ILIAS 11 on Ubuntu 24.04 on Azure User Guide

Overview

ILIAS is a full open source learning management system: courses and groups, the personal and shared repository, SCORM and xAPI e-learning content, tests and assessments, exercises with peer review, wikis, blogs, portfolios, learning sequences, competence management, certificates and a built-in calendar, forum and mail. It is developed by the ILIAS open source e-Learning society and is the LMS of choice for a large part of German-speaking higher education and the public sector. The cloudimg image delivers the official ILIAS 11.4 release fully installed on Ubuntu 24.04, served over HTTPS, with every per-VM secret generated on first boot — so a working LMS is serving within minutes of launch. Backed by 24/7 cloudimg support.

ILIAS is free software published under the GNU General Public License version 3.0. ILIAS is a trademark of the ILIAS open source e-Learning society (ILIAS open source e-Learning e.V.); cloudimg is not affiliated with, endorsed by, or sponsored by that society. This image packages the upstream open source release with cloudimg's provisioning, hardening and support.

What is included:

• ILIAS 11.4, served from /var/www/ilias, with the web root at /var/www/ilias/public
• PHP 8.3 (php8.3-fpm, over a local UNIX socket) behind Apache 2.4, reachable at https://<vm-ip>/; port 80 only ever redirects to HTTPS and serves no content of its own
• A local MariaDB 10.11 LTS database, bound to 127.0.0.1 only
• ILIAS's scheduled job runner on a systemd timer (ilias-cron.timer, every five minutes) rather than a web-triggered endpoint
• A per-VM administrator password, database password, Web Access Checker and WebDAV URL signing keys, installation identifiers and HTTPS certificate, all generated on first boot and written to a root-only file — no default, shared or published credential ships in the image
• The ILIAS installation is completed at build time with the command line setup. ILIAS 11 has no web installation wizard, and the setup command lives above the web root, so there is no setup route for a stranger to reach
• Self-registration is disabled by default and the password policy is hardened beyond upstream's (minimum 12 characters, mixed case, digits and symbols)
• 24/7 cloudimg support

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2ms (2 vCPU / 8 GiB RAM) is the recommended starting size: ILIAS is a PHP application with a local database, and the extra memory keeps the MariaDB InnoDB buffer pool and PHP's opcache warm. Scale up for large course catalogues, many concurrent learners, or heavy SCORM and video use. NSG inbound: allow 22/tcp from your management network and 443/tcp (HTTPS) from wherever your learners and staff will browse. 80/tcp is optional and only redirects to HTTPS.

Step 1: Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for ILIAS by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size (Standard_B2ms or larger); under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTPS (443). Then Review + create and Create.

Step 2: Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name ilias \
  --image <marketplace-image-urn> \
  --size Standard_B2ms \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open HTTPS so learners can reach the platform:

az vm open-port --resource-group <your-rg> --name ilias --port 443 --priority 900

Step 3: Connect to your VM

ssh azureuser@<vm-public-ip>

Step 4: Confirm the ILIAS stack is running

First boot generates this VM's secrets and only then opens the front door, so if the web server is running the installation is ready. Check the four units:

systemctl is-active mariadb php8.3-fpm apache2 ilias-cron.timer

All four report active:

active
active
active
active

Confirm ILIAS answers over HTTPS on the VM itself. The image ships a self-signed certificate, so -k is expected here until you install your own certificate in Step 11:

curl -sk -o /dev/null -w '%{http_code}\n' 'https://127.0.0.1/login.php?client_id=ilias&cmd=force_login'

That prints 200. (Quote the URL: an unquoted & would background the command in your shell. Requesting login.php without cmd=force_login answers 302 rather than 200, because ILIAS redirects you to the default view.)

Only SSH and HTTPS are reachable from off the VM. The database and PHP-FPM are deliberately not:

ss -lntu | grep -E ':(3306|443|80|22) ' | sort

MariaDB appears only on 127.0.0.1:3306, while :22, :80 and :443 are the three the network sees. PHP-FPM does not appear at all — it listens on a UNIX socket, not a TCP port.

Step 5: Retrieve the first-boot credentials

Every secret on this VM was generated on its first boot and written to a file only root can read. Nothing here is shared with any other deployment:

sudo cat /root/ilias-credentials.txt

# cloudimg :: ILIAS 11 appliance credentials
# Generated on this VM's first boot. This file is readable only by root.
# Change the administrator password after your first sign-in.
ilias.admin.user=root
ilias.admin.pass=<unique to this VM>
ilias.client.id=ilias
ilias.db.user=ilias
ilias.db.pass=<unique to this VM>

root here is ILIAS's own administrator account, not the Linux root user. ILIAS's documented default password for that account is not present in this image: it is replaced during the build and replaced again, with a value nobody records, before the image is captured. Your VM mints its own on first boot.

Step 6: Understand the platform URL

ILIAS builds its links from the address you browse with, and this image teaches ILIAS which addresses this VM answers on every time it boots — the public IP, the private IP, the hostname and localhost. That means a stop/start that changes your Azure public IP is picked up automatically, with nothing to edit.

You can see the list ILIAS accepts:

sudo mariadb -u root ilias -BN -e "SELECT value FROM settings WHERE keyword='allowed_hosts';"

Browse to https://<vm-public-ip>/ and your browser will warn about the self-signed certificate. Accept it to continue, or install your own certificate first (Step 11).

Step 7: Sign in

Open https://<vm-public-ip>/ and sign in with the username root and the password from Step 5.

Change the password immediately: click your avatar at the top right, choose Settings, then Password. The image enforces a minimum of 12 characters with upper case, lower case, digits and symbols.

Step 8: Create your first course

From the left sidebar choose Repository, then Add New Item and Course. Give the course a title and select Add Course.

ILIAS opens the new course on its Settings tab and confirms Course added. A new course is Offline until you publish it: on the Settings tab tick Online under Availability and select Save. Use the Content tab to add learning modules, tests, exercises and files, and the Members tab to enrol learners.

Step 9: Scheduled jobs

ILIAS runs background work — notification mails, expired session cleanup, certificate generation, learning progress recalculation — through its own job runner. On this image that is a systemd timer firing every five minutes, not a public web endpoint, so nothing outside the VM can trigger it.

systemctl list-timers ilias-cron.timer --no-pager

You can run the jobs immediately and confirm the run was recorded:

sudo systemctl start ilias-cron.service && sudo mariadb -u root ilias -BN -e "SELECT FROM_UNIXTIME(value) FROM settings WHERE keyword='last_cronjob_start_ts';"

That prints the timestamp of the run that has just happened. Manage the individual jobs in Administration → System Settings and Maintenance → Cron Jobs.

Step 10: Configure outbound email

ILIAS sends account, notification and password-reset mail. Azure blocks outbound port 25 on most subscriptions, so relay through an authenticated provider. In Administration → System Settings and Maintenance → Mail → SMTP, enable SMTP and enter your provider's host, port (587), username and password, then send yourself a test message from Mail.

Step 11: Use a domain name and your own certificate

Point a DNS A record at the VM's public IP, then obtain a certificate for that name. With the name resolving publicly:

sudo apt-get update && sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d lms.example.com

Certbot installs the certificate and renews it automatically. Then tell ILIAS to use the name in the links it builds outside a web request, such as notification mail:

sudo sed -i 's#^http_path = .*#http_path = "https://lms.example.com"#' /var/www/ilias/ilias.ini.php
sudo systemctl reload apache2

Your domain is accepted automatically alongside the VM's own addresses.

Step 12: Security model

• No default or shared credential ships in the image. The ILIAS administrator password, the database password, the Web Access Checker and WebDAV URL signing keys, the installation identifiers and the HTTPS certificate are all generated on this VM's first boot.
• ILIAS 11 has no web installation wizard. The setup is a command line tool that lives above the web root, and the web server additionally denies /setup and /cli outright.
• The files that carry secrets — client.ini.php, key_rotation.php, webdav_key_rotation.php — are denied over HTTP and readable only by the web server user.
• Only 22/tcp and 443/tcp are reachable from off the VM. 80/tcp issues a permanent redirect to HTTPS and serves nothing else. MariaDB is bound to 127.0.0.1 and PHP-FPM uses a UNIX socket.
• Self-registration is off by default. Turn it on in Administration → Users and Roles → User Management → New Account Registration only when you intend to accept public sign-ups.
• Ubuntu's unattended security upgrades remain enabled.

Step 13: Back up your platform

ILIAS keeps state in two places: the database, and the file store outside the web root.

sudo mariadb-dump --single-transaction --routines ilias | gzip > ~/ilias-db-$(date +%F).sql.gz
sudo tar czf ~/ilias-files-$(date +%F).tar.gz /var/www/files

Copy both off the VM, and take an Azure disk snapshot before any upgrade.

Step 14: Maintenance and upgrades

Ubuntu security updates are applied automatically. To move to a later ILIAS 11 point release, back up first (Step 13), then replace the code and run the setup's update command:

sudo systemctl stop apache2
cd /tmp && curl -fsSLO https://github.com/ILIAS-eLearning/ILIAS/releases/download/v11.5/ILIAS-11.5.tar.gz
sudo tar -xzf ILIAS-11.5.tar.gz -C /var/www/ilias --strip-components=1 ILIAS-11.5/
sudo chown -R www-data:www-data /var/www/ilias
cd /var/www/ilias && sudo -u www-data php cli/setup.php update /var/www/config/ilias.json
sudo systemctl start apache2

Check the installation's health at any time — this reports each component's database schema version and whether an update is outstanding:

cd /var/www/ilias && sudo -u www-data php cli/setup.php status 2>/dev/null | head -20

Support

cloudimg provides 24/7 support for this image. Contact us at support@cloudimg.co.uk or through the cloudimg support page. For questions about ILIAS itself, see the ILIAS documentation.