---
title: 'LNMP (Linux + Nginx + MySQL + PHP) 架設伺服器'
disqus: hackmd
---

LNMP (Linux + Nginx + MySQL + PHP)
架設伺服器
===

## Table of Contents

[TOC]

## General Setup

If you are a total beginner to this, start here!

1. (Linux) Ubuntu 20.4.1
`lsb_release -a`

2. Nginx 1.18.0
`nginx -v`

3. MySQL 8.0.30-0ubuntu0.22.04.2
`mysql -v`

4. Php 7.4.3
`php -v`

---
## Server DEMO

http://10.250.128.133/
### 1. Login

### 2. Show MySQL Database (contacts information)
sudo apt-get install php-mysqlnd
> **(WEB)**

>**(SSH)**

### 3. Contacts Information Page

### 4. Add/Edit Contacts

| Add New Contact | Edit |
|:---------------------------------------------:|:----:|
|  |  |

### 5. Delete Contacts

### 6. Nginx Load Balance

http {

  # At least 2 servers.
  upstream loadbalancer{
      server [server1 IP] weight=1;
      server [server2 IP] weight=1;
  
  }
   

location / {

  proxy_pass http://loadbalancer;
  try_files $uri $uri/ =404;
  
  }

| Server1 | Server2 |
|:----:|:----:|
||

Vulnerability Scan & Fix
---
### 1. OWASP ZAP scanner
> https://www.zaproxy.org/

●Result:
●Alerts

### 2. Fix vulnerabilities
#### (1)Content Security Policy (CSP) Header Not Set

> **etc/nginx/sites-available/default
> add_header Content-Security-Policy "default-src 'self';"**

|  |  |

#### (2)Missig Anti-clickjacking Header

> **/etc/nginx/conf.d
> add_header X-Frame-Options sameorigin always;**

|  |  |

#### (3)Cookie No HttpOnly Flag

> **/etc/nginx/sites-available/default**

location ~ \.php$ {
  ...
  add_header Set-Cookie "Path=/; HttpOnly; Secure";
  proxy_cookie_path / "/; HTTPOnly; Secure";
  
  }

| | |

#### (4)Cookie without SameSite Attribute

> **/etc/nginx/sites-available/default
> add_header Set-Cookie "Path=/; HttpOnly; Secure; SameSite=Lax"**

|||

#### (5)X-Content-Type-Options Header Missing

> **/etc/nginx/sites-available/default
> add_header X-Content-Type_Options nosniff;**

|||

Database Audit (Enable MySQL Query Log)
---

> **/var/lib/mysql/
> create mysql.log**

mysql > Setting

    SET GLOBAL general_log = 'ON';
	SET GLOBAL general_log_file ='/var/lib/mysql/mysql.log';

Test:

### The time difference between database audit is enabled or not.

#### ●Enable general_log -> Scaning Time :12.399 (s)
|||

#### ●Disable general_log -> Scaning Time :9.788 (s)
|||

:::info
可以看出general_log開啟前後，在OWASP ZAP scanner掃描時間的差異。
:::

###### tags: `LNMP` `Ubunutu` `Nginx` `MySQL` `PHP`