LEMP Setup - Ubuntu 16.04 LTS.md

A Relatively Secure LEMP Server Stack Setup in Ubuntu 16.04 LTS

By Anup Dhakal

Introduction

In this guide, LEMP stands for Linux, Nginx (pronounced as Engine-X) , MariaDB (a drop in replacement for MySQL) and PHP (PHP Hypertext Preprocessor).

I have gone through many websites in order to learn even just the basics of setting up a LEMP server. Hence I know the hassle. Here I have created a through guide to help someone relatively new to setup a powerful LEMP machine easily and effortlessly. I hope this guide comes to someone's rescue.

The instructions on this guide has been tested to work on a fresh install of Ubuntu 16.04.1. And for any other platform, this guide should still serve a useful resource. The "mini goals" are well defined in various paragraphs. And one can easily look elsewhere for specific instructions for that platform to achieve same "mini goal" one at a time.

For a system already running other version of server stacks (example LAMP), some additional steps (like removing those packages or disabling them) might be required. That is beyond the scope of this guide.

Specifications/Target:

• Ubuntu v16.04
• Nginx v1.10
• PHP v7.1
• MariaDB v10.1

But before we start, let's quickly make sure that we have some basic tools ready. Run the following commands in the terminal.

sudo apt update
sudo apt install wget
sudo apt install software-properties-common

Now let's start!

Custom Repositories

Before beginning the installation, we want to add some repositories which will give us the latest corresponding packages for our server stack.

Nginx Repository

For Ubuntu, in order to authenticate the Nginx repository signature and to eliminate warnings about missing PGP key during installation of the Nginx package, it is necessary to add the key used to sign the Nginx packages and repository to the apt program keyring. Only after then we will dare to add the repositories.

The above fact is true every time we add a custom repository. If we don't want to add any custom repository and use the ones provided to us by "vanilla" Ubuntu itself, we can just ignore this section of the guide, entirely. We have to keep in mind that the version numbers used in this guide are according to the default, most recent versions of the respective packages at the time of creation of this guide. So, we might have to be careful in coming sections of the guide where we start installation and setup of the stack. We would want to make sure then, that the version number would match to what we have installed, not what is shown in this guide.

Run the following code one by one in the terminal to add the Nginx stable repository. We need to accept any prompts, if asked.

wget http://nginx.org/keys/nginx_signing.key
sudo apt-key add nginx_signing.key
sudo sed -i '$a deb http://nginx.org/packages/ubuntu/ xenial nginx' /etc/apt/sources.list
sudo sed -i '$a # deb-src http://nginx.org/packages/ubuntu/ xenial nginx' /etc/apt/sources.list

MariaDB Repository

Just like we did with Nginx, we will add the MariaDB stable repository. Run the following commands in the terminal to do so. We need to accept any prompts, if asked.

sudo apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 0xF1656F24C74CD1D8
sudo add-apt-repository 'deb [arch=amd64,i386,ppc64el] http://mirror.fibergrid.in/mariadb/repo/10.1/ubuntu xenial main'

Please note that the mirror here I have used is from Fibergrid (India), because it is one of the nearest mirrors from my location. To select any other mirror, and get corresponding setup instructions, we can visit the MariaDB Repository webpage here. We have to make sure that we choose Distro Ubuntu, Release 16.04 LTS "xenial", Version 10.1 [Stable] and finally the mirror nearest to us.

PHP Repository

The repository here we are going to install is the PHP PPA by Ondrej. We can update our system with unsupported packages from this untrusted PPA by adding ppa:ondrej/php to our system's Software Sources. The following commands will help us to do so. We need to accept any prompts, if asked.

sudo add-apt-repository ppa:ondrej/php

We might feel a little bit confused by the terms "untrusted PPA", but there is actually no reason to worry. We just need to remember that, unlike Nginx's or the MariaDB's repositories, this is not an official upgrade path. But the PPA is well known, and is relatively safe to use.

Update APT

Let's finally begin the actual installations processes.

First, we want to make sure we have the latest records in our local packages registry. Let's run the following command in the terminal like so.

sudo apt update

Installing Nginx

First thing we’re going to install is the server called Nginx.

sudo apt install nginx

We can check if Nginx is installed by typing nginx -v in the terminal.

Installing MariaDB

Now we want to install the database management system (DBMS). We choose MariaDB, which is a modern relational DBMS. It is the drop in replacement for MySQL.

sudo apt install mariadb-server mariadb-client

We can check if MariaDB is installed by executing mysql --version in the terminal.

Even though we are setting up MariaDB, it's actually a derivation of MySQL and hence many packages we install here may have term "mysql" in them. For an example, PHP makes use of the package php-mysql as the database driver for MySQL as well as MariaDB.

Installing PHP

Next thing we want to install is PHP. We need to install PHP with a few extensions that are mandatory for modern web applications.

sudo apt install php-cli php-fpm php-zip php-xml php-mbstring php-mcrypt php-curl php-gd php-mysql php-bz2 php-gettext php-pear php-phpseclib php-tcpdf

We may run php -v in the terminal to check the version of PHP installed.

Configuring Nginx

We don't need to change anything right now. But if we want to, we can change the main configuration of Nginx as follows:

sudo gedit /etc/nginx/nginx.conf

In the config file, notice the line with user nginx. This means Nginx will run as the user nginx. We should not forget to run sudo systemctl restart nginx.service if we make changes to any configuration file of Nginx.

Configuring PHP to work with Nginx

In order for PHP and Nginx to work together, we need to configure both of them. We need to make sure that PHP-FPM (FastCGI Process Manager) runs as the same user as Nginx. And for that we need to run sudo gedit /etc/php/7.1/fpm/pool.d/www.conf in the terminal and change the relevant lines as:

...
user = nginx
group = nginx
...
listen.owner = nginx
listen.group = nginx
...

Note the command where we used ... php/7.1/fpm ... . We want to make sure that 7.1 is the version that we actually have installed in our system. Refer this section to go back and see how we installed PHP and PHP-FPM, and how to see the version of PHP installed.

We need to run sudo systemctl restart php7.1-fpm.service in the terminal to load the new configuration.

Default Site

Now comes the fun part where we create a default site that supports PHP. In our case, we want ~/www as our directory of all websites. Normally, /var/www is used as the default one. Here we want to change it to a custom directory inside our home directory, as mentioned above.

First, we want to make sure the directory exists. Let's create a default site directory _default_ with command mkdir -p ~/www/_default_/public.

Note that to add other sites, we can follow a similar pattern. We may create a new folder for each site, which has a public folder in it as the public entry point of the site.

Now to edit the default site configuration, let's run the following command in the terminal

sudo gedit /etc/nginx/conf.d/default.conf

and replace its content with this:

server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /home/[OUR_USERNAME]/www/_default_/public;

    index index.html index.htm index.php;

    server_name _;

    location / {
        try_files $uri $uri/ =404;
        autoindex on;
    }

    location ~ \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php/php7.1-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }

}

Please note that we need to change [OUR_USERNAME] from above config file to our actual username.

Now let's run sudo systemctl restart nginx.service to reload our new configuration.

Now we should be able to see on browser that http://localhost actually works, and most probably shows an empty index.

**Ba Dum Tis**

We can put any file in the ~/www/_default_/public directory and it should be showing in the browser after a refresh.

Configuring MariaDB

This one is easy. Let's open our terminal and run sudo mysql_secure_installation. We just need to carefully follow all of the prompts and we will properly set up MariaDB.

Installing phpMyAdmin

Setting Up Host

We want to be able to lunch phpMyAdmin by going to http://phpmyadmin.app in the address bar of the browser.

So, first of all, run sudo gedit /etc/hosts and add an entry as follows:

127.1.1.1    phpmyadmin.app

phpMyAdmin

Run the following commands to install phpmyadmin:

sudo apt install phpmyadmin

NOTE: We will press [tab] when asked which web server we have. This is because phpMyAdmin does not provide us with an option for Nginx. We will continue all other setup as usual. Also, when prompted for a password by phpmyadmin, we can insert any random password we want.

Setting Up Server Block

Now, we will setup an Nginx server block (a.k.a. virtual host in Apache httpd).

Let's run the command sudo touch /etc/nginx/conf.d/phpmyadmin.conf to create a site (configuration file).

Let's open it with sudo gedit /etc/nginx/conf.d/phpmyadmin.conf and add the contents as follows.

server {
    listen 80;

    root /usr/share/phpmyadmin; # make sure to enter the correct location of phpmyadmin here
    index index.php index.html index.htm;

    server_name phpmyadmin.app;

    location / {
        try_files $uri $uri/ /index.php?$query_string;
    }

    location ~ \.php$ {
        try_files $uri /index.php =404;
        fastcgi_split_path_info ^(.+\.php)(/.+)$;
        fastcgi_pass unix:/run/php/php7.1-fpm.sock;
        fastcgi_index index.php;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

Activating the server block

Now we have to restart Nginx to activate our new site (config file) by running:

sudo systemctl restart nginx.service

Try hitting http://phpmyadmin.app and it should work!

Conclusion

There we have it! We should by now have a working and relatively secure LEMP server stack with Nginx running at http://localhost, as well as our phpMyAdmin app running at http://phpmyadmin.app

In this guide we didn't talk anything about firewall. This is because a fresh install of "vanilla" Ubuntu 16.04 should not have one running it automatically. We may research about it later if we wish to. Right now, that would be beyond the scope of this guide.

So, did you find this guide helpful? Feedbacks are precious. Suggestions are highly appreciated.

`pc@aspire ~ $ sudo apt install nginx`

Reading package lists... Done
Building dependency tree       
Reading state information... Done
Some packages could not be installed. This may mean that you have
requested an impossible situation or if you are using the unstable
distribution that some required packages have not yet been created
or been moved out of Incoming.
The following information may help to resolve the situation:

The following packages have unmet dependencies:
 nginx : Depends: libssl1.0.0 (>= 1.0.2~beta3) but 1.0.1f-1ubuntu2.15 is to be installed
E: Unable to correct problems, you have held broken packages.

I've got this error message in my Linuxmint 17.3

[SOLVED] My package was older. sudo apt update/upgrade worked for me now.