How to create a secure website on Ubuntu 22.04

9/19/2022

This how-to is for someone who wants a list of all the terminal commands needed to create a LAMP WordPress site with SSL. This document in its current form as of 9/19/2022 assumes that you know how to perform basic navigation within Windows and Linux which includes opening, closing windows and selecting items. It also assumes that you have port forwarding configured and optionally have a domain name configured and pointing to your web server. Even if you do not have those things configured, you can still jump to specific steps to install and configure individual components for your particular environment.

We will cover the Installation and Configuration of:

1. A Microsoft Hyper-V Virtual Machine
2. Ubuntu operating system
3. Apache web server
4. MySQL database
5. PHP hypertext preprocessor
6. Certbot SSLs from Let’s Encrypt

• Prerequisites:
  • A computer or VM with:
    • 2 GHz Dual core processor or better
    • 4 GB RAM
    • 25 GB HDD
    • For additional details about system requirements, click here
  • Familiarity with the Linux Terminal
  • Download Linux Operating System (OS): Ubuntu 22.04 LTS ISO x64 architecture, click here
  • A router with the ability to configure port forwarding (optional)
  • Internet Access (optional)
• Items not covered:
  • Selecting a domain name
  • Registering a domain name
  • Configuring Name Servers to point to your router
  • Configuring port forwarding on your router to redirect web traffic from ports 80 and 443 to your web server
• Procedure
  • Create a new VM with:
    • 4096 MB RAM and disable Dynamic Memory
    • 25 GB HDD
    • Two Cores
    • Mount .ISO image
    • Startup VM
  • Install Ubuntu Desktop 22.04
    • steps would be nice!
  • Update and Upgrade OS
    • sudo apt-get update
    • sudo apt-get upgrade
  • Install Apache
    • sudo apt install -y apache2 apache2-utils
    • sudo apache2 -v
  • Install MySQL
    • sudo apt install -y mariadb-server mariadb-client
    • sudo mysql_secure_installation
  • Configure MySQL
    • Unix Socket, N
    • Change Root password, N
    • Remove anonymous users, Y
    • Disallow root login remotely, Y
    • Remove test database, Y
    • reload privileges, Y
  • Install PHP
    • sudo apt install -y php php-mysql libapache2-mod-php
    • sudo systemctl restart apache2
  • Configure MySQL database
    • sudo mysql -u root -p
    • Set a root PW
      • If this an actual step, set the MySQL Root PW
    • create database wordpress;
    • GRANT ALL PRIVILEGES ON wordpress.* TO ‘root’@’localhost’ IDENTIFIED BY ‘YOURPASSWORD’;
    • SELECT VERSION();
      • Optional, if you want to know the version of MySQL
    • Exit
  • Get Web Server status
    • systemctl status apache2
    • hostname -I
    • make a note of the IP Address
  • Test Web Server
    • connect to the IP address, ex: http://youripaddress
    • echo "<?php phpinfo(); ?>" | sudo tee /var/www/html/phpinfo.php
    • Browse to: http://youripaddress/phpinfo.php
    • *A YouTube site with good information
  • Download latest WordPress
    • cd /var/www/html
    • sudo wget http://wordpress.org/latest.tar.gz
  • Extract WordPress
    • sudo tar xzf latest.tar.gz
  • Configure WordPress directories and permissions
    • sudo mv wordpress/* .
    • sudo rm -rf wordpress latest.tar.gz
    • ls -al
    • sudo chown -R www-data: .
    • ls -al
    • sudo rm index.html phpinfo.php
  • Configure WordPress
    • Browse to: http://youripaddress/index.php
      • It is called a Famous 5 minute install
    • Import backup file
  • Install, Configure and run certbot
    • *Requires a 64 bit Linux architecture
    • sudo snap install core; sudo snap refresh core
    • sudo snap install –classic certbot
    • sudo ln -s /snap/bin/certbot /usr/bin/certbot
  • Obtain certificate
    • *Ensure that port forwarding was already configured in advance and the domain is pointing to that computer or VM
    • sudo certbot –apache
    • Make a note of new site name with SSL configuration
  • Change website from port 80 to port 443
    • sudo a2dissite 000-default.conf
    • Sudo a2ensite your-new-site.conf
      • your-new-site.conf is the name of the site that Certbot provided
    • systemctl reload apache2
    • systemctl status apache2