The Linux, Nginx, MySQL, PHP (LEMP) stack is a popular set of technologies for running commodity web applications and sites. This variation of the stack replaces Apache with Nginx, a lighter web server that is a better fit for smaller-footprint servers, or with anyone who needs more performance. Unlike the venerable LAMP stack, LEMP runs PHP scripts in a separate process, which has different implications for securing and scaling PHP-based web applications.<\/p>\n
Confirm that you have the following before you follow this guide: Start by applying all available updates. This critical step should be performed regularly. It will apply all outstanding security patches and bugfixes for everything installed on your server.<\/p>\n Now we’ll add the CentOS 7 EPEL repository. This grants access to some packages we’ll need to install later.<\/p>\n For this tutorial, we’ll use MariaDB instead of MySQL. MariaDB is a backwards-compatible community MySQL fork with various enhancements that make it a better fit for modern web applications. In general, MySQL and MariaDB are interchangeable, but MariaDB is a better choice if it is available to you.<\/p>\n Next we start the server so it will begin accepting connections.<\/p>\n MariaDB must now be secured. Here we set the root password, which is needed to create databases and grant permissions. Keep this password secure, and don’t use your server’s root password. Use something unique, memorable, and difficult to guess.<\/p>\n By default, a MariaDB installation has an anonymous user, allowing anyone to log into MariaDB without having to have a user account created for them. This is intended only for testing, and to make the installation go a bit smoother. You should remove them before moving into a production environment.<\/p>\n Normally, root should only be allowed to connect from ‘localhost’. This ensures that someone cannot guess at the root password from the network.<\/p>\n By default, MariaDB comes with a database named ‘test’ that anyone can access. This is also intended only for testing, and should be removed before moving into a production environment.<\/p>\n MariaDB is started, but it currently won’t start automatically when your server boots up. This next command tells CentOS to start MariaDB when your server comes up.<\/p>\n It is now time to install the Nginx web server. Start by installing the package itself.<\/p>\n As with MariaDB, we must now start the Nginx server so it accepts connections.<\/p>\n Also, as with MariaDB, we need to configure the Nginx server to start on boot.<\/p>\n PHP runs in a separate process, managed and configured by the php-fpm package. Let’s install that now.<\/p>\n Again, we start the PHP-FPM daemon.<\/p>\n We also enable it to start on boot.<\/p>\n All necessary servers and processes are running. We need to tell Nginx where the PHP-FPM process expects to receive scripts that it will run. Do this by editing the default virtual host configuration.<\/p>\n Save and exit. Reload Nginx so the new configuration takes effect.<\/p>\n We’ll next configure the PHP process, making changes to improve security.<\/p>\n Find the “cgi.fix_pathinfo” line, and then remove the comment symbol “;”. Change “1” to “0”. After the modifications, it should look like this:<\/p>\n Change the last line to:<\/p>\n Save and exit. Next we’ll edit the php-fpm configuration and make several changes there.<\/p>\n Find the following lines:<\/p>\n Change them to:<\/p>\n With these configuration changes in place, we need to restart php-fpm. We’ll do that here.<\/p>\n Let’s ensure that everything is working. We’ll create a phpinfo page, a simple page that calls a diagnostic function. If everything works, you’ll see lots of details about your newly-configured PHP environment.<\/p>\n In your server’s document root directory, edit the file as shown:<\/p>\n Now access the newly-created page from your browser. Visit http:\/\/your_ip\/info.php. If everything works, you’ll see a report about the PHP installation you’ve just set up.<\/p>\n With this LEMP setup in place, your server can now run WordPress, MediaWiki, and any number of standardized PHP applications. Share this article with anyone who wants to get up and running quickly with PHP on CentOS 7.<\/p>\n","protected":false},"excerpt":{"rendered":" The Linux, Nginx, MySQL, PHP (LEMP) stack is a popular set of technologies for running commodity web applications and sites. This variation of the stack replaces Apache with Nginx, a lighter web server that is a better fit for smaller-footprint servers, or with anyone who needs more performance. Unlike the venerable LAMP stack, LEMP runs<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[70],"tags":[],"class_list":["post-2523","post","type-post","status-publish","format-standard","hentry","category-web-hosting","operating_system-centos-7"],"yoast_head":"\n
\n\u2022 1 Node (Cloud Server<\/a> or Dedicated Server<\/a>) running CentOS 7.
\n\u2022 Root access to the node.<\/p>\nTutorial<\/h2>\n
yum update -y
\nreboot<\/code><\/p>\nyum install epel-release<\/code><\/p>\nyum install mariadb-server mariadb<\/code><\/p>\nsystemctl start mariadb<\/code><\/p>\nmysql_secure_installation<\/code><\/p>\nSet root password? [Y\/n]
\nNew password:
\nRe-enter new password:
\nPassword updated successfully!
\nReloading privilege tables..
\n... Success!<\/code><\/p>\nRemove anonymous users? [Y\/n] y
\n... Success!<\/code><\/p>\nDisallow root login remotely? [Y\/n] y
\n... Success!<\/code><\/p>\nRemove test database and access to it? [Y\/n] y
\n- Dropping test database...
\n... Success!
\n- Removing privileges on test database...
\n... Success!
\nReloading the privilege tables will ensure that all changes made so far
\nwill take effect immediately.
\nReload privilege tables now? [Y\/n] y
\n... Success!
\nCleaning up...
\nAll done! If you've completed all of the above steps, your MariaDB
\ninstallation should now be secure.
\nThanks for using MariaDB!<\/code><\/p>\nsystemctl enable mariadb.service<\/code><\/p>\nyum install nginx -y<\/code><\/p>\nsystemctl start nginx.service<\/code><\/p>\nsystemctl enable nginx.service<\/code><\/p>\nyum install php php-mysql php-fpm<\/code><\/p>\nsystemctl start php-fpm<\/code><\/p>\nsystemctl enable php-fpm<\/code><\/p>\nnano \/etc\/nginx\/nginx.conf<\/code><\/p>\n[...]
\n# Load modular configuration files from the \/etc\/nginx\/conf.d directory.
\n# See http:\/\/nginx.org\/en\/docs\/ngx_core_module.html#include
\n# for more information.
\ninclude \/etc\/nginx\/conf.d\/*.conf;
\nserver {
\nlisten 80 default_server;
\nlisten [::]:80 default_server;
\nserver_name 173.209.44.190;
\nroot \/usr\/share\/nginx\/html;
\nindex index.php index.html index.htm;
\n# Load configuration files for the default server block.
\ninclude \/etc\/nginx\/default.d\/*.conf;
\nlocation ~ \\.php$ {
\ntry_files $uri =404;
\nfastcgi_pass unix:\/var\/run\/php-fpm\/php-fpm.sock;
\nfastcgi_index index.php;
\nfastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
\ninclude fastcgi_params;
\n}
\nerror_page 404 \/404.html;
\nlocation = \/40x.html {
\n}
\nerror_page 500 502 503 504 \/50x.html;
\nlocation = \/50x.html {
\nroot \/usr\/share\/nginx\/html;
\n}
\n[...]<\/code><\/p>\nsystemctl reload nginx.service<\/code><\/p>\nnano \/etc\/php.ini<\/code><\/p>\n; cgi.fix_pathinfo provides *real* PATH_INFO\/PATH_TRANSLATED support for CGI. PHP's
\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
\n; http:\/\/php.net\/cgi.fix-pathinfo
\n; cgi.fix_pathinfo=1<\/code><\/p>\n; cgi.fix_pathinfo provides *real* PATH_INFO\/PATH_TRANSLATED support for CGI. PHP's
\n; previous behaviour was to set PATH_TRANSLATED to SCRIPT_FILENAME, and to not grok
\n; what PATH_INFO is. For more information on PATH_INFO, see the cgi specs. Setting
\n; this to 1 will cause PHP CGI to fix its paths to conform to the spec. A setting
\n; of zero causes PHP to behave as before. Default is 1. You should fix your scripts
\n; to use SCRIPT_FILENAME rather than PATH_TRANSLATED.
\n; http:\/\/php.net\/cgi.fix-pathinfo
\ncgi.fix_pathinfo=0<\/code><\/p>\nnano \/etc\/php-fpm.d\/www.conf<\/code><\/p>\nlisten = 127.0.0.1<\/code><\/p>\n;listen.owner = nobody
\n;listen.group = nobody<\/code><\/p>\n; RPM: apache Choosed to be able to access some dir as httpd
\nuser = apache
\n; RPM: Keep a group allowed to write in log dir.
\ngroup = apache<\/code><\/p>\nlisten = \/var\/run\/php-fpm\/php-fpm.sock<\/code><\/p>\nlisten.owner = nobody
\nlisten.group = nobody<\/code><\/p>\n; RPM: apache Choosed to be able to access some dir as httpd
\nuser = nginx
\n; RPM: Keep a group allowed to write in log dir.
\ngroup = nginx<\/code><\/p>\nsystemctl restart php-fpm<\/code><\/p>\nnano \/usr\/share\/nginx\/html\/info.php<\/code><\/p>\n<?php
\nphpinfo();
\n?><\/code><\/p>\nConclusion<\/h2>\n