15 Best Security Tips for LAMP Stack (Apache, MySQL and PHP) on Linux

Many of new system administrators forgot to apply security when configuring web hosting environment for production use with Apache, MySQL, and PHP. I am trying to include all those security tips which we must be considered while preparing a new system for production use or any existing LAMP setup.

All the configuration changes are used in this article will be updated in following configuration files as per your operating systems. In some cases, configuration files path may change. So make the change in appropriate files. After making changes restart related services to change take effect.

For Ubuntu, Debian & LinuxMint:

Apache2: /etc/apache2/apache2.conf
PHP: /etc/php/[VERSION]/apache2/php.ini
MySQL: /etc/mysql/my.cnf or /etc/mysql/mysql.conf.d/mysqld.cnf

For CentOS, RedHat & Fedora:

Apache: /etc/httpd/conf/httpd.conf
PHP: /etc/php.ini
MySQL: /etc/my.cnf

#1. Hiding Version and OS Identity (Apache)

The ServerTokens directive controls whether Server response header field which is sent back to clients. The ServerSignature configures the footer on server-generated documents. Edit Apache configuration file and update following directives as following.

 ServerTokens Prod

 ServerSignature Off

#2. Disable Directory Listing (Apache)

If directory listing is enabled in Apache. Then all the files and directories list will be shown on the web page if no default document exists. Add following configuration in Apache to disable directory listing server wide.

<Directory />
    Options -Indexes 
</Directory>

After that, you can enable listing per directory basis if required.

#3. Restricting File and Directory Access (Apache)

Restricting access on basis of Directory, File the Location in Apache.

Restrict Directory

To restrict directory and files access from users, It will only allowed the ips are defined with Allow from.

<Directory "/home/user/public_html">
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from .example.com
</Directory>

Restrict File

We can also restrict specific file using File directive like below.

<File data.xml>
    Order deny,allow
    Deny from all
</File>

Restrict Location

The Location directive limits the scope of the enclosed directives by URL.

<Location /admin>
    Order Deny,Allow
    Deny from all
    Allow from 192.168.1.0/24
    Allow from .example.com
</Location>

#4. Disable Server Side Includes and CGI (Apache)

We can simply disable server-side includes and CGI execution by defining directory tag. Add below in Apache virtual host configuration file.

<Directory "/home/user/public_html">
   Options -Includes -ExecCGI
</Directory>

#5. Restrict PHP Information Leakage (PHP)

By default, PHP installation exposes to the world that PHP is installed on the server, which includes the PHP version within the HTTP header (Eg: X-Powered-By: PHP/5.4.20). Read More

To hide this values from header edit php.ini and update below directive to Off

expose_php = Off

#6. Disable Remote Code Execution (PHP)

If allow_url_fopen is enabled on your setup, It allows ile functions like file_get_contents() and the include and requires statements which can retrieve data from HTTP or FTP remote locations and execute their code.

allow_url_fopen=Off
allow_url_include=Off

#7. Disable Dangerous PHP Functions (PHP)

We can disable any PHP function using the disable_functions directive in PHP configuration file. Disable all the functions which can be harmful and not used in applications.

disable_functions =exec,shell_exec,passthru,system,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source,proc_open,pcntl_exec

#8. Limit PHP Access To File System (PHP)

The open_basedir directive set the directories from which PHP is allowed to access files

open_basedir="/home/user/public_html"

#9. Disable Unused PHP Modules (PHP)

PHP supports “Dynamic Extensions” to load in the PHP environment. We can disable any unused module to load in the system by changing configuration file name.

cd /etc/php.d/
mv oci8.ini oci8.ini.disable

#10. Enable Limits in PHP (PHP)

To allow users to upload files of maximum size, update following configuration value.

 upload_max_filesize = 2M  #Maximum 2Mb of file user can upload

Maximum execution time of each script

 max_execution_time = 30  # seconds

Maximum amount of time each script may spend parsing request data

bind-address=127.0.0.1

[mysqld]
local-infile=0

[email protected]:~# mysql -u root -p 

mysql> CREATE USER 'myusr'@'localhost' IDENTIFIED BY 'password';
mysql> GRANT SELECT,INSERT,UPDATE,DELETE ON mydb.* TO 'myusr'@'localhost' IDENTIFIED BY 'password';
mysql> FLUSH PRIVILEGES;

[email protected]:~# mysql_secure_installation 

"Only required output is showing below. In actual you will see more output on-screen"

Change the root password? [Y/n] y
New password: **********
Re-enter new password: **********

Remove anonymous users? [Y/n] y
Disallow root login remotely? [Y/n] y
Remove test database and access to it? [Y/n] y
Reload privilege tables now? [Y/n] y

chattr +i /etc/php.ini
chattr +i /etc/php.d/*
chattr +i /etc/my.cnf
chattr +i /etc/httpd/conf/httpd.conf

chattr -i filename