{"id":396,"date":"2023-02-16T15:49:45","date_gmt":"2023-02-16T15:49:45","guid":{"rendered":"http:\/\/joonim.ca\/?p=396"},"modified":"2023-02-16T15:49:45","modified_gmt":"2023-02-16T15:49:45","slug":"ubuntu-how-to-build-lamp-server","status":"publish","type":"post","link":"https:\/\/waterloobae.com\/blog\/2023\/02\/16\/ubuntu-how-to-build-lamp-server\/","title":{"rendered":"[Ubuntu] How to build LAMP server 1 of 3 &#8211; Server"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">LAMP server used to be installed as default. For 18.04 and 20.04, LAMP server can be installed as below.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo apt install tasksel\n$sudo tasksel install lamp-server<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">For 22.04, Apache and MySQL server gets installed for LAMP server as below.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo apt install apache2\n$sudo apt install mysql-server\n$sudo apt install php libapache2-mod-php php-mysql <\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Update<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It is often recommended to run <strong><em>sudo apt-get update<\/em><\/strong> and <em><strong>sudo apt-get upgrade<\/strong><\/em> before installing packages. You can run <strong><em>sudo unattended-upgrade<\/em><\/strong> for security updates.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Scripts<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Some scripts help you to automate maintenance along with crontab jobs. Here are a couple of useful scripts. This is fixing permission and ownership issue when more than one person are working on files in web spaces.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">#!\/bin\/bash\nchown -R www-data:www-data \/var\/www\nfind \/var\/www -type f -exec chmod 664 {} \";\"\nfind \/var\/www -type d -exec chmod 775 {} \";\"\nchmod 775 \/var\/www<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">MySQL can be backed up with the script below. You need to tweak it for your usage. This script performs full-bakcup on Sunday and it performs incremental backup on other days.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">#!\/bin\/bash\n#mysqldump --database db-name  --add-drop-table -u root -pPassword > \/databasebackup\/file-name.sql\nif [ \"`date +%A`\" == \"Sunday\" ]; then\n\tmysqldump -A -Y --flush-logs --delete-master-logs --master-data=2 --add-drop-table --lock-all-tables -uroot -pPassword > \/databasebackup\/file-name.sql\nelse\n        today=`date +%A`\n        logno=`ls -d \/var\/log\/mysql\/mysql-bin.?????? | sed 's\/^.*\\.\/\/' | sort -g | tail -n 1`\n        mysqladmin -uroot -pPassword flush-logs\n        mysqlbinlog \/var\/log\/mysql\/mysql-bin.$logno > \/databasebackup\/$today.sql\nfi<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Crontab<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It is possible to create\/edit Crontab job in your account by typing <strong><em>crontab -e<\/em><\/strong>, or <strong><em>sudo crontab -e<\/em><\/strong> will created Crontab jobs in root account. It will look like below.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\"># m     h       dom     mon     dow     command\n# *\/15     *       *       *       *       \/scripts\/server_mon\n05      07      1       *       *       \/scripts\/set_www_perms\n00      22      *       *       *       \/scripts\/db_backup <\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Backup<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">My organization uses EMC NetWorker. So, this is how client get installed on your server for backup. First, need to delete old client.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo dpkg -l | grep \u201clgt\u201d\n$sudo dpkg --remove lgtoclnt\n$sudo rm -rf \/nsr\/<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">After deleting old client, the new client can be installed as below.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo dpkg --configure -a\n$sudo dpkg -i package_file.deb\n$sudo apt-get -f install (to complete dependencies)\n$sudo nsrexecd (This will create the \/nsr directory)\n$sudo kill `pidof nsrexecd`\n$sudo vi \/nsr\/res\/servers\n        your.org.backup.com\n$sudo \/etc\/init.d\/networker restart\n$sudo systemctl restart networker \n$sudo vi \/.nsr\n$sudo nsrports -S 7937-7941<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Authentication<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">SSH password authentication can be enabled by editing \/etc\/ssh\/sshd_config<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo vi \/etc\/ssh\/sshd_config\n\tPasswordAuthentication yes <\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">SSH public key authentication can be set up as followed. On your machine you run<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$mkdir ~\/.ssh\n$chmod 700 ~\/.ssh\n$ssh-keygen -t rsa -b 4096<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Transfer client key to host from your machine.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$ssh-copy-id &lt;username>@&lt;host><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Transfer client key after copying public key.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$cp authorized_keys authorized_keys_Backup\n$cat id_rsa.pub >> authorized_keys\n\n$sudo vi \/etc\/ssh\/sshd_config\n\tPasswordAuthentication no\n\tPubkeyAuthentication yes\n\tRSAAuthentication yes\n$sudo service ssh restart<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Firewall<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It is possible to start firewall for your server locally. UFW is the right tool for this job. Just make it sure open ports first specially SSH port (22). Otherwise, you will be kicked out from your SSH connection when UFW is enabled. <\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo ufw allow 22\n$sudo ufw allow 80\/tcp\n$sudo ufw allow 443\/tcp\n$sudo ufw allow 7937:7941\/tcp\n$sudo ufw allow 3306\n$sudo ufw allow 3306\/tcp\n$sudo ufw allow samba\n\n$sudo ufw enable\n$sudo ufw status\n    To                         Action      From\n    --                         ------      ----\n    22                         ALLOW       Anywhere\n    80\/tcp                     ALLOW       Anywhere\n    443\/tcp                    ALLOW       Anywhere\n    3306\/tcp                   ALLOW       Anywhere\n    8080\/tcp                   ALLOW       Anywhere\n    Samba                      ALLOW       Anywhere<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If your server is on AWS and it uses AWS Firewall, you can create a white list that enables to send request with APIs. You can register any servers who need to talk to severs behind Firewall. First, login to AWS Console. Then, search for &#8220;ASW Firewall Manager&#8221;.  Under &#8220;AWS WAF&#8221;, you can click &#8220;IP sets&#8221; <\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"http:\/\/joonim.ca\/wp-content\/uploads\/2023\/02\/image-1024x317.png\" alt=\"\" class=\"wp-image-411\"\/><figcaption class=\"wp-element-caption\">AWS Firewall Manager<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">After that you can Create IP set and Add IP address.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" src=\"http:\/\/joonim.ca\/wp-content\/uploads\/2023\/02\/image-1-1024x334.png\" alt=\"\" class=\"wp-image-412\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Adding User<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">You can create a user with useradd command and add that user in to the proper groups. It is also good to change the user&#8217;s main group to &#8220;www-data&#8221; if that user works as a web developer. It will create less head ache for permission issues.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">- $sudo useradd -s \/bin\/bash -m -c 'John Doe' -G www-data jdoe\n- $sudo usermod -a -G sudo jdoe\n- $ sudo usermod -g www-data jdoe<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Samba<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">If file server is needed, Samba can be installed and used.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo apt-get install samba\n$sudo ufw allow samba<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Configuration file can be found in \/etc\/samba\/smb.conf.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">[global]\n      server min protocol = LANMAN1 \n      security = user\n\n[SharedDir]\n      comment = Ubuntu File Server Share\n      path = \/SharedDir\n      browsable = yes\n      guest ok = no\n      read only = no\n      create mask = 0755\n      valid users = jdoe\n      admin users = jdoe\n<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Directory and users for Samba can be created as below<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo mkdir -p \/SharedDir\n$sudo chown nobody:nogroup \/SharedDir\/\n\n$sudo useradd -m -c 'John Doe' -G www-data jdoe\n$sudo smbpasswd -a jdoe\n\n$ sudo service smbd restart\n$ sudo service nmbd restart<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">How to prevent Kernel update<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Kernel get updated automatically when updates are available. This automated update can fill up \/Boot partition pretty quickly. So, it might be necessary to hold updates.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$uname -r\nOutput: x.xx.x-xx-generic\n$sudo apt-mark hold x.xx.x-xx-generic<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">PDF file handling<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">It is possible to merge PDF files with <strong><em>pdfunite<\/em><\/strong> command.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo apt-get update\n$sudo apt-get install poppler-utils\n$pdfunite source1.pdf source2.pdf merged_output.pdf<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">It is also possible to split PDF files with <em><strong>qpdf<\/strong><\/em> command.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo apt-get update\n$sudo apt-get install qpdf\n$qpdf --empty --pages infile.pdf 1-5 -- outfile.pdf<\/pre>\n\n\n\n<h2 class=\"wp-block-heading\">Postfix<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Postfix can be secured to use TLS. I found it causes less bounce backs from receiving mail servers.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo apt-get install libsasl2-modules\n$sudo apt-get install postfix\n$sudo vi \/etc\/postfix\/main.cf<\/pre>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">#smtp_use_tls = yes\n#smtp_tls_security_level = encrypt\nsmtp_tls_security_level = may\nsmtp_tls_cert_file=\/etc\/ssl\/certs\/server.crt\nsmtp_tls_key_file=\/etc\/ssl\/certs\/server.key\n#smtp_tls_key_file=\/etc\/ssl\/private\/server.key\n\n# where to find CA certificates\nsmtp_tls_CAfile = \/etc\/ssl\/certs\/server-ca.crt<\/pre>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo service postfix restart<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Postfix can be test as below after configurations are changed.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo apt install mailutils\n$ echo \"body of your email\" | mail -s \"This is a Subject\" -a \"From: test@test.ca\" test@test.ca<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Postfix file too large error can be fixed as below.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo tail -f \/var\/log\/mail.log\n$postconf -d | grep size\n$sudo postconf -e mailbox_size_limit=0\n$sudo postconf -e message_size_limit=0\n$sudo \/etc\/init.d\/postfix restart<\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">It is possible to configure Postfix to relay emails to specific email server. However, I could not make it work. I am just leaving my attempts here.<\/p>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo apt-get install libsasl2-modules\n$sudo apt-get install sasl2-bin\n$sudo apt-get install postfix\n$sudo vi \/etc\/postfix\/sasl_passwd<\/pre>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">bulkmail.test.ca       user_name:password\n[bulkmail.test.ca]     user_name: password\n[bulkmail.test.ca]:465 user_name: password\n[bulkmail.test.ca]:587 user_name: password<\/pre>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo chmod 400 \/etc\/postfix\/sasl_passwd\n$sudo postmap \/etc\/postfix\/sasl_passwd\n$sudo chown root:root \/etc\/postfix\/sasl_passwd \/etc\/postfix\/sasl_passwd.db\n$sudo chmod 0600 \/etc\/postfix\/sasl_passwd \/etc\/postfix\/sasl_passwd.db\n$sudo vi \/etc\/postfix\/main.cf<\/pre>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\"># Enable STARTTLS encryption\nsmtp_tls_security_level = may\n#smtp_use_tls = yes\n#smtp_tls_security_level = encrypt\n\n# where to find CA certificates\nsmtp_tls_cert_file=\/etc\/ssl\/certs\/server.crt\n#smtp_tls_key_file=\/etc\/ssl\/certs\/server.key\nsmtp_tls_key_file=\/etc\/ssl\/private\/server.key\nsmtp_tls_CAfile = \/etc\/ssl\/certs\/server-ca.crt\n\n# enable SASL authentication\nrelayhost = [bulkmail.test.ca]:587\n# relayhost = [bulkmail.test.ca]:465\n# relayhost = [bulkmail.test.ca]:submission\n# smtp_tls_wrappermode = yes\nsmtp_sasl_auth_enable = yes\nsmtp_sasl_mechanism_filter = plain, login\n# disallow methods that allow anonymous authentication.\nsmtp_sasl_security_options = noanonymous\n#smtp_sasl_tls_security_options = noanonymous\n# where to find sasl_passwd\nsmtp_sasl_password_maps = hash:\/etc\/postfix\/sasl_passwd<\/pre>\n\n\n\n<pre class=\"wp-block-syntaxhighlighter-code\">$sudo service postfix restart<\/pre>\n","protected":false},"excerpt":{"rendered":"<p>LAMP server used to be installed as default. For 18.04 and 20.04, LAMP server can be installed as below. For 22.04, Apache and MySQL server gets installed for LAMP server as below. Update It is often recommended to run sudo apt-get update and sudo apt-get upgrade before installing packages. You can run sudo unattended-upgrade for [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-396","post","type-post","status-publish","format-standard","hentry","category-it-tips"],"_links":{"self":[{"href":"https:\/\/waterloobae.com\/blog\/wp-json\/wp\/v2\/posts\/396","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/waterloobae.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/waterloobae.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/waterloobae.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/waterloobae.com\/blog\/wp-json\/wp\/v2\/comments?post=396"}],"version-history":[{"count":0,"href":"https:\/\/waterloobae.com\/blog\/wp-json\/wp\/v2\/posts\/396\/revisions"}],"wp:attachment":[{"href":"https:\/\/waterloobae.com\/blog\/wp-json\/wp\/v2\/media?parent=396"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/waterloobae.com\/blog\/wp-json\/wp\/v2\/categories?post=396"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/waterloobae.com\/blog\/wp-json\/wp\/v2\/tags?post=396"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}