FileGator 7.16.8 on AWS User Guide

Overview

This guide covers launching and using the FileGator 7.16.8 on Ubuntu 24.04 AMI from cloudimg on Amazon EC2. It is one version of the cloudimg file sharing and sync listing on AWS Marketplace; you pick it as the software version when you subscribe and launch.

FileGator is an open source, multi-user web file manager. In the browser your team can upload files (large files go up in resumable chunks, folders by drag and drop), download them singly or several at once as a zip, copy, move, rename, zip and unzip, edit text files and search. An administrator creates users, gives each one a home folder and chooses what they may do (read, write, upload, download, batch download, zip). There is no database to run: files live on the file system and users in a small JSON file.

The cloudimg image locks FileGator down:

• No default administrator password. Upstream FileGator ships a well known admin / admin123 account. This image ships no user store at all: first boot creates the admin account with a password unique to your instance (stored as a bcrypt hash) and writes it to /root/filegator-credentials.txt (root only). The site is not served until that has happened, and anonymous visitors get no permissions at all.
• HTTPS from the first boot. nginx serves FileGator on port 443 with a certificate generated on your instance's first boot. Port 80 redirects to HTTPS, and requests for a host name the instance does not serve are dropped.
• Brute force protection. After five failed sign ins from one address, that address must wait five minutes. The session cookie is Secure, HttpOnly and SameSite=Strict, and a new session id is issued at every sign in.
• Uploads can never run. Your files live on a dedicated data volume (mounted noexec), outside the web server's document root, and are only ever returned through FileGator's signed in download, as attachments. The web server cannot even read them directly. PHP files, scripts and hidden dot files are refused as upload, folder, rename, archive and save names.
• Cross site requests are refused. Every FileGator request refuses a call that does not come from FileGator's own page, and every change additionally needs FileGator's per session token, so another website cannot make your browser download, delete or change files.
• No network access for PHP. FileGator needs none, so PHP is blocked at the kernel level from opening any network connection except to the instance itself, including the EC2 instance metadata service.
• Fully patched Ubuntu 24.04 LTS at build time, PHP 8.3 with the latest security fixes, and unattended security upgrades switched on.

What is on the image: FileGator 7.16.8 (MIT; the project's own release build, verified against the v7.16.8 source tag), PHP 8.3 (FPM), nginx, Ubuntu 24.04 LTS, cloud-init and the AWS Systems Manager agent. The licence, change log and exact sources are in /usr/share/doc/filegator/.

Default user: ubuntu · Architecture: x86_64 · Recommended instance type: m5.large

Prerequisites

• An AWS account subscribed to the listing, an EC2 key pair and a VPC subnet.
• A security group that allows TCP 22 (SSH), TCP 443 (FileGator) and TCP 80 (redirects to HTTPS) from your own networks only.

Step 1: Launch the instance

In the AWS Marketplace listing choose Continue to Subscribe, then Continue to Configuration, pick FileGator 7.16.8 on Ubuntu 24.04 as the software version and your Region, then Launch through EC2. Choose m5.large, your key pair, a security group as above, and a subnet. The AMI brings an 8 GiB root volume and a separate 20 GiB data volume that holds your files; raise the data volume under Configure storage if you need more space (you can also grow it later, see Step 9).

With the AWS CLI (replace the values in angle brackets; this sets the data volume to 100 GiB):

aws ec2 run-instances --region <region> --image-id <ami-id-from-the-listing> \
  --instance-type m5.large --key-name <your-key-pair> \
  --security-group-ids <your-security-group> --subnet-id <your-subnet> \
  --metadata-options HttpTokens=required,HttpEndpoint=enabled \
  --block-device-mappings 'DeviceName=/dev/sdf,Ebs={VolumeSize=100,VolumeType=gp3}' \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=filegator}]'

Step 2: Connect to your instance

ssh -i <your-key.pem> ubuntu@<public-ip>

Step 3: Check the services

First boot generates the certificate, creates the administrator and starts the site. It takes a few seconds:

systemctl is-active filegator-host filegator-firstboot php8.3-fpm nginx

active
active
active
active

Only SSH (22) and nginx (80, 443) listen on the network; PHP talks to nginx over a local socket, and the two loopback entries are Ubuntu's local DNS resolver:

sudo ss -lntp | awk 'NR>1 {print $4}' | sort -u

0.0.0.0:22
0.0.0.0:443
0.0.0.0:80
127.0.0.53%lo:53
127.0.0.54:53
[::]:22
[::]:443
[::]:80

The health helper checks that the site answers and that an anonymous visitor is the powerless guest:

sudo /usr/local/sbin/filegator-health

PRIMARY_HEALTH_OK https://ec2-203-0-113-10.compute-1.amazonaws.com/ (healthz 200, page 200, anonymous = guest)

If nginx is not running, first boot has not finished (or failed, in which case the site is never served). Check systemctl status filegator-host filegator-firstboot and journalctl -u filegator-firstboot.

Step 4: Get your URL and password

sudo cat /root/filegator-credentials.txt

The file is readable by root only and holds the address and this instance's administrator sign in:

# FileGator 7.16.8 - generated on first boot by filegator-firstboot.service
# This password is unique to this instance; none was baked into the image. Keep this file secret.

FILEGATOR_URL=https://ec2-203-0-113-10.compute-1.amazonaws.com/
FILEGATOR_ADMIN_USER=admin
FILEGATOR_ADMIN_PASSWORD=<FILEGATOR_ADMIN_PASSWORD>
...

You can confirm the sign in from the instance itself. The helper checks the redirect, that an anonymous visitor has no permissions, that the password signs in through FileGator's own login and lists your files, and that a wrong password, the upstream default admin123 and the guest account are refused:

sudo /usr/local/sbin/filegator-cred-roundtrip

OK https 301 + anonymous = powerless guest + admin signs in and lists the repository + wrong, admin123 and guest refused

Step 5: Sign in

Open the FILEGATOR_URL address in your browser. The certificate is self signed until you install your own (Step 8), so the browser asks you to accept it once; compare the fingerprint it shows with the one on the instance:

sudo openssl x509 -in /etc/nginx/ssl/filegator.crt -noout -fingerprint -sha256

Sign in as admin with the password from Step 4:

FileGator opens on your file repository, which starts with a few sample files you can delete:

Change the administrator password to one of your own whenever you like: in FileGator click Administrator (top right) and change it there, or on the instance (16 to 128 characters, no spaces; the helper reads it from standard input, so it never appears in your shell history or the process list, and updates the credentials file):

sudo filegator-set-password --stdin

Run sudo filegator-set-password without --stdin to generate a new random password instead. Sessions signed in with the old password are signed out.

Step 6: Manage files and users

Click Add files (or drag files and folders onto the window) to upload. Select files to copy, move, rename, zip, unzip, download or delete them; select several and choose Download to get them as one zip archive. Text files open in the built in editor.

As admin, open Users to add people. Each user gets a home folder (they see only that folder and what is below it) and the permissions you tick. The guest account stands for visitors who are not signed in; leave its permissions empty to keep the site private:

Things to know:

• Refused names. PHP files (.php, .phtml, .phar and similar), shell, Perl, Python and Ruby scripts, .htaccess / .user.ini files and names that start with a dot are refused when you upload, create, rename, zip or save. Every other type uploads normally, up to 1 GiB per file.
• Downloads. Files are offered as downloads (PDF files open in the browser), so a web page you store cannot run as part of FileGator.
• Unzip. FileGator 7.16.8 reports "Failed" after every unzip even when it worked (an upstream quirk); refresh the folder to see the extracted files.
• Direct links. A FileGator download link pasted into a new browser tab's address bar is refused (it carries no proof that it came from FileGator's page); use the Download action instead.

Step 7: Where your files live

Your files are in /var/lib/filegator/repository on the data volume, owned by the unprivileged filegator account that PHP runs as; each user's home folder is a folder inside it:

sudo ls -la /var/lib/filegator/repository

To copy files in or out over SSH, write them as that account so FileGator can manage them, for example:

sudo -u filegator cp /home/ubuntu/report.pdf /var/lib/filegator/repository/Documents/

The users (with bcrypt password hashes) are in /var/lib/filegator/users/users.json, readable only by filegator. FileGator's sign in log is /var/www/filegator/private/logs/app.log.

Step 8: Use your own host name and certificate

Point a DNS record at the instance (an Elastic IP keeps the address across stop and start), then tell the instance its name. This mints a new self signed certificate for that name, updates the nginx host rule, the cross site guard and the address in the credentials file, and keeps the name across reboots:

sudo filegator-set-hostname files.example.com

To use a certificate from a public authority instead, replace /etc/nginx/ssl/filegator.crt (full chain) and /etc/nginx/ssl/filegator.key (mode 0600, owned by root) with your own and run sudo systemctl reload nginx. Running filegator-set-hostname again later would replace them with a new self signed pair.

Step 9: Check persistence, storage and updates

Every service is enabled, so FileGator returns after a reboot or a stop and start; your files, users and passwords stay as they are. Unattended security upgrades keep the operating system, PHP and nginx patched:

systemctl is-enabled nginx php8.3-fpm unattended-upgrades

enabled
enabled
enabled

The data volume is mounted by its file system UUID. To grow it, enlarge the EBS volume in the EC2 console and then extend the file system online:

sudo resize2fs $(findmnt -no SOURCE /var/lib/filegator)

To back up your files and users, take an EBS snapshot of the data volume (or use AWS Backup on the instance). cloudimg publishes a new version of the image when a newer FileGator release is available.

Security notes

• No shared secret ships in the image. No user store, password, password hash, TLS key or credentials file exists until your instance's first boot generates them, and nginx refuses to start until that has finished. The upstream default admin / admin123 account does not exist anywhere on the image.
• Fail closed. If first boot cannot complete, nothing is served. FileGator cannot recreate a default user store: the folder that holds it is owned by root.
• PHP is confined. It runs as the filegator account, can write only your files, its working folder, the user store and its log, cannot run other programs, cannot open URLs and cannot connect anywhere except the instance itself; FileGator's code is owned by root and read only to it. Sessions are kept in memory, never on disk.
• Metadata service blocked. nginx, PHP and the first boot step that creates your administrator are blocked from the EC2 instance metadata service; only the step that looks up the instance's public name uses it (IMDSv2).
• Security fixes. FileGator 7.16.8 includes the fixes for GHSA-f74m-x83r-c4v4 (another user's batch download) and GHSA-44r8-3p76-84mw (another user's upload chunks), both tested on this image with two ordinary users, and for the LDAP issues GHSA-h3qf-hr78-8c64 and GHSA-4r6c-gx7v-584w (this image signs in against its JSON user store, not LDAP). The PHP issue in FileGator's Docker image (GHSA-c2f4-g7pq-3p3f, CVE-2026-109618 and CVE-2026-109619) does not apply: this image runs Ubuntu's PHP 8.3, which carries both fixes.
• Known residual findings, not reachable here. FileGator 7.16.8 pins Flysystem 1.1.10, which has one low severity advisory (GHSA-cxf4-7mrp-vvpr, a file name check that malformed UTF-8 can bypass; no path escape). Its prebuilt browser bundle contains older axios, lodash and moment releases with published advisories; those affect Node.js servers, functions FileGator does not call, or need a separate script injection, and the image's content security policy limits the page to its own site.
• Restrict 22/tcp to your management network, and 80/443 to the networks that use FileGator.

Architecture summary

Support

cloudimg images come with 24/7 support. Email support@cloudimg.co.uk with your AWS account ID and the instance ID. For FileGator itself, see the FileGator project on GitHub.

FileGator is an open source project by Milos Stojanovic and contributors. cloudimg is not affiliated with or endorsed by the FileGator project.