Debain LAMP setup

Basic Debain LAMP setup

This is how I generally setup a new debian server or vps. This process normally only takes a few minutes to have a nice, secure, production worthy lamp setup and running quickly. This is one of the main reasons I love debian so much. In this I assume that you have a bare newly rented server without any prior installations and I cover a few of my common practices that make my life as a sysadmin a little bit easier. We will forget for now that some of their policy decisions seem to be motivated by to much coffee and estrogen.

Update sources

#most of the following should be executed as root
apt-get update
apt-get upgrade

Screen
GNU screen will be something you learn to love as you become more experienced with it. The following UI setup I found somewhere a long time ago and have been using it ever since.

vi ~/.screenrc
hardstatus on
hardstatus alwayslastline
hardstatus string '%{gk}[ %{G}%H %{g}][%= %{wk}%?%-Lw%?%{=b kR}(%{W}%n*%f %t%?(%u)%?%{=b kR})%{= kw}%?%+Lw%?%?%= %{g}][%{Y}%l%{g}]%{=b C}[ %m/%d %c ]%{W}'

Control +a c adds a new window
Control +a n switches to the next window
Control +a p switches to the previous window
Control +a x locks the screen session
Control +a k kills the current window

Install fail2ban
fail2ban is a great piece of software that monitors a log file for a given pattern(e.g. failed ssh logins, failed ftp logins, etc) and will block them for a variable amount of time depending on your requirements. This is great for preventing bruteforce attacks.

apt-get install fail2ban

IPtables
This is where I differ from some sysadmin. Most seem create a shell script that holds all of their iptables rules but I use two nifty packages shipped by default with debian(iptables-restore & iptables-save)

First we save the default fail2ban rules somewhere that is easy to remember

iptables-save > /etc/iptables

And now we add our two basic rules to allow web and ssh traffic

vi /etc/iptables
# Generated by iptables-save v1.4.2 on Wed Nov  9 22:16:52 2011
*mangle
:PREROUTING ACCEPT [2507975:1707373020]
:INPUT ACCEPT [2507975:1707373020]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2481524:1683726521]
:POSTROUTING ACCEPT [2481524:1683726521]
COMMIT
# Completed on Wed Nov  9 22:16:52 2011
# Generated by iptables-save v1.4.2 on Wed Nov  9 22:16:52 2011
*filter
:INPUT ACCEPT [2507975:1707373020]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [2481524:1683726521]
:fail2ban-ssh - [0:0]
-A INPUT -p tcp -m multiport --dports 22 -j fail2ban-ssh
-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,22 -j ACCEPT
-A INPUT -p tcp -j DROP
-A INPUT -p udp -j DROP
-A fail2ban-ssh -j RETURN
COMMIT
# Completed on Wed Nov  9 22:16:52 2011
# Generated by iptables-save v1.4.2 on Wed Nov  9 22:16:52 2011
*nat
:PREROUTING ACCEPT [11674:749649]
:POSTROUTING ACCEPT [11773:720169]
:OUTPUT ACCEPT [11773:720169]
COMMIT
# Completed on Wed Nov  9 22:16:52 2011

You will notice that we added the following 4 lines. Which accepts all web and ssh traffic and drops everything else.

-A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
-A INPUT -p tcp -m multiport --dports 80,22 -j ACCEPT
-A INPUT -p tcp -j DROP
-A INPUT -p udp -j DROP

Now we update our iptables rules

iptables-restore /etc/iptables

MySQL

Now we install MySQL

 apt-get install mysql-server mysql-client

Just follow the on screen instructions anda you will be given the chance to create a root password. I would make note of this password if I were you.

Apache and PHP5
Here we install apache2 and php5 along with php5-suhosin for added security

apt-get install apache2 php5 php5-mysql libapache2-mod-php5 php5-suhosin

Now the basic suhosin setup

vi /etc/php5/apache2/php.ini
[suhosin]
extension=suhosin.so
;Disable session encryption (required for most login scripts)
suhosin.session.encrypt = Off
;Log all errors
suhosin.log.syslog=511
;Max traversal depth ie '../../'
suhosin.executor.include.max_traversal=4
;Disable eval
suhosin.executor.disable_eval=On
;Disable /e modifier
suhosin.executor.disable_emodifier=On
;Disallow newlines in Subject:, To: headers and double newlines in additional headers
suhosin.mail.protect=2
;Recommend Settings
;Silently fail all failed sql queries. You may want to disable this for a development environment
suhosin.sql.bailout_on_error=On

Now we setup ssl

a2enmod ssl
apache2 -k restart

The vhost configs are in /etc/apache2/sites-available/default. If you are planning on having several domains the common practice on debian servers is to have the document root under /var/www and a corrisponding config in /etc/apache2/sites-available/.

As an example if my site was named domain.com I would do the following

mkdir /var/www/domain.com
chown www-data:www-data /var/www/domain.com
chmod ug+r /var/www/domain.com
cp /etc/apache2/sites-available/default /etc/apache2/sites-available/domain.com
vi /etc/apache2/sites-available/domain.com
#......edit accordingly 
apache2 -k restart

This is all really pretty easy and should only take a few minutes to have a basic and secure lamp setup up and running