Security Checklist for using Laravel on Digital Ocean's LEMP app

Checklist.md

Security Checklist

For setting up laravel on Ubuntu 14.04. Assumes using DO's LEMP image to start.

To start:

• Install and update new software:
  • Run apt-get update
  • Run apt-get install php5-cli php5-mcrypt git
  • Run php5enmod mcrypt
  • Run service php5-fpm restart
• Remove info.php from the web root; nobody needs to know that much info about our configuration
• If you are running something other than this image, edit /etc/php5/fpm/php.ini, line ~768 should be changed. We need to ensure that this is set properly: cgi.fix_pathinfo=0
• Run mysql_secure_installation
• Save copy of MySQL root password for personal reference
• Remove /etc/motd.tail
• Edit /etc/adduser.conf, and change directory permissions to 750; we don't want users looking through each others' files
• Add directorie to /etc/skel: .ssh
• Add an empty authorized_keys file, with proper permission sets (700) then you can append to it with scripts

Create a new web account:

• Remove the default site from /etc/nginx/sites-enabled/, as we probably will create a user with the script below
• Run the script here to make new users on various domains.
• If you are using laravel, then the web folder should be the folder in your project called 'public'. So you will probably end up with something like /home/account/public_html/public; Where you put it is up to you, but your actual Laravel installation should be outside the user's web root folder.
• Run chown -R account:account /home/account/site_folder in order to ensure that the user can write to his files. You must do this to your Laravel project folder to ensure that the storage folder is writable.
• Run service php5-fpm restart
• If you have any SSH keys to add, now is the time

While we're at it make a new administrator account:

• Run adduser administrator, be sure to set a password for the user for safety
• Add user to sudoers usermod -a -G sudo administrator
• Add any SSH keys to authorized_keys for this new user
• Log out of the server, log back in as administrator, and ensure that you can use sudo to do root things before continuing!
• Now you can disable the root account's password: passwd -l root
• Remove all keys from root's authorized_keys file

With this done it is now time to change SSH policy:

• Open /etc/ssh/sshd_config and set PasswordAuthentication no
• in the same file, change to a non-default port (near the top)
• set PermitRootLogin no and save the file
• Restart the ssh daemon service ssh restart, log out, and log in as your new admin on the new port

Working With Laravel 5.0:

• You'll need to install composer:

  wget -q -O - https://getcomposer.org/installer | php sudo mv composer.phar /usr/local/bin/composer

• Ensure you read this

Don't forget:

• Configure your DNS for any applicable subdomains
• Restart the server when you're done to finalize any package installs

Upon completion of this, you should have a new account on a new port that can act as an administrator. Root should have its password locked, and not be able to SSH in. For each new user, they'll need a schema, a db user, and another run of the user create script above.