "$PWF" "$OLD" "$JAR"

admin + ofbiz: Password incorrect
flexadmin + ofbiz: User not found
admin + instance password: signed in

OFBiz, nginx and the first boot service are blocked from the instance metadata service:

systemctl show -p IPAddressDeny ofbiz nginx apache-ofbiz-firstboot | grep -c '169.254.169.254'
sudo journalctl -u apache-ofbiz-firstboot --no-pager | grep -o 'imds-egress: blocked.*' | tail -1

3
imds-egress: blocked (169.254.169.254 unreachable from apache-ofbiz-firstboot.service)

The patched libraries are on the class path; the full list with checksums is in the inventory file:

grep -E '^(org.apache.tomcat:tomcat-catalina|com.fasterxml.jackson.core:jackson-databind|org.freemarker:freemarker|org.apache.logging.log4j:log4j-core|org.apache.cxf:cxf-core):' /usr/share/doc/cloudimg/ofbiz-runtime-jars.txt | cut -d' ' -f1

com.fasterxml.jackson.core:jackson-databind:2.21.7
org.apache.cxf:cxf-core:3.6.12
org.apache.logging.log4j:log4j-core:2.25.5
org.apache.tomcat:tomcat-catalina:9.0.121
org.freemarker:freemarker:2.3.35

Step 8: Your own DNS name and certificate

Point a DNS name at the instance (an Elastic IP keeps the address stable), then tell OFBiz about it. The helper generates a new self-signed certificate for the name, pins it in nginx, adds it to OFBiz's allowed host list and restarts the services:

sudo ofbiz-set-hostname erp.example.com

To use a certificate your browsers trust, replace /etc/nginx/ssl/ofbiz.crt and /etc/nginx/ssl/ofbiz.key with your certificate chain and key (for example from your certificate authority or certbot with a DNS challenge) and run sudo systemctl reload nginx. The name is kept in /etc/cloudimg/ofbiz-hostname.

Step 9: The administrator password

To set a new random administrator password (recorded in /root/ofbiz-credentials.txt):

sudo ofbiz-set-password

To choose your own (16 to 64 letters and digits), pass it on standard input so it never appears on a command line:

read -rs NEWPW && printf '%s\n' "$NEWPW" | sudo ofbiz-set-password --stdin; unset NEWPW

The helper briefly stops OFBiz (the embedded database allows one process at a time) and starts it again. Users can change their own passwords in OFBiz from the user menu. OFBiz's forgot password page is refused on this image, because it emails a reset to anyone who knows a user name; reset a forgotten password as the administrator instead (Party > Find Party > the user > User Login > Change password).

Step 10: What is switched off, and why

• XML-RPC, SOAPService and ProgramExport. These endpoints were the entry points of OFBiz's pre-authentication remote code execution vulnerabilities (CVE-2023-49070, CVE-2023-51467, CVE-2024-32113, CVE-2024-38856, CVE-2024-45195 and others). nginx refuses them in any spelling, and SOAPService and ProgramExport are removed from the Web Tools controller. If you need SOAP or REST integration, use OFBiz's REST API plugin (/rest), which authenticates with tokens signed by your instance's own key.
• The AJP connector and the admin port. A stock OFBiz opens AJP on port 8009 on every interface with no secret, and an admin socket on 10523 with a key printed in its configuration. Both are removed; systemd stops OFBiz cleanly.
• The example, exampleext and LDAP plugins. The example plugins are developer samples. The LDAP plugin is an optional authenticator that is inactive until configured and pulls in an older CAS and Spring stack with known vulnerabilities. Re-enabling a plugin means setting enabled="true" in /opt/ofbiz/plugins/<name>/ofbiz-component.xml and rebuilding OFBiz with a JDK and Gradle, which this image does not include.

Step 11: Data, backups and logs

The simplest consistent backup is an EBS snapshot of the data volume. For a file level copy, stop OFBiz first, because Derby is an embedded database:

sudo systemctl stop ofbiz
sudo tar -C /var/lib/ofbiz -czf /root/ofbiz-runtime-$(date +%F).tar.gz runtime
sudo systemctl start ofbiz

Embedded Derby suits evaluation, small teams and single instance use. For heavier production use, OFBiz supports PostgreSQL and MySQL through framework/entity/config/entityengine.xml; see the OFBiz documentation for moving the data across.

Step 12: Security recommendations

• Allow port 22 from your admin network only, and ports 80 and 443 only from the networks your users work from.
• Use your own DNS name and a certificate your browsers trust (Step 8).
• Create a named user for each person with the security groups their job needs, and keep admin for administration.
• Change the admin password if it may have been shared (Step 9), keep the operating system patched, and snapshot the data volume regularly.
• Follow the Apache OFBiz security page (https://ofbiz.apache.org/security.html) and move to newer cloudimg versions as OFBiz releases fixes.

Support and licensing

Apache OFBiz is open source software licensed under the Apache License 2.0 (/usr/share/doc/apache-ofbiz/LICENSE); cloudimg builds the official release with patched library versions and a hardened configuration. There is no per user licence fee. The AMI price covers cloudimg's hardening, first boot setup and support. Apache, Apache OFBiz and OFBiz are trademarks of The Apache Software Foundation; cloudimg is not affiliated with or endorsed by The Apache Software Foundation.

• Email: support@cloudimg.co.uk
• Website: https://www.cloudimg.co.uk
• Support: 24/7, with a 24 hour response SLA