Many of new system administrators forgot to apply security when configuring web hosting environment for production use with Apache, MySQL, and PHP. I am trying to include all those security tips which we must be considered while preparing a new system for production use or any existing LAMP setup.

Nearly every LAMP shop uses some flavor or variant of the basic LAMP stack. For beginners, setting up a custom stack may take a few days of scouring the Internet. True, packages like XAMPP may make it simple to get a service stack up on top of the OS, but going from nothing to OS, server, scripts, and database may not be possible in one go.

10 Reliable Linux Server Distributions and LAMP / LEMP Stack Manuals. June 30, 2015 - E-Commerce, Fire development. Today we are going to talk about Linux server distributions. The open-source nature of Linux is the main reason for the wide variety of available distros. Each Linux distribution is designed with a slightly different set of features.
LAMP Stack is a software stack which is very common in web development. LAMP stands for Linux, Apache, MySQL and (PHP/Perl/Python), and makes up the integral parts of the software stack. Each of these components are layered to support each other and create a coherent base for developing web applications. The term LAMP stack was coined in 1998 by Michael Kunze and the stack has seen massive.

LAMP Installation Tutorials:
How to Install LAMP Stack on CentOS/RHEL 7
How to Install LAMP Stack on CentOS/RHEL 6/5
How to Install LAMP Stack on Ubuntu & Debian

All the configuration changes are used in this article will be updated in following configuration files as per your operating systems. In some cases, configuration files path may change. So make the change in appropriate files. After making changes restart related services to change take effect.

For Ubuntu, Debian & LinuxMint:

Apache2: /etc/apache2/apache2.conf
PHP: /etc/php/[VERSION]/apache2/php.ini
MySQL: /etc/mysql/my.cnf or /etc/mysql/mysql.conf.d/mysqld.cnf

For CentOS, RedHat & Fedora:

Apache: /etc/httpd/conf/httpd.conf
PHP: /etc/php.ini
MySQL: /etc/my.cnf

#1. Hiding Version and OS Identity (Apache)

The ServerTokens directive controls whether Server response header field which is sent back to clients. The ServerSignature configures the footer on server-generated documents. Edit Apache configuration file and update following directives as following.

#2. Disable Directory Listing (Apache)

If directory listing is enabled in Apache. Then all the files and directories list will be shown on the web page if no default document exists. Add following configuration in Apache to disable directory listing server wide.

After that, you can enable listing per directory basis if required.

#3. Restricting File and Directory Access (Apache)

Restricting access on basis of Directory, File the Location in Apache.

Restrict Directory

To restrict directory and files access from users, It will only allowed the ips are defined with Allow from.

Restrict File

We can also restrict specific file using File directive like below.

Restrict Location

The Location directive limits the scope of the enclosed directives by URL.

#4. Disable Server Side Includes and CGI (Apache)

We can simply disable server-side includes and CGI execution by defining directory tag. Add below in Apache virtual host configuration file.

#5. Restrict PHP Information Leakage (PHP)

By default, PHP installation exposes to the world that PHP is installed on the server, which includes the PHP version within the HTTP header (Eg: X-Powered-By: PHP/5.4.20). Read More

To hide this values from header edit php.ini and update below directive to Off

#6. Disable Remote Code Execution (PHP)

If allow_url_fopen is enabled on your setup, It allows ile functions like file_get_contents() and the include and requires statements which can retrieve data from HTTP or FTP remote locations and execute their code.

#7. Disable Dangerous PHP Functions (PHP)

We can disable any PHP function using the disable_functions directive in PHP configuration file. Disable all the functions which can be harmful and not used in applications.

#8. Limit PHP Access To File System (PHP)

The open_basedir directive set the directories from which PHP is allowed to access files

Best Lamp Stack For Windows

#9. Disable Unused PHP Modules (PHP)

PHP supports “Dynamic Extensions” to load in the PHP environment. We can disable any unused module to load in the system by changing configuration file name.

#10. Enable Limits in PHP (PHP)

To allow users to upload files of maximum size, update following configuration value.

Maximum execution time of each script

Maximum amount of time each script may spend parsing request data

#11. Restrict Remote MySQL Access (MySQL)

If your application environment does not require to access the database remotely, then disable all remote connections for the database server. The easier way to do it force MySQL server to listen only on 127.0.0.1 (localhost).

Edit MySQL configuration file and update following value.

#12. Disable use of LOCAL INFILE (MySQL)

Enabling LOCAL INFILE can be dangerous for your system security. If LOCAL INFILE is enabled on the server, a user can load any file ( like /etc/passwd, /etc/shadow ) to a table easily.

To disable this edit MySQL configuration file and add following value under [mysqld] section.

Best Lamp Stack For Mac

#13. Create Application Specific User in MySQL (MySQL)

Do not use MySQL ‘root’ user for accessing the database through the application. It can be dangerous for your system. So make sure to create and use an application-specific user with limited access to application database only. To create MySQL account use following command.

#14. Improve Security with mysql_secure_installation (MySQL)

After installing MySQL mysql_secure_installation command is very useful for securing MySQL server. This command will also enable password protection on root user.

#15. Write Protect Configuration Files (Apache/MySQL/PHP)

In this section we are protecting all our server configuration files used in LAMP Stack, So than no one can change these files.

Remember than after enabling write protection no user including root can update these file. In case you need to update any of file disable write protection first using following command.

We will keep updating useful LAMP security tips for this article. We also request you to suggest tips by adding them in comments.