elFinder on Ubuntu 24.04 on Azure User Guide

Overview

elFinder is a long established open source web file manager that brings a familiar desktop style file browser to the browser. Its two pane interface gives you a folder tree beside a file list, with the operations you expect from a desktop file manager: upload and download, rename, copy, move, search, preview images and text, and create or extract archives, all without leaving the page. The cloudimg image serves elFinder 2.1.69 through nginx and PHP 8.3 FPM on a hardened, fully patched Ubuntu 24.04 LTS base.

elFinder is distributed as a library rather than a finished application: upstream ships a demo connector and no authentication at all. This image closes that gap before the VM is ever reachable. Authentication is enforced by nginx across the entire application, including the PHP connector that performs the actual filesystem operations, so there is no unauthenticated route to your files. A unique administrator password is generated on the first boot of every VM and written to a root only file, so no shared or default login ever ships in the image. Backed by 24/7 cloudimg support.

What is included:

• elFinder 2.1.69 served by nginx and PHP 8.3 FPM, managed by systemd
• HTTP Basic authentication enforced on every path, including the php/connector.php endpoint
• A per VM administrator password generated on first boot and recorded in a root only file
• A connector locked to a single volume, so there is no route from the interface to the wider filesystem
• Uploaded files stored outside the web document root and served back as inert downloads, so an uploaded script can never be executed
• Cross site request forgery protection on every write command, enforced by the connector
• jQuery and jQuery UI vendored locally, so the interface has no runtime dependency on a public content delivery network
• A dedicated Azure data disk at /data holding the managed file tree at /data/elfinder/files
• nginx.service, php8.3-fpm.service and elfinder-firstboot.service as enabled systemd units
• An open /healthz endpoint for Azure Load Balancer health probes
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_D2s_v3 (2 vCPU / 8 GiB RAM) is a sensible starting point; size up for heavier concurrent transfer loads. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web interface. The image serves plain HTTP on port 80 by default. Because HTTP Basic authentication sends the password in an easily decoded header, enable TLS before exposing the instance to the public internet, as described in Step 9.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for elFinder by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name elfinder \
  --image <marketplace-image-urn> \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the web interface:

az vm open-port --resource-group <your-rg> --name elfinder --port 80

Find the public address to browse to:

az vm show --resource-group <your-rg> --name elfinder --show-details --query publicIps -o tsv

Step 3 - Connect and confirm the services are running

SSH in as azureuser:

ssh azureuser@<vm-public-ip>

Confirm nginx, PHP FPM and the first boot unit are all active, and that nginx is listening on port 80:

systemctl is-active nginx php8.3-fpm elfinder-firstboot

Expected output:

active
active
active

ss -tlnp | grep ':80 ' | sed 's/  */ /g'

Step 4 - Retrieve the per VM administrator password

Every VM generates its own administrator password on first boot and writes it, along with the login user and the managed root, to a root only credentials file. Read it with sudo:

sudo cat /root/elfinder-credentials.txt

You sign in with username admin and the ELFINDER_ADMIN_PASSWORD value from this file.

Note that the ELFINDER_URL line records the address the VM sees itself on. Azure does not expose a Standard SKU public IP through the instance metadata service, so on those VMs this line shows the private address. Browse to the public address from Step 2 instead.

Step 5 - Confirm authentication is enforced

This is the property that matters most on a file manager: nothing is reachable without credentials. Confirm that an unauthenticated request to both the interface and the connector is refused with 401, while the health probe endpoint stays open for Azure Load Balancer:

curl -s -o /dev/null -w 'unauthenticated interface -> HTTP %{http_code}\n' http://127.0.0.1/

curl -s -o /dev/null -w 'unauthenticated connector -> HTTP %{http_code}\n' 'http://127.0.0.1/php/connector.php?cmd=open&target=&init=1'

curl -s -o /dev/null -w 'health probe -> HTTP %{http_code}\n' http://127.0.0.1/healthz

Expected output:

unauthenticated interface -> HTTP 401
unauthenticated connector -> HTTP 401
health probe -> HTTP 200

Now confirm the per VM password does authenticate:

curl -s -o /dev/null -w 'authenticated interface -> HTTP %{http_code}\n' -u 'admin:<ELFINDER_ADMIN_PASSWORD>' http://127.0.0.1/

Expected output:

authenticated interface -> HTTP 200

Step 6 - Sign in to elFinder

Browse to http://<vm-public-ip>/. Your browser prompts for a username and password with a native sign in dialog. Enter admin and the password from Step 4. Nothing is served until you do, including the connector, so there is no way to reach the file tree without these credentials.

Once authenticated, elFinder opens on its two pane interface: the folder tree on the left, the file list on the right, and the toolbar across the top.

Step 7 - Upload and organise files

Use the toolbar to upload files, or drag them straight onto the file list. Select any item to rename, copy, move, download or delete it, and use the archive commands to create or extract a zip or tar. Every write command is protected against cross site request forgery by the connector, so a request that did not originate in your authenticated session is refused.

Select a file and open it to preview its contents in place, without downloading it first.

Everything you manage in the interface lives under the managed root on the dedicated data disk. Confirm it from the shell:

sudo ls -la /data/elfinder/files

Step 8 - Where your data lives

The managed file tree lives on a dedicated Azure data disk mounted at /data, separate from the OS disk. This disk is captured into the image and re provisioned on every VM. Confirm the mount and the filesystem:

df -h /data | tail -1

findmnt -no SOURCE,TARGET,FSTYPE /data

This reports the backing device, the /data mount point and the ext4 filesystem. The device node itself varies with the VM size you chose, so the mount is keyed by filesystem UUID in /etc/fstab rather than by device name.

The managed root sits outside the nginx document root, which is why an uploaded file can never be executed by the web server. Confirm the elFinder release and that all three units are enabled to start on boot:

grep -m1 '"version"' /var/www/elfinder/package.json

systemctl is-enabled nginx php8.3-fpm elfinder-firstboot

Step 9 - Enable HTTPS with Let's Encrypt

HTTP Basic authentication sends your password in an easily decoded header, so it must not be used over plain HTTP on an untrusted network. Before exposing this instance to the public internet, point a DNS name at the VM, open port 443 in the NSG, and issue a certificate. Run these on the VM, replacing the placeholders with your own domain and email:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-nginx
sudo certbot --nginx -d your-domain.example.com -m you@example.com --agree-tos --redirect --non-interactive

Certbot edits the nginx server block in place, keeps the existing authentication stanza, and installs a renewal timer. After it completes, browse to https://your-domain.example.com/.

Step 10 - Change the administrator password

The credential is an nginx htpasswd entry. To set your own password, run htpasswd and reload nginx:

sudo htpasswd -B /etc/nginx/.htpasswd-elfinder admin
sudo systemctl reload nginx

To add a second account, use the same command with a different username. Every account listed in the file has the same access to the managed tree, so create them only for people you intend to give full access.

Server components

Filesystem layout

Managing the service

systemctl status nginx --no-pager | head -3

sudo systemctl restart nginx php8.3-fpm
sudo journalctl -u nginx -n 50 --no-pager

Troubleshooting

The browser keeps asking for a password. The password is the ELFINDER_ADMIN_PASSWORD value in /root/elfinder-credentials.txt, and the username is admin. If you have lost it, set a new one with sudo htpasswd -B /etc/nginx/.htpasswd-elfinder admin followed by sudo systemctl reload nginx.

The interface loads but the file list stays empty or shows an error. That points at the connector rather than the web server. Check the PHP FPM log with sudo journalctl -u php8.3-fpm -n 50 --no-pager, and confirm the managed root exists and is owned by the web user with sudo ls -ld /data/elfinder/files.

Uploads fail for large files. The image allows uploads up to 512 MB. To raise it, edit upload_max_filesize and post_max_size in /etc/php/8.3/fpm/conf.d/99-elfinder.ini, raise client_max_body_size in the nginx server block to match, then restart both services.

The health probe returns 401. The /healthz endpoint is the single deliberately unauthenticated path. If it is prompting for credentials, the server block has been edited; compare it against /etc/nginx/sites-available/cloudimg-elfinder and run sudo nginx -t.

Security notes

• Authentication is enforced by nginx on every path except /healthz, including the connector endpoint that performs filesystem operations. There is no unauthenticated route to your files.
• The image serves plain HTTP by default. Enable TLS as described in Step 9 before exposing the instance to the public internet, and restrict port 80 in the NSG to trusted networks in the meantime.
• The per VM administrator password lives in /root/elfinder-credentials.txt, readable only by root. Keep a copy somewhere safe and change it to a password of your own with htpasswd.
• The connector is locked to a single volume rooted at /data/elfinder/files, and the commands that could attach another volume are disabled, so there is no route from the interface to the wider filesystem.
• Uploaded files are stored outside the web document root and served back with Content-Disposition: attachment and X-Content-Type-Options: nosniff, so an uploaded script cannot be executed by the web server.
• Everyone listed in the htpasswd file has full access to the managed tree. Give out accounts accordingly, and use a separate instance where you need genuinely isolated storage.
• Keep the VM patched. The image ships fully patched with unattended security upgrades enabled.

Support

cloudimg images come with 24/7 support. If you have any questions about this elFinder image or need help with your deployment, contact us through the cloudimg website.