This document provides instructions for configuring various server applications and services on a Linux server including Apache, PHP, MySQL, FTP, SSL, IPTables, PHPMyAdmin, and server monitoring. It discusses installing and configuring each of these applications and services individually with specific configuration details. The document is intended to provide a complete solution for setting up these common LAMP stack components and services on a Linux server.

1. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 1
Configuring Apache, PHP, MySQL, FTP, SSL, IPTables
PHPMyadmin and Server Monitoring Complete Solution
Documented By Chanaka Lasantha Nanayakkara
Email : chanaka.lasantha@gmail.com
Mob : 071-1381308
Contents
Setting Up Ips, Repos and Nameserver info 01
Installing and Config Apache Web Server 02
Installing and Config PHP 03
Installing and Config SSL 04
Installing and Config MySQL 05
Installing and Config PHPmyadmin 06
Installing and Config FTP Server 07
Installing and Config DDNS Client 08
Configuring IPTables Firewall 09
Installing and Config Web Server Monitoring 10

2. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 2
Setting Up Ips, Repos and Nameserver info
Date:
date -s "9 AUG 2013 11:32:08"
Time:
date +%T -s "11:32:08"
## RHEL/CentOS 6 32-Bit ##
wget http://download.fedoraproject.org/pub/epel/6/i386/epel-release-6-8.noarch.rpm
rpm -ivh epel-release-6-8.noarch.rpm
## RHEL/CentOS 6 64-Bit ##
wget http://download.fedoraproject.org/pub/epel/6/x86_64/epel-release-6-8.noarch.rpm
rpm -ivh epel-release-6-8.noarch.rpm
Preparing... ###################################### [100%]
1:epel-release ###################################### [100%]
sed -i -e "s/enabled=1/enabled=0/g" /etc/yum.repos.d/epel.repo
# when you use the repository, input yum command like follows
yum --enablerepo=epel install xayhsdhsd
Installing Apache Web Server
yum -y install httpd
rm -f /etc/httpd/conf.d/welcome.conf
rm -f /var/www/error/noindex.html
ln -s /usr/bin/perl /usr/local/bin/perl
Configure httpd
vim /etc/httpd/conf/httpd.conf
# line 44: change
ServerTokens Prod
# line 74: change to ON
KeepAlive On
# line 251: Admin's address
ServerAdmin root@myweb.com
# line 265: change to your server's name
ServerName www.myweb.com:80
# line 320: change (enable CGI and disable Indexes)
Options FollowSymLinks ExecCGI
# line 327: change
AllowOverride All
# line 391: add file name that it can access only with directory's name
DirectoryIndex index.html index.cgi index.php
# line 524: change

3. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 3
ServerSignature Off
# line 747: make it comment
#AddDefaultCharset UTF-8
# line 778: uncomment and add file-type that apache looks them CGI
AddHandler cgi-script .cgi .pl
/etc/rc.d/init.d/httpd start
chkconfig httpd on
Installing PHP
yum -y install php php-mbstring php-pear
vim /etc/httpd/conf/httpd.conf
# line 402: add file name that it can access only with directory's name
DirectoryIndex index.html index.php
vim /etc/php.ini
# line 946: set your timezone
date.timezone = "Asia/Colombo"
/etc/rc.d/init.d/httpd restart
Create a your server's original SSL Certificate.
cd /etc/pki/tls/certs
make server.key
openssl rsa -in server.key -out server.key
make server.csr
openssl x509 -in server.csr -out server.crt -req -signkey server.key -days 3650
chmod 400 server.*
Configration of SSL
yum -y install mod_ssl
vim /etc/httpd/conf.d/ssl.conf
# line 84: uncomment
DocumentRoot "/var/www/html"
# line 85: uncomment and specify server name
ServerName www.myweb.com:443
# line 112: specify certificate
SSLCertificateFile /etc/pki/tls/certs/server.crt
# line 119: specify certification key
SSLCertificateKeyFile /etc/pki/tls/certs/server.key
/etc/rc.d/init.d/httpd restart

4. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 4
Installing MySQL
yum -y install mysql-server
/etc/rc.d/init.d/mysqld start
chkconfig mysqld on
/usr/bin/mysql_secure_installation
Log in MySQL as root
mysql -uroot -p
Installing PHPmyadmin
yum --enablerepo=epel -y install phpMyAdmin php-mysql php-mcrypt # install from EPEL
vi /etc/httpd/conf.d/phpMyAdmin.conf
# line 13: add IP address you permit
Allow from 127.0.0.1 10.0.0.0/24
/etc/rc.d/init.d/httpd reload
Access to 'http://192.168.2.204/phpmyadmin' with web browser, then following screen is shown. Login with a user in
MySQL.
Installing FTP Server
use existing group to provide access on shared directory:
groupadd ftpusers
chgrp -R ftpusers /var/www/html
chmod -R 777 /var/www/html # This is Optional
useradd chanaka
usermod -G ftpusers chanaka
passwd chanaka
chown -R chanaka: chanaka /var/www/html # This is Optional
yum -y install vsftpd
vim /etc/vsftpd/vsftpd.conf
# line 12: no anonymous
anonymous_enable=NO
# line 80,81: uncomment ( allow ascii mode )
ascii_upload_enable=YES
ascii_download_enable=YES
# line 95, 96: uncomment ( enable chroot )
chroot_local_user=YES
chroot_list_enable=YES
# line 98: uncomment ( specify chroot list )
chroot_list_file=/etc/vsftpd/chroot_list
# line 104: uncomment

5. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 5
ls_recurse_enable=YES
# add at the last line
# specify root directory ( if don't specify, users' home directory become FTP home directory)
local_root=/var/www/html
# use localtime
use_localtime=YES
vim /etc/vsftpd/chroot_list
# add users you allow to move over their home directory
chanaka
Sameera
Admin
/etc/rc.d/init.d/vsftpd start
Starting vsftpd for vsftpd: [ OK ]
chkconfig vsftpd on
Installing DDNS Client
Domain Transfer Guide (Inbound)
In order to transfer a domain from your current registrar you will need your Authorization/EPP code. Contact your
current registrar for this code and have them release/unlock your domain. Once you receive your Authorization/EPP
code and your domain is released you can request a transfer from your No-IP account.
If your account does not already have valid contact information you should do this first. This can be set by going to
“Domain Registration” and then click the “Domain Contact” link on the left-hand navigation bar. Enter your contact
information (all fields with an asterisk ‘*’ are required). Once your contact information is entered click “Create
Contact.”
To request a domain transfer go to the “Domain Registration” tab and click “Transfer Domain.” Type your domain into
the box. If you have multiple domains that you wish to transfer you can enter them in box labeled “Domains to
Transfer,” simply separate the domains by using a space (as specified).
Note, the following specifications need to be met before proceeding (for each domain):
· There is a valid email address you can access for its registrant contact
· The domain name has been registered more than 60 days
· Any lock or hold at your current registrar has been removed
· For .com, .net, .org, .biz, .info, .tv, .cc, .me, .us, and .co you have the Authorization Code (EPP Key) for domain
transfers from your current registrar.
Once your domains have been entered click “Next.” Specify the DNS package you will be using for your domain. Enter
the current Registrants email address for the domains you are transferring. Then enter the Auth/EPP codes for each
domain you will be transferring (these are case sensitive) then click “Next.” Verify the “Post-transfer Contact
Information” and then click “Next” again.

6. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 6
Your request will need to be activated before it is completed. To do this click “Activate Now” and then select the
service that you will need from the “Renew/Activate” and follow the check out process. Domain’s that can be
transferred and pricing can be viewed here.
Once you have paid we will send a verification email to the email address of the current owner listed on the Whois
database. Please follow the instructions in that email to approve the transfer. When the transfer request has been
made your current registrar will process the request (this can take up to seven days, after the seven days, the transfer
will become automatic).
Please monitor the status of your Domain Transfer by going to the “Domain Registration” and clicking on “Manage
Transfers.” A successful request will have the status of “Requested.” A completed transfer will have the status of
“Complete.” Once the transfer is completed and approved by your domain name registrar please allow 24-48 hours for
the DNS information to propagate globally. Once this process is complete No-IP will be the registrar and the DNS
provider for your domain/s.
Install “Make” compiler program in preparation to compile the no-ip program. You might also have to install the
“GCC” compiler if “Make” compiler don’t work; I have both GCC and Make installed. The following is the commands
to download &install them:
yum install gcc
yum install make
Now onto the easy step-by-step installation of no-ip client. Run the following 6 commands from the terminal:
mkdir noip && cd noip
wget http://www.no-ip.com/client/linux/noip-duc-linux.tar.gz
tar zvxf noip-duc-linux.tar.gz
cd noip-2.1.9-1
make
make install
Please enter the login/email string for no-ip.com (email account that you used to set-up no-ip account)
Please enter the password for user(password that you used to login to no-ip)
Please enter an update interval: [30] 30
(Increments in minutes that you want no-ip client to check if your router’s external dynamic IP address has changed
and updates it accordingly.)
Do you wish to run something at successful update? *N+ (y/N) N(Just enter “N” here.)
/usr/local/bin/noip2(To start/run noip client)
echo ‘/usr/local/bin/noip2′ >> /etc/rc.local(To start/run noip client after each system reboot
More useful no-ip commands
 /usr/local/bin/noip2 -C to configure noip client
 /usr/local/bin/noip2 -S to display info about running noip client
 /usr/local/bin/noip2 -U to set update intervals (in minutes)

7. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 7
Enable IP Forwarding (Highly Important!)
If you want your OpenVPN clients to be able to access the network, in addition to the push routes statements above
you will need to setup ip forwarding for the tunnel interface and change the 0 to a 1.
vim /etc/sysctl.conf
# ------ Edit the following line changing the 0 to a 1 -----
net.ipv4.ip_forward = 1
Save and close the file. Reload the changes by typing the following command:
Or
echo 1 > /proc/sys/net/ipv4/ip_forward
sysctl -p
Configuring IPTables Firewall
service iptables start
iptables --flush
iptables --table nat -–flush
iptables --delete-chain
service iptables save
service iptables restart
service network restart
iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -p icmp -m limit --limit 1/s --limit-burst 2 -j ACCEPT
iptables -A INPUT -p icmp -j ACCEPT
iptables -A OUTPUT -p icmp -j ACCEPT
iptables -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m state --state NEW,ESTABLISHED,RELATED -j ACCEPT
iptables -A INPUT -m state --state INVALID -j DROP
iptables -A OUTPUT -m state --state INVALID -j DROP
iptables -A INPUT -m state --state NEW -p tcp --tcp-flags ALL ALL -j DROP
iptables -A INPUT -m state --state NEW -p tcp --tcp-flags ALL NONE -j DROP
iptables -A INPUT -p tcp --tcp-flags ALL FIN,URG,PSH -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,RST SYN,RST -j DROP
iptables -A INPUT -p tcp --tcp-flags SYN,FIN SYN,FIN -j DROP
iptables -N SYN_FLOOD
iptables -A INPUT -p tcp --syn -j SYN_FLOOD
iptables -A SYN_FLOOD -m limit --limit 2/s --limit-burst 6 -j RETURN
iptables -A SYN_FLOOD -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type address-mask-request -j DROP
iptables -A INPUT -p icmp -m icmp --icmp-type timestamp-request -j DROP
iptables -A INPUT -p icmp -m icmp -m limit --limit 1/second -j ACCEPT

8. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 8
iptables -A INPUT -p tcp -m tcp --tcp-flags RST RST -m limit --limit 2/second --limit-burst 2 -j ACCEPT
iptables -A INPUT -m recent --name portscan --rcheck --seconds 86400 -j DROP
iptables -A FORWARD -m recent --name portscan --rcheck --seconds 86400 -j DROP
iptables -A INPUT -m recent --name portscan --remove
iptables -A FORWARD -m recent --name portscan –remove
iptables -A INPUT -s 0.0.0.0/7 -j DROP
iptables -A INPUT -s 2.0.0.0/8 -j DROP
iptables -A INPUT -s 5.0.0.0/8 -j DROP
iptables -A INPUT -s 7.0.0.0/8 -j DROP
iptables -A INPUT -s 10.0.0.0/8 -j DROP
iptables -A INPUT -s 23.0.0.0/8 -j DROP
iptables -A INPUT -s 27.0.0.0/8 -j DROP
iptables -A INPUT -s 31.0.0.0/8 -j DROP
iptables -A INPUT -s 36.0.0.0/7 -j DROP
iptables -A INPUT -s 39.0.0.0/8 -j DROP
iptables -A INPUT -s 42.0.0.0/8 -j DROP
iptables -A INPUT -s 49.0.0.0/8 -j DROP
iptables -A INPUT -s 50.0.0.0/8 -j DROP
iptables -A INPUT -s 77.0.0.0/8 -j DROP
iptables -A INPUT -s 78.0.0.0/7 -j DROP
iptables -A INPUT -s 92.0.0.0/6 -j DROP
iptables -A INPUT -s 96.0.0.0/4 -j DROP
iptables -A INPUT -s 112.0.0.0/5 -j DROP
iptables -A INPUT -s 120.0.0.0/8 -j DROP
iptables -A INPUT -s 169.254.0.0/16 -j DROP
iptables -A INPUT -s 172.16.0.0/12 -j DROP
iptables -A INPUT -s 173.0.0.0/8 -j DROP
iptables -A INPUT -s 174.0.0.0/7 -j DROP
iptables -A INPUT -s 176.0.0.0/5 -j DROP
iptables -A INPUT -s 184.0.0.0/6 -j DROP
iptables -A INPUT -s 192.0.2.0/24 -j DROP
iptables -A INPUT -s 197.0.0.0/8 -j DROP
iptables -A INPUT -s 198.18.0.0/15 -j DROP
iptables -A INPUT -s 223.0.0.0/8 -j DROP
iptables -A INPUT -s 224.0.0.0/3 -j DROP
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT
iptables -A INPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW -m tcp --dport 53 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW -m tcp --dport 80 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW -m tcp --dport 443 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW -m tcp --dport 22 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW -m tcp --dport 21 -j ACCEPT

9. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 9
iptables -A OUTPUT -p tcp -m state --state NEW -m tcp --dport 3306 -j ACCEPT
iptables -I FORWARD -s 0.0.0.0/0 -m string --string “%27+or+%271%27%3d%271” --algo bm -j DROP
iptables -I FORWARD -s 0.0.0.0/0 -m string --string “%27+or+1%3d1” --algo bm -j DROP
iptables -I FORWARD -s 0.0.0.0/0 -m string --string “%27+or+%271%27%3d%271” --algo bm -j DROP
iptables -I FORWARD -s 0.0.0.0/0 -m string --string “%27+or+%27%27%3d%27” --algo bm -j DROP
iptables -I FORWARD -s 0.0.0.0/0 -m string --string “%27+or+1%3d1” --algo bm -j DROP
iptables -I FORWARD -s 0.0.0.0/0 -m string --string “%27+or+%271%27%3d%271” --algo bm -j DROP
iptables -I FORWARD -s 0.0.0.0/0 -m string --string “%27+or+%27%27%3d%27” --algo bm -j DROP
iptables -I FORWARD -s 0.0.0.0/0 -m string --string “%27+or+1%3d1” --algo bm -j DROP
iptables -I FORWARD -s 0.0.0.0/0 -m string --string “%27+or+%271%27%3d%271” --algo bm -j DROP
service iptables save
service iptables restart
service network restart
/sbin/iptables -L
iptables -L -t nat –n
iptables -vnL
Installing Web Server Monitoring
yum -y install graphviz
wget http://www.hping.org/visitors/visitors-0.7.tar.gz
tar zxvf visitors-0.7.tar.gz
cd visitors_0.7
make
cp visitors /usr/local/bin/
cd
mkdir /var/www/html/visitors
vim /etc/httpd/conf.d/visitors.conf
# create new
<Location /visitors>
Order Deny,Allow
Deny from all
Allow from 10.0.0.0/24 # IP address you allow
</Location>
/etc/rc.d/init.d/httpd restart
Stopping httpd: [ OK ]
Starting httpd: [ OK ]
# generate common reports
visitors -A /var/log/httpd/access_log -o html > /var/www/html/visitors/index.html
--
11 lines processed in 1 seconds
0 invalid lines, 0 blacklisted referers
# generate page tour reports
visitors -A -m 30 /var/log/httpd/access_log -o html --trails --prefix http://www.myweb.com >
/var/www/html/visitors/trails.html
--

10. Configuring Apache, PHP, MySQL, FTP, SSL, IPTables PHPMyadmin and Server Monitoring Complete Solution 10
11 lines processed in 1 seconds
0 invalid lines, 0 blacklisted referers
# generate page tour image
visitors /var/log/httpd/access_log --prefix http://www.myweb.com -V > /var/www/html/visitors/graph.dot
--
11 lines processed in 1 seconds
0 invalid lines, 0 blacklisted referers
dot -Tpng /var/www/html/visitors/graph.dot > /var/www/html/visitors/graph.png
Access to 'http://(your server's name or IP address)/visitors/'
http://(your server's name or IP address)/visitors/graph.png
Remort Login to the Web Server with Putty