aptosid LAMP Stack
The acronym LAMP refers to a set of free software programs commonly used together to run dynamic Web sites or servers
Linux, the operating system
Apache, the Web server
MySQL, the database management system (or database server)
Perl, PHP, and/or Python, scripting languages
WARNING: Never use your day-to-day PC to act as an internet web server! Use a dedicated PC to be an internet web server and let it do nothing else!
a) a local test server for web designers without internet connectivity which is the scope of this topic;
b) a private "closet" server connected to the net;
c) a private web server fully propagated to the internet
d) a commercial web server which is beyond the scope of this manual
At least 256MB of RAM available. Anything less than this minimum ram will cause lot of problems since running a server with mysql requires lot of RAM to run properly. Mysql will error of "cannot connect to mysql.sock" if you dont have enough memory in your server.
The packages you will need to install are:
apache2 apache2-utils apache2-mpm-prefork php5 php5-common mysql-server mysql-common libapache2-mod-php5 php5-mysql phpmyadmin
apt-get remove --purge splashy
As splashy always breaks mysql
The Apache configuration file is located at:/etc/apache2/apache2.conf and your web folder is /var/www. Do not tweak the debian default settings for 'mpm-worker/mpm-prefork' as the debian defaults are sane.
To check whether php is installed and running properly, just create a test.php in your /var/www folder with phpinfo() function exactly as shown below.
mcedit /var/www/test.php # test.php <? phpinfo(); ?>
Point your browser to:
http://localhost/test.php or http://yourip:80/test.php
This should show all your php configuration and default settings.
You can edit necessary values or setup virtual domains using apache configuration file.
If you want to test your installation go to your browser and type the following
This should display welcome message then your installation is correct.
Default document root directory for apache2 is /var/www Change this to:
mkdir /home/myself/www ln -s /home/myself/www /var/www
By doing the above commands you can now edit your web site inside your home as normal user.
Use SSH and read carefully the SSH topic , also aptosid has another built in FTP client in the form of Konqueror to enable you to upload your files.
Enabling good security protocols for Web Servers
Without a firewall there is absolutely no security for your server. Remember block EVERYTHING until you need it, then reblock it!.
21 (ftp) 22 (SSH) 25 110 (email) 443 (SSL http or https) 993 (imap ssl) 995 (pop3 ssl) 80 (http) and any other port going!
Protect Server Files by Default
One aspect of Apache which is occasionally misunderstood is the feature of default access. That is, unless you take steps to change it, if the server can find its way to a file through normal URL mapping rules, therefore it can serve it to clients.
For instance, consider the following example:
1. # cd /; ln -s / public_html 2. Accessing http://localhost/~root/
This would allow clients to walk through the entire filesystem! To work around this, add the following block to your server's configuration:
<Directory /> Order Deny,Allow Deny from all </Directory>
This will forbid default access to filesystem locations. Add appropriate <Directory> blocks to allow access only in those areas you wish. For example,
<Directory /usr/users/*/public_html> Order Deny,Allow Allow from all </Directory> <Directory /usr/local/httpd> Order Deny,Allow Allow from all </Directory>
Pay particular attention to the interactions of <Location> and <Directory> directives; for instance, even if <Directory /> denies access, a <Location /> directive might overturn it.
Also be wary of playing games with the UserDir directive; setting it to something like "./" would have the same effect, for root, as the first example above. If you are using Apache 1.3 or above, we strongly recommend that you include the following line in your server configuration files:
UserDir disabled root
Run the script “apache2-ssl-certificate”
The following screen will appear for you to enter all the required information.
Creating self-signed certificate replace it with one signed by a certification authority (CA) enter your ServerName at the Common Name prompt. If you want your certificate to expire after x days call this programm with -days x ----- Generating a 1024 bit RSA private key -------- writing new private key to '/etc/apache2/ssl/apache.pem' -------- You are about to be asked to enter information that will be incorporated into your certificate request. ----------- What you are about to enter is what is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank. For some fields there will be a default value, ---------- If you enter '.', the field will be left blank.
Country Name (2 letter code) [GB]: State or Province Name (full name) [Some-State]: Locality Name (eg, city) : Organization Name (eg, company; recommended) : Organizational Unit Name (eg, section) : server name (eg. ssl.domain.tld; required!!!) : Email Address :
Run the script “a2enmod ssl” i.e
# a2enmod ssl
This will automatically generate a symbolic link between mods- available and mods – enabled
Make a copy of '/etc/apache2/sites-available/default' file in the /etc/apache2/sites-available/ - call it 'ssl'
# cp /etc/apache2/sites-available/default /etc/apache2/sites-available/ssl
Make a sym-link to this new site configuration for this use
# ln -s /etc/apache2/sites-available/ssl /etc/apache2/sites-enabled/ (or) #a2ensite ssl
If you want to change the any basic configuration settings change in /etc/apache2/apache2.conf and if you want to change the default document root change in /etc/apache2/sites-available/default file and restart the apache server.
To Restart Apache server use the following command
#service apache2 restart
Now we need to change the port address in /etc/apache2/ports.conf by default it will listen port 80 and now we are installing with SSL we need to change port 443 to listen
Edit /etc/apache2/sites-available/ssl (or whatever you called your new ssl site's config) and change port 80 in the name of the site to 443.
Add below two lines some where in /etc/apache2/apache2.conf file
SSLEngine On SSLCertificateFile /etc/apache2/ssl/apache.pem
Edit SSLCertificateFile /etc/apache2/ssl/apache.pem and enter the locations of certificate file and certificate key file .Below one is the example
SSLCertificateFile /etc/apache2/ssl/online.test.net.crt SSLCertificateKeyFile /etc/apache2/ssl/online.test.net.key
Set ServerSignature off, follow these steps edit the /etc/apache2/apache2.conf file and add these two lines
ServerSignature Off ServerTokens ProductOnly
If you want to allow the different index files types check for the following line in /etc/apache2/apache2.conf file
DirectoryIndex index.html index.cgi index.pl index.php index.xhtml index.shtml
Restart the apache server
service apache2 restart
You should now have a test server sandbox, should you want to connect to the interent, with it, DONT!... Use another PC purely dedicated to being an internet web server!