elFinder 2.1.70 Web File Manager on AWS User Guide

Overview

This guide covers launching and using the elFinder 2.1.70 Web File Manager on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg file sharing and sync listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

elFinder is an open source web file manager with a desktop style interface: a folder tree on the left, your files on the right, drag and drop uploads, right click menus, quick look previews of images, text and PDF files, search, copy, cut and paste, rename, duplicate, zip archives (create and extract) and image resize and rotate, all in the browser.

The cloudimg image locks elFinder down:

• HTTPS from the first boot. nginx serves elFinder on port 443 with a certificate generated on your instance's first boot. Port 80 redirects to HTTPS, and requests for a host name the instance does not serve are dropped.
• A sign in on everything, with a password unique to your instance. HTTP Basic authentication protects the whole application: the page, its scripts and the PHP connector that performs every file operation. The image ships with no password at all; first boot generates one (stored as a bcrypt hash) and writes it to /root/elfinder-credentials.txt (root only). The site is not served until that has happened.
• Uploads can never run. Your files live on a dedicated data volume, outside the web server's document root, and are only ever returned through the signed in connector; the web server cannot even read them directly. PHP files, shell scripts and executables are refused on upload, by type and by name, including inside zip archives you extract.
• No network features. elFinder can mount remote storage (FTP, Dropbox, Google Drive and others) and fetch files from a URL you paste. On this image those features are removed or switched off, and PHP is blocked at the kernel level from opening any network connection except to the instance itself, so the file manager can never be used to reach other servers or the EC2 instance metadata service.
• Cross site requests are refused. Browsers resend a Basic sign in automatically, so another website could otherwise make your browser delete or rename files. Every file operation refuses a request that does not come from the file manager's own page, and elFinder 2.1.70 adds its own per session token on top.
• Fully patched Ubuntu 24.04 LTS at build time, PHP 8.3 with the latest security fixes, and unattended security upgrades switched on.

What is on the image: elFinder 2.1.70 (BSD-3-Clause) with jQuery 4.0.0 and jQuery UI 1.14.2 served from the instance, PHP 8.3 (FPM), nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent. The licences and exact sources are in /usr/share/doc/elfinder/.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet.
• A security group that allows TCP 22 (SSH), TCP 443 (the file manager) and TCP 80 (redirects to HTTPS) from your own networks only.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick elFinder 2.1.70 Web File Manager on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair, a security group as above, and a subnet. The AMI brings an 8 GiB root volume and a separate 20 GiB data volume that holds your files; raise the data volume under Configure storage if you need more space (you can also grow it later, see Step 9).

With the AWS CLI (replace the values in angle brackets; this sets the data volume to 100 GiB):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=elfinder}]'

Step 2: Connect to your instance

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot generates the certificate and the password, then starts the site. It takes a few seconds:

systemctl is-active elfinder-host elfinder-firstboot php8.3-fpm nginx

active
active
active
active

Only SSH (22) and nginx (80, 443) listen on the network; PHP talks to nginx over a local socket, and the two loopback entries are Ubuntu's local DNS resolver:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22
0.0.0.0:443
0.0.0.0:80
127.0.0.53%lo:53
127.0.0.54:53
[::]:22
[::]:443
[::]:80

The health helper checks that the site answers and that it demands a sign in:

sudo /usr/local/sbin/elfinder-health

PRIMARY_HEALTH_OK https://ec2-203-0-113-10.compute-1.amazonaws.com/ (healthz 200, UI 401 without credentials)

If nginx is not running, first boot has not finished (or failed, in which case the site is never served). Check systemctl status elfinder-host elfinder-firstboot and journalctl -u elfinder-firstboot.

Step 4: Get your URL and password

sudo cat /root/elfinder-credentials.txt

The file is readable by root only and holds the address and this instance's sign in:

# elFinder 2.1.70 Web File Manager - generated on first boot by elfinder-firstboot.service
# This password is unique to this instance; none was baked into the image. Keep this file secret.

ELFINDER_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/
ELFINDER_ADMIN_USER=admin
ELFINDER_ADMIN_PASSWORD=<ELFINDER_ADMIN_PASSWORD>
...

You can confirm the sign in from the instance itself. The helper checks the redirect, that an unauthenticated request is refused, that the password opens the page and the connector, and that a wrong password and common defaults are refused:

sudo /usr/local/sbin/elfinder-cred-roundtrip

OK https 301 + unauthenticated 401 + admin opens UI and connector (API 2.1070) + wrong and default passwords refused

The connector reports elFinder's API version, 2.1070 for elFinder 2.1.70.

Step 5: Sign in

Open the ELFINDER_URL address in your browser. The certificate is self signed until you install your own (Step 8), so the browser asks you to accept it once; compare the fingerprint it shows with the one on the instance:

sudo openssl x509 -in /etc/nginx/ssl/elfinder.crt -noout -fingerprint -sha256

Sign in as admin with the password from Step 4. The file manager opens on the Files volume, which starts with a few sample files you can delete:

Change the password to one of your own whenever you like (16 to 128 characters, no spaces). The helper reads it from standard input, so it never appears in your shell history or the process list, and updates the credentials file:

sudo elfinder-set-password --stdin

Run sudo elfinder-set-password without --stdin to generate a new random password instead. Your browser then asks you to sign in again.

Step 6: Manage your files

Drag files from your desktop into the window to upload them, or use the upload button in the toolbar. Double click a folder to open it, and select a file and press Space for a quick look:

Right click a file or folder for every action: open, download, preview, copy, cut, duplicate, delete, rename, resize and rotate an image, create a zip archive or extract one, and get info:

Things to know:

• Archives are zip. Archives are created and extracted by PHP itself, so zip is the format available. When an archive holds a PHP file, script or executable, those items are refused and the rest is extracted.
• Refused uploads. PHP files (.php, .phtml, .phar and similar), shell, Perl and Python scripts, .htaccess / .user.ini files and executables are refused. Every other type uploads normally, up to 2 GB per file (large files go up in chunks).
• Web pages download. HTML and SVG files are offered as downloads rather than opened in the browser, so a page you store cannot run as part of the file manager.
• No URL upload or network drives. Pasting a web address to fetch a file, and mounting FTP, SFTP or cloud storage, are not available on this image.
• Direct links. A download link copied into a new browser tab's address bar is refused (it carries no proof that it came from the file manager page); use the Download action instead.

Step 7: Where your files live

Your files are in /var/lib/elfinder/files on the data volume, owned by the unprivileged elfinder account that PHP runs as:

sudo ls -la /var/lib/elfinder/files

To copy files in or out over SSH, write them as that account so the file manager can manage them, for example:

sudo -u elfinder cp /home/ubuntu/report.pdf /var/lib/elfinder/files/Documents/

Step 8: Use your own host name and certificate

Point a DNS record at the instance (an Elastic IP keeps the address across stop and start), then tell the instance its name. This mints a new self signed certificate for that name, updates the nginx host rule, the cross site guard and the address in the credentials file, and keeps the name across reboots:

sudo elfinder-set-hostname files.example.com

To use a certificate from a public authority instead, replace /etc/nginx/ssl/elfinder.crt (full chain) and /etc/nginx/ssl/elfinder.key (mode 0600, owned by root) with your own and run sudo systemctl reload nginx. Running elfinder-set-hostname again later would replace them with a new self signed pair. Basic authentication sends the password with every request, so keep the site on HTTPS.

Step 9: Check persistence, storage and updates

Every service is enabled, so elFinder returns after a reboot or a stop and start; your files and the password stay as they are. Unattended security upgrades keep the operating system, PHP and nginx patched:

systemctl is-enabled nginx php8.3-fpm unattended-upgrades

enabled
enabled
enabled

The data volume is mounted by its file system UUID. To grow it, enlarge the EBS volume in the EC2 console and then extend the file system online:

sudo resize2fs $(findmnt -no SOURCE /var/lib/elfinder)

To back up your files, take an EBS snapshot of the data volume (or use AWS Backup on the instance). elFinder itself is the release from the project's GitHub repository; cloudimg publishes a new version of the image when a newer elFinder release is available.

Security notes

• No shared secret ships in the image. No password, password hash, TLS key or credentials file exists until your instance's first boot generates them, and nginx refuses to start until that has finished.
• Fail closed. If first boot cannot complete, nothing is served. The PHP connector also refuses to work if it is ever reached without a signed in user.
• PHP is confined. It runs as the elfinder account, can write only the file tree and its own working folder, cannot run other programs, cannot open URLs and cannot connect anywhere except the instance itself; the code of the file manager is owned by root and read only to it. Sessions are kept in memory, never on disk.
• Metadata service blocked. nginx, PHP and the first boot step that writes your password are blocked from the EC2 instance metadata service; only the step that looks up the instance's public name uses it (IMDSv2).
• Security fixes. elFinder 2.1.70 fixes the zip extraction and URL upload issues published with it (GHSA-gxmj-r5rf-ggwq, GHSA-8x3q-jpjh-qh5c) and a CSRF issue in network mounting (GHSA-9hjf-w35w-6vx2); the network mount and URL upload features are switched off here in any case.
• Restrict 22/tcp to your management network, and 80/443 to the networks that use the file manager.

Architecture summary

Support

cloudimg images come with 24/7 support. Email support@cloudimg.co.uk with your AWS account ID and the instance ID. For elFinder itself, see the elFinder project on GitHub.

elFinder is an open source project of Studio 42. cloudimg is not affiliated with or endorsed by the elFinder project or Studio 42.