Setup WordPress with Apache, PHP and MySQL on Ubuntu

Install PHP

Install the PHP Packages

sudo apt-get install php5

As of Ubuntu 12 (an maybe even earlier), the installer will automatically restart Apache2 for you.

Verify

Quickly verify that everything works by creating a php info file with your favourite editor,

sudo vi /var/www/info.php # On public site do not use such an obvious file name

Put in the following contents,

<?php
phpinfo();
?> 

Save the file and browser to file using a browser. You can use either the IP Address or the valid Domain Name. For example, http://173.194.75.94/info.php or http://www.krypton.com/info.php which should show a purple and grey PHP informational screen.

Secure the PHP

The security posture is from an administrative perspective and with shared hosting.

Restrict the Execution of PHP to a Specific Folder

Edit php.ini to only allow execution of php scripts in specific directories.

sudo, edit, vi /etc/php5/apache2/php.ini

Search the open_basedir line and modify,

; open_basedir, if set, limits all file operations to the defined directory
; and below.  This directive makes most sense if used in a per-directory
; or per-virtualhost web server configuration file. This directive is
; *NOT* affected by whether Safe Mode is turned On or Off.
; http://php.net/open-basedir
open_basedir = /opt/www.krypton.com/www/blog/:/opt/www.earth.com/www/blog/

This helps minimizes the amount of damage that can be done in the event that the system is compromised to the specified directory.

Restart Apache for the changes to take effect,

sudo service apache2 restart

You will now find that php scripts will only run in the designated directories specified in php.ini.

Install MySQL

sudo apt-get install mysql-server 

For the root administration database password, use the standard password algorithm based on the server name.

Connect PHP to MySQL

Install the necessary libraries so that PHP will be able to connect to MySQL.

sudo apt-get install php5-mysql 

Configure MySQL

Secure MySQL

As a staff user run the Secure Installation script included with MySQL,

mysql_secure_installation

The prompts are very straightforward. Except for "Change the Root password?", answer yes to all prompts by hitting Enter,

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MySQL to secure it, we'll need the current
password for the root user.  If you've just installed MySQL, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.
Enter current password for root (enter for none): 
OK, successfully used password, moving on...
Setting the root password ensures that nobody can log into the MySQL
root user without the proper authorisation.
You already have a root password set, so you can safely answer 'n'.
Change the root password? [Y/n] n
 ... skipping.
By default, a MySQL installation has an anonymous user, allowing anyone
to log into MySQL without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.
Remove anonymous users? [Y/n] 
 ... Success!
Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.
Disallow root login remotely? [Y/n] 
 ... Success!
By default, MySQL comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.
Remove test database and access to it? [Y/n] 
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!
Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.
Reload privilege tables now? [Y/n] 
 ... Success!
Cleaning up...
All done!  If you've completed all of the above steps, your MySQL
installation should now be secure.
Thanks for using MySQL! 

For now that's it to securing MySQL.

Connect

Connect into MySQL,

mysql -u root -p 

The password to use is the password set during the MySQL install. If everything goes well you will be in the MySQL shell,

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 36
Server version: 5.5.24-0ubuntu0.12.04.1 (Ubuntu)
Copyright (c) 2000, 2011, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql>

The remainder of this section happens inside of the mysql shell.

Create the WordPress Database and Accounts in MySQL

Enter the following MySQL commands,

CREATE DATABASE wpkryptondb;
GRANT ALL PRIVILEGES ON wpkryptondb.* TO 'wpkryptonuser'@'localhost' IDENTIFIED BY 'password';
FLUSH PRIVILEGES;

Adjust the variables for your application.

wpkryptondb - Name of the database for the WordPress application instance. We use the domain name of the website.

wpkryptonuser - User account for accessing the database.

localhost - Address of the database server. In this example, the database is on the same server so use localhost.

password - Change to password using algorithm based on name of the website domain, in this case krypton.

Exit MySQL Shell

Exit the MySQL shell,

EXIT

Setup WordPress

WordPress is incredibly easy to setup and there are many shorter tutorials than this.

This tutorial, takes a more secure approach

Install WordPress

Using a staff account, download and install WordPress,

cd /opt/www.krypton.com/www/
wget http://wordpress.org/latest.tar.gz
tar -xvpf latest.tar.gz
mv ./wordpress/ ./blog/ # We do not need to make the technology obvious.

Setup File Permissions

There is no need to setup file permissions if you have followed the Bonsai Framework Apache Virtual Hosting with ACLs article. Extracting the tar while within the directories already setup with ACLs will result in the permissions being inherited.

Configure WordPress

Create Config File for Database Access

Launch a browser and hit the WordPress setup page for your machine at http://krypton.com/blog/wp-admin/install.php and you will be prompted to create a configuration file.

Click the button, "Create a Configuration File".

The next prompt reminds you of all the critical information you will need. The Bonsai Framework takes a high security posture, so the automatic file creation should not work. Click the "Let's go!" button.

Enter the required information and click "Submit",

It is expected that you will receive a message that WordPress can not write the wp-config file,

Copy the generated wp-config.php file.

Go to your shell, load your favourite editor and paste the contents of the wp-config.php file,

vi /opt/www.krypton.com/www/blog/wp-config.php

Once you have saved the file, go back to your browser and click "Run the install".

Enter Site Information

Finally enter the site information,

Click, "Install WordPress" which should result in a success screen. At this point you are actually done the setup. Do not click "Log In".

Customize WordPress

At this point WordPress is already working. There are two urls to take note of,

If you have the Install WordPress Success Screen still up, click "Log In" will take you to the Word Press Administration url or use the url in the table above.

Setting Up Users

The default user created is an administrator and has more privileges than necessary. The very first step is to create users with specific roles provided by WordPress. The roles are outlined below in order of most privileges to least.

Lock Down WordPress

WordPress and PHP simply due to the model is inherently insecure when compared to more Enterprise solutions.

As such the Bonsai Framework takes an administrator approach to managing and securing WordPress. It is strongly recommended to not use a co-hosting model for multiple clients that require privacy. This is especially problematic if clients are granted shell access. It becomes very complex to protect one client from gaining access to another client's WordPress data.

Restrict WordPress Database Account

As part of good application security, the WordPress database account should only be granted minimal privileges.

Connect into MySQL,

mysql -u root -p 

Enter the following MySQL commands,

REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'wpkryptonuser'@'localhost';
GRANT SELECT, INSERT, UPDATE ON wpkryptondb.* TO 'wpkryptonuser'@'localhost' IDENTIFIED BY 'password';
FLUSH PRIVILEGES;
EXIT

Adjust the variables for your application.

wpkryptondb - Name of the database for the WordPress application instance. We use the domain name of the website.

wpkryptonuser - User account for accessing the database.

localhost - Address of the database server. In this example, the database is on the same server so use localhost.

password - Change to password using algorithm based on name of the website domain, in this case krypton.

Verify the changes took effect,

SHOW GRANTS FOR 'wpkryptonuser'@'localhost';

File Permissions

Fom the WordPress article Hardening WordPress we might want to take the approach of creating accounts for select developers or release managers.

wp-config.php - holds the database password and should be locked down (it is thanks to the ACLs)

...

Writing Next Topics

• Repeat for the second instance.

FAQ

Why do some of the php5 installations say to use install libapache2-mod-php5?

No need, it is included with the php5 package.

What is the difference between the php5  and libapache2-mod-php5 packages?

Nothing I can see. It just looks like php5 is an overarching package name.

References

Setup

Ubuntu Server Documentation - https://help.ubuntu.com/12.04/serverguide/php5.html

Security

Has some ok details around suPHP - https://help.ubuntu.com/community/ApacheMySQLPHP#Installing_MYSQL_with_PHP_5

Some good notes on securing PHP from Symantec - http://www.symantec.com/connect/articles/securing-php-step-step

Start some good security practices for WordPress - http://www.howtospoter.com/web-20/wordpress/triple-p-of-total-wordpress-security

Wordpress discussion on permissions, based their recomendations for suPHP the community does not really understand permissions - http://codex.wordpress.org/Changing_File_Permissions

This restricts the php process to specific directories - http://help.godaddy.com/article/1616

At least by looks this looks like it may be a good guide to securing wordpress - http://wpsecure.net/basics/

http://example.com/blog/wp-admin/install.php