How to set up a web server (LAMP) on Debian or Ubuntu

Introduction

Setting up a web server and related software enables your cloud server to host dynamic web pages or web applications. Installing a LAMP stack is a proven approach to achieve this with open-source applications. LAMP stands for Linux (OS), Apache (web server), MariaDB (database management system) and PHP (programming language).

This tutorial explains how to set up a LAMP web server on your OVHcloud service.

Requirements

• A dedicated server, a VPS or a Public Cloud instance in your OVHcloud account (excluding Windows systems)
• Access to the OVHcloud Control Panel
• Administrative access to your service via SSH

Instructions

If a current Debian or Ubuntu distribution is not already installed on your server, carry out a reinstallation first in your OVHcloud Control Panel. This is the best way to have a clean system for your web server and the applications running on it.

Follow the respective guide to install an operating system on your OVHcloud service and connect to it via SSH:

• Dedicated server
• VPS
• Public Cloud instance

Step 1: Updating the system

After logging in to your server with SSH, ensure that all packages are up-to-date:

sudo apt update && sudo apt upgrade -y

Now you can install the current LAMP packages.

Step 2: Installing Apache

Install the Apache packages (including documentation):

sudo apt install -y apache2 apache2-doc

You can verify the installation with the following command:

sudo systemctl status apache2

You can also open http://server_IP in a web browser. The "Apache2 Debian Default Page" should appear.

Step 3: Installing the database server and PHP

Install the packages of MariaDB and PHP:

sudo apt install -y php php-pdo php-mysql php-zip php-gd php-mbstring php-curl php-xml php-pear php-bcmath mariadb-server

Step 4: Configuring the database server

MariaDB provides a script to assist with the initial configuration and to apply some security-related settings.

To run it, enter this command:

sudo mariadb-secure-installation

Confirm the first prompt by pressing Enter.

Next you can choose a method to secure access to the database server.

Switch to unix_socket authentication [Y/n]

It is recommended to use the proposed authentication method (unix_socket) instead of the access via root password. Press y and then Enter. (If you decide to use root user access instead, choose n and then set a root password at the next prompt.)

Enter n at the next prompt:

Change the root password? [Y/n]

Since the subsequent prompts concern security measures, confirm them all with y until the script is finished.

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

If you have configured MariaDB access in the recommended way (unix_socket), you now have automatic admin access (root) to it whenever you are logged on to the server as a user with elevated permissions (sudo).

Creating your first database and a database user (optional)

Open the MariaDB shell:

sudo mariadb

MariaDB [(none)]> 

Create a database:

MariaDB [(none)]> CREATE DATABASE database_name;

Create a "user" with a name of your choice and grant it all rights on this database. This account can then access the database and carry out all operations for the application using this database. Replace database_name with the name of your database, user_name with a name of your choice and password with a strong password.

MariaDB [(none)]> GRANT ALL ON database_name.* TO 'user_name'@'localhost' IDENTIFIED BY 'password' WITH GRANT OPTION;

Ensure the changes made are applied and then exit the MariaDB shell:

MariaDB [(none)]> FLUSH PRIVILEGES;

MariaDB [(none)]> exit;

Step 5: Configuring the firewall (optional)

Configuring a firewall (iptables) will enhance the security of your server. This process can be simplified by using the frontend "Uncomplicated Firewall" (UFW) and its preset of profiles. Install UFW:

sudo apt install ufw

The relevant profiles are labelled as "WWW" in the application list:

sudo ufw app list | grep WWW
  WWW
  WWW Cache
  WWW Full
  WWW Secure

By choosing "WWW Full", both secure connections (port 443) and not-secured http requests (port 80) to the web server will be allowed.

To see which ports are affected by a particular profile, enter sudo ufw app info "profile name".

By entering the following command, the ports defined by the profile "WWW Full" will be opened:

sudo ufw allow 'WWW Full'

Since all ports not explicitly allowed will be blocked after enabling the firewall, make sure to allow SSH connections (port 22 in a default configuration) as well:

sudo ufw allow 'SSH'

Finally, activate the firewall rules and verify the configuration:

sudo ufw enable

sudo ufw status

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
80,443/tcp (WWW Full)      ALLOW IN    Anywhere                  
22/tcp (SSH)               ALLOW IN    Anywhere                  
80,443/tcp (WWW Full (v6)) ALLOW IN    Anywhere (v6)             
22/tcp (SSH (v6))          ALLOW IN    Anywhere (v6)       

You can go further with UFW, for example if you want to restrict denial of service (DOS) attacks or prevent requests by certain IP address ranges. Please refer to the official UFW documentation.

Step 6: DNS configuration (optional)

In order to access your web server installation via a domain name, you need to attach it to your service. This is done by editing the DNS zone which you can do in your OVHcloud Control Panel, provided OVHcloud is your domain registrar and the domain name uses OVHcloud DNS servers.

Please refer to our guide on Editing a DNS zone for further instructions. If the domain name is currently in use, only configure DNS after your website or application is ready.

Step 7: Enabling secure connections with Let’s Encrypt (optional)

First make sure that your domain name has the correct records in the DNS zone, i.e. is mapped to the IP address of your server.

Install the required packages for the Certbot client:

sudo apt install -y certbot python3-certbot-apache

Obtain the certificate for your domain name and the "www" subdomain:

sudo certbot --apache -d domainname.ovh -d www.domainname.ovh

You will need to enter a valid email address and accept the terms of service.

Certbot will automatically renew the certificates. There are no further steps needed. However, you can look into the available options to learn more about the capabilities of Certbot.

Go further

How to upload and retrieve data on a server via SFTP

UFW documentation

Apache documentation

MariaDB documentation

Let’s Encrypt documentation

Certbot documentation

NGINX documentation (Apache alternative)

Join our community of users.