Changes between Initial Version and Version 1 of secureweb

Timestamp:

Nov 18, 2016, 3:34:52 AM (8 years ago)

Author:

admin

Comment:

--

secureweb

@@ +1 @@
+= LAMP Installation and Web hardening =
+LAMP is one of the most common web systems we find today. Letters L A M P stands for '''Linux''' , '''Apache''', '''MySQL''' & '''PHP'''. [[br]]
+
+From your yesterday’s work, we already have our first objective ‘L’, i.e. Linux or in our case its Ubuntu. Therefore, let’s see how to install other three and then in to some security hardening.
+
+== Prerequisites ==
+Before we begin, we need to have a non-root user account with '''sudo''' privileges set up on your Ubuntu 16.04 LTS server clean installation.[[br]]
+Check whether you can ping your vm from the pc using its domain name www.'yourdomain'.ws.learn.ac.lk
+
+== Installation of Apache ==
+Apache is a web server application that is widely used in the internet for more than 20 years and it is a well-documented piece of Free and Open Source Software managed by Apache Foundation.
+(https://httpd.apache.org/)
+
+Before installing we need to update our repositories. Therefore we will first add debian apache repo to our list and do a update on the list. Since we will be using sudo commands, It will ask you for your user's password as these processors will be granted root privileges.
+{{{
+sudo add-apt-repository ppa:ondrej/apache2
+}}}
+
+When Asked press ‘Enter’ to Continue. Once the ppa is imported do an update.
+{{{
+sudo apt-get update
+}}}
+
+Once the repo lists are updated run,
+{{{
+sudo apt-get install apache2
+}}}
+
+When asked press '''Y''' and hit '''Enter''' to continue, and the installation will proceed.
+
+Check installed apache version details by issuing,
+{{{
+$ apache2 -v
+}}}
+'''NOTE''': if you had installed apache2 while installing Ubuntu OS then we should update it to the latest by,
+{{{
+sudo apt-get --only-upgrade install apache2 -y
+}}}
+
+Now goto your browser and type '''http://www.'your domain'.ws.learn.ac.lk''' and check whether you are able to access the apache test page.
+
+== MySQL Installation ==
+
+Once the web server is installed and running we need to install a database management system to host our dynamic data. For that we use MySQL database as another popular FOSS.
+
+So to install MYSQL run,
+{{{
+sudo apt-get install mysql-server
+}}}
+
+Again you will be asked to press Y to continue. During the installation process you will be asked to type in and confirm a root password for your MySQL system. Please keep in mind that MySQL root is also similar to root access of your server and therefore choose a strong and unique password, never leave it
+blank.
+
+As the installation completes let’s tighten some security in MySQL by running,
+{{{
+sudo mysql_secure_installation
+}}}
+Enter your MySQL root password when asked. As the first step it will ask
+
+'''VALIDATE PASSWORD PLUGIN'''
+
+
+where this will make your passwords associated with databases much stronger by enforcing password restrictions. Once you click y it will give three options LOW, MEDIUM, STRONG. Then select a level of password validation. Make sure to keep in mind that if you enter 1, for the medium level, you will receive errors when attempting to set any password which does not contain numbers, upper and lowercase letters, and special characters. [[br]] Then there will be several questions asked, please enter Y for every answer and enter.[[br]] Once the script ends running we can test our MySQL instance by login in to it.
+{{{
+mysql –u root –p
+}}}
+Enter your MySQL root password when requested.
+
+== Install PHP 7 ==
+As the last option of LAMP lets install PHP version 7.
+
+type in,
+{{{
+sudo apt-get -y install php7.0 libapache2-mod-php7.0
+}}}
+the switch –y will automatically put yes on the installation process when it is prompted.[[br]]
+Once the installation is finished restart apache.
+{{{
+sudo service apache2 restart
+}}}
+To check php, lets create a test php file.
+{{{
+sudo nano /var/www/html/info.php
+}}}
+'''Note''': /var/www/html/ is the default document root for apache in Ubuntu unless you have changed it in apache configuration.
+
+Enter the following in info.php
+{{{
+<?php
+phpinfo();
+?>
+}}}
+Now let us call that file in a browser (e.g. http://www.'yourdomain'.ws.learn.ac.lk /info.php)
+
+If your PHP 7 is working you will see all your php server settings in a one single place.
+
+== Enabling Virtual Hosts ==
+
+Before we go further test your domain names are correctly resolving to the same server IP address by issuing Ubuntu dig commands.
+{{{
+dig @192.248.1.161 web1.’yourdomain’.ws.learn.ac.lk
+dig @192.248.1.161 web2.’yourdomain’.ws.learn.ac.lk
+}}}
+Next, create two directories on /var/www/ to host two separate web sites.
+{{{
+sudo mkdir /var/www/web1
+sudo mkdir /var/www/web2
+}}}
+Create index pages on each directories containing following.
+{{{
+sudo nano /var/www/web1/index.php
+}}}
+You may change the content as appropriate.
+{{{
+<html>
+<head>
+<title>Web 1</title>
+</head>
+<body>
+<h1> <?php
+Echo "Hello, I’m Web1";
+?>
+</h1>
+</body>
+</html>
+}}}
+Default host configuration is located in /etc/apache2/sites-available/000-default.conf which serves any requests coming to its domain name or IP address. To make other two domains work, lets create virtual host files for each domain names;
+{{{
+sudo nano /etc/apache2/sites-available/web1.conf
+}}}
+with the following content,
+{{{
+<VirtualHost *:80>
+ServerAdmin admin@yourdomain.ws.learn.ac.lk
+ServerName yourdomain.ws.learn.ac.lk
+ServerAlias web1.yourdomain.ws.learn.ac.lk
+DocumentRoot /var/www/web1
+ErrorLog ${APACHE_LOG_DIR}/error.log
+CustomLog ${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>
+}}}
+Then create the virtual host for web2 as web2.conf on the same directory as web1.conf with the folowing.
+{{{
+<VirtualHost *:80>
+ServerAdmin admin@yourdomain.ws.learn.ac.lk
+ServerName yourdomain.ws.learn.ac.lk
+ServerAlias web2.yourdomain.ws.learn.ac.lk
+DocumentRoot /var/www/web2
+ErrorLog ${APACHE_LOG_DIR}/error.log
+CustomLog ${APACHE_LOG_DIR}/access.log combined
+</VirtualHost>
+}}}
+Once both files are written these needs to be enabled by,
+{{{
+sudo a2ensite web1.conf
+sudo a2ensite web2.conf
+}}}
+Now restart the apache and check your browsers for following and see how three websites are hosted in one server.
+
+http://www.yourdomain.ws.learn.ac.lk [[br]]
+http://web1.yourdomain.ws.learn.ac.lk [[br]]
+http://web2.yourdomain.ws.learn.ac.lk [[br]]
+
+== CGI Scripts ==
+== Apache Hardening ==
+== file/folder permissions ==
+== https configuration ==
+== http2 ==