How to Install and Secure a LAMP Stack on Debian

Author: JJustis | Published: 2025-10-21 00:22:12
Article Image 1
How to Install and Secure a LAMP Stack on Debian
The LAMP stack — Linux, Apache, MySQL, and PHP — is a classic foundation for web applications. This guide covers both installation and essential security hardening steps for Debian-based systems.
1. Installing the LAMP Stack
  • Update your system packages using sudo apt update && sudo apt upgrade -y.
  • Install Apache: sudo apt install apache2 -y.
  • Enable Apache on boot: sudo systemctl enable apache2.
  • Install MySQL Server: sudo apt install mysql-server -y.
  • Secure MySQL installation with sudo mysql_secure_installation — follow prompts to remove test users, set a root password, and disable remote root login.
  • Install PHP and modules: sudo apt install php libapache2-mod-php php-mysql -y.
  • Restart Apache: sudo systemctl restart apache2.
  • Test PHP by creating /var/www/html/info.php with the contents <?php phpinfo(); ?>.
2. Hardening Apache
  • Disable directory listing: edit /etc/apache2/apache2.conf and remove or comment out Options Indexes.
  • Hide Apache version: in /etc/apache2/conf-enabled/security.conf, set ServerTokens Prod and ServerSignature Off.
  • Enable HTTPS using ZeroSSL or Let’s Encrypt for free SSL certificates.
  • Install Certbot: sudo apt install certbot python3-certbot-apache -y.
  • Generate a certificate: sudo certbot --apache -d yourdomain.com.
  • Test renewal: sudo certbot renew --dry-run.
3. Hardening MySQL
  • Ensure strong passwords for all accounts and disable remote root access.
  • Allow only necessary network access — modify /etc/mysql/mysql.conf.d/mysqld.cnf to set bind-address = 127.0.0.1.
  • Use mysql_secure_installation regularly after upgrades.
  • Create dedicated database users for each web application with limited privileges.
4. Securing PHP
  • Edit /etc/php/*/apache2/php.ini to disable dangerous functions: disable_functions = exec,passthru,shell_exec,system.
  • Set expose_php = Off to hide PHP version headers.
  • Enable open_basedir to restrict PHP scripts to their directories.
  • Use display_errors = Off on production to avoid leaking file paths.
5. Firewall and Security Enhancements
  • Enable the UFW firewall: sudo apt install ufw -y.
  • Allow only essential ports: sudo ufw allow 22,80,443/tcp.
  • Enable firewall: sudo ufw enable.
  • Install and configure Fail2Ban: sudo apt install fail2ban -y.
  • Review /etc/fail2ban/jail.local to adjust bans and thresholds for SSH and Apache.
6. File and Directory Permissions
  • Set the correct ownership for web files: sudo chown -R www-data:www-data /var/www/html.
  • Restrict permissions: sudo chmod -R 750 /var/www/html.
  • Never run Apache or PHP as root — use www-data or a dedicated service account.
7. Continuous Monitoring
  • Check Apache logs in /var/log/apache2/ regularly for suspicious activity.
  • Use OSSEC or CrowdSec for intrusion detection.
  • Perform regular system and package updates.
  • Consider automated backups using rsync or Duplicity.
8. Testing Your Installation
  • Access your server via browser and confirm HTTPS is working.
  • Remove the test info.php file after confirmation for security.
  • Test SQL connectivity with a sample PHP page using mysqli_connect.
Conclusion
A secured LAMP stack ensures your applications run efficiently and safely. Regularly auditing permissions, updating software, and monitoring logs will help maintain a hardened Debian web server that’s resistant to most common attacks.