A LAMP Server on Ubuntu 10.04 in One Coffee

Ubuntu 10.04 LTS came out on April 29, and for anyone who runs their own small web server, the LTS part is what matters. The Server Edition gets five years of support, so whatever you set up now can sit there quietly until 2015 without a forced upgrade.

It also ships a current stack. The 10.04 server CD carries Apache 2.2.14, PHP 5.3.2 and MySQL 5.1.41, which means closures, namespaces and the rest of PHP 5.3 without adding a third party repository.

Here’s the short path from a fresh install to a working LAMP box, and the handful of settings worth changing before you point a domain at it.

One command for the whole stack

Ubuntu groups common server roles into tasks, and one of them is literally called LAMP server. It pulls in Apache, MySQL, PHP with the Apache module, and the PHP MySQL driver.

sudo apt-get update
sudo tasksel install lamp-server

If you’d rather pick from a menu, run sudo tasksel on its own and tick LAMP server. Either way, when it finishes you have Apache serving /var/www and PHP wired into it. Drop a phpinfo() file in there, load it in a browser to confirm everything is talking, and then delete it, because it tells anyone who finds it far more about your server than they need to know.

Lock down MySQL

A fresh MySQL install is set up for convenience, not for the internet. MySQL ships a script that fixes the usual problems in one pass.

sudo mysql_secure_installation

It asks for the current root password, then offers to set one if you haven’t, remove the anonymous user accounts, stop root from logging in remotely, drop the test database and the privileges that let anyone use it, and reload the privilege tables so the changes take effect right away. Say yes to all of them. The script itself says running every step is recommended for any MySQL server in production use, and for a single box running a web app, I can’t think of a reason to keep any of those defaults.

While you’re at it, give each app its own MySQL user that only has rights on its own database. Your PHP code shouldn’t be connecting as root.

Turn on mod_rewrite

Nearly every PHP framework and CMS wants pretty URLs, and Ubuntu’s Apache package leaves mod_rewrite installed but not enabled. Debian and Ubuntu use small helper scripts for this instead of hand editing httpd.conf.

sudo a2enmod rewrite
sudo /etc/init.d/apache2 restart

One more thing trips people up here. The default site in /etc/apache2/sites-available/default sets AllowOverride None for /var/www, so any .htaccess file your app ships with is ignored. You can change that for your app’s directory, or better, put the rewrite rules in a <Directory> block in the site config itself.

Say less about yourself

Out of the box, this server is chatty. Ubuntu’s /etc/apache2/conf.d/security sets ServerTokens OS, so every response’s Server header names the exact Apache version and the operating system. It also sets ServerSignature On, which adds a footer line with the server version to pages Apache generates itself, like its error pages. Change both in that file.

ServerTokens Prod
ServerSignature Off

With ServerTokens Prod, Apache’s ServerTokens directive sends just Apache with no version. The same file already sets TraceEnable Off, so that one’s done for you.

PHP has its own version of this. /etc/php5/apache2/php.ini comes with expose_php turned on, which adds an X-Powered-By header with the PHP version to every PHP response and adds PHP to Apache’s version string too. Turn it off.

expose_php = Off

Restart Apache once more and check the headers with curl -I against one of your PHP pages. None of this makes the server secure on its own. Hiding a version number doesn’t patch anything, and the real protection is installing security updates promptly. But there’s no reason to hand out a shopping list to anyone scanning for a specific vulnerable version.

The takeaway

On 10.04, a LAMP server is two commands for the stack, one script for MySQL, one for mod_rewrite, and a couple of lines of config so it stops announcing its version numbers. That fits comfortably inside one coffee. The part that takes longer is the part that matters most over the next five years: run sudo apt-get update && sudo apt-get upgrade regularly, or you’ve built a very tidy server that slowly becomes an easy target.