Before you dive deep into this project, I want to say a few words about the people that helped and collaborated on this project...
When all of us got together to decide which distribution we would pick for this project, I was the only one that consider it, out of pure stupidity and ignorance. I did not know what the project was about and did not know the amount of work it would take for it to be completed. I was immensely lucky to have Alex Barbosa Felix Da Silva, Júlio César Santos Souza and Nicholas Saraiva Arruda Serafim, joining together with me to tackle the project. I would not even got to the installation screen without their help and insights. In true 42 spirit and collaboration, I can say for sure that we all learned greatly from the whole experience and I wish for you reading this all the same (if possible even pass it on).Honarable mentions to Pedro Miguel Reis Neiva (prime Rocky user) and Alex Deimling (alpha tester for this guide).
I salute my fellow friends, more to us like these I wish.
Points of contact:
Alex Barbosa Felix Da Silva -> alebarbo@student.42porto.com
Júlio César Santos Souza -> jcesar-s@student.42porto.com
Nicholas Saraiva Arruda Serafim -> nsaraiva@student.42porto.com
It is worth noting that this guide is porpously made without straight to the awnsers instructions in case of easier/intermediate topics. The explanations for the concepts used in this project may not cover all in depth for some would require guides of their own, however there are links and references I higly suggest futher exploration.
Rocky Linux is a distribution which stems from CentOS since its discontinued development. The original co-founder of CentOS took on the responsability of carrying on the initial goal of a community-driven, enterprise level operating system for development. The project is now hosted by Rocky Enterprise Software Foundation.
Rocky established itself as a downstream build of its upstream vendor Red Hat Enterprise Linux.
The installation ISO can be found at the Rocky OS website under the section of default images. Download Rocky Linux 9.5 minimal ISO (the checksum can be used to verify the integrity of the installation).
On the virtual machine software of your choice (this guide will use Oracle VirtualBox), Figure 0, create a new virtual machine, choose the name, select the directory to save the VM files and select the directory with the Rocky ISO image. Check the box fot the 'Skip Unattended Installation'.
Figure 0.
In the 'Hardware' section (Figure 1), select the amount of base memory for the virtual machine and the amount of processors you want to use.
Figure 1.
Next in the 'Virtual Hard Disk' shown in Figure 2, create a virtual hard disk with the amount specified in the subject (this size will change in case you choose to make the bonus). Take some time to do the final check of the specifications for the VM and finish the creation.
Figure 2.
The partition scheme, as per the bonus section, must have one primary partition and an extended partition for the logical volume groups, Figure 3.
Figure 3.
The virtual machine has a set amount of primary memory (RAM) and a set amount of secondary memory (hard disk or SSD). The objective is slice the available secondary memory into different sectors that will compartimentalize different parts of the operating system. In order to achieve this goal, first the partitions must be create following a certain partition table, the extended partition must be encrypted and inside it, logical volume groups are created to support different directories of the linux filesystem.
The partitioning scheme layout standard used is the legacy Master Boot Record (MBR). This type provides wide compatibility with older systems and has a simple structure to be worked on. MBR has a set number of primary partitions that can be created, no more than 4, and can only support 2 TiB of size disk which will be more than enough for the pourposes of this project. The up to date, modern standard of partitioning scheme is GUID Partition Table (GPT) with almost every single specification having an upgrade compared to its predecessor MBR. GPT has practically an unlimited amount of partitions that can be created, it is realiable given its system of redundancy checks, it has compatibility with mordern boot firmware such as UEFI and it can manage larger systems with sizes bigger than 2 TiB.
More information about disk partititons in here and there.
After the disk has been properly partitioned, the system is ready to have each partition formatted with a filesystem. Each pool of memory now has to be assigned a filesystem format and a mount point. Linux suppports a wide range of filesystems, each with its own particularities, characteristics and performance according to given task.
Filesystems simply structures the way data is stored, organized, accessed and managed throughout the operating system. It adds redunduncy in the form of journals or logs for the case of sudden crashes or system corruption. It keeps track of the area in which data must be stored and can be used. Also, it implements checksums to verify integrity of the system and file modifications.
This project uses the ext4 filesystem for its stabililty and performance which is enough in this case. The ext4 is flexible which make it suitable for a variety of workloads and file sizes. The current project does not require the management of large storage units, scalability is not the main goal, so the ext4 is the right fit.
Useful content around this topic and other types of filesystems here and there.
Logical volume management is a device mapper framework that abstracts the physical storage devices on a linux system. Physical memory storage can now be virtualized in virtual block devices, this make possible for the logical volumes to absorb new physical devices to enlarge the systems size or shrink it dynamically.
The layered architecture of the LVM is composed by the physical volume which is the base layer, normally an entire partition. The volume group is the central pool of storage composed of one or more physical volumes, this layer acts a container for the physical volumes. The logical volume is the abstraction created for the operating system to use. The logical volume is a standard block device in the perspective of the OS where mount points can be assigned and formatted with specific file system.
More information on here and there.
At the start up installation menu (Figure 4), press TAB, type inst.text and press enter. Next, select the text mode and go into the anaconda prompt by pressing alt+tab.
Figure 4.
At the anaconda prompt, use the fdisk command utility to write on the /dev/sda disk (Figure 5).
Figure 5.
Inside the fdisk program, type m for the help menu. Afterwards, type n to create a new partition, select it as a primary partition and set the last sector to be +500M as shown in Figure 6. Leave the Partition number as the default, as well as, the first sector.
Figure 6.
After creating the primary partition where the /boot mount point will live, add another partition, only this time select it as an extended partition.The fdisk program creates a second partition named sda2 of type 'Extended' with all the remaining space available on disk. Create yet another partition with the n command, with all the space allocated to the extended partition sda2, fdisk will add a logical partition, leave again all the fields as the default. Type w to update the partition table. Follow the mentioned steps and check if the process is similar to Figure 7.
Figure 7.
The sda5 partition needs to be encrypted and for this action use the following command on the anaconda prompt:
cryptsetup -y -v --type luks1 luksFormat /dev/sda5
The command above basically sets the desired type of encryption, luks1 or luks2, on top of the of the sda5 partition. By encrypting the entire partition, the part of the system where potentially critical information is stored will be safe.
With the partition encrypted, in order to add the logical volume manager (LVM) groups it is necessary to open the partition first. This can be achieved with the following command:
cryptsetup open /dev/sda5 sda5_crypt
Now, the extended partition can be managed to have any logical groups needed. First, create the physical volume in which the logical volumes will reside with the command:
pvcreate /dev/mapper/sda5_crypt.
Afterwards, create the volume group which the logical volumes will be a part of on top of the newly created physical volume mapper. Use the command:
vgcreate LVMGroup /dev/mapper/sda5_crypt.
Finally, create all the necessary logical volumes that belong to the LVMGroup. Use the lvcreate command to achieve this goal. The size can be set with the '-L' flag, and the name of the logical volume with the '-n' flag. For example:
lvcreate -L 10G -n root LVMGroup
Repeat this step for all the logical volumes, do this in the order as per the subject. Check if the partition is similar to Figure 8 with the lsblk command.
Figure 8.
When all these steps are completed, type reboot in the command prompt and enter the guided installation wizard. In the 'Installation Summary' menu, under 'System' select the 'Installation Destination'. Select the checkbox of the manual installation and hit 'Done', this will redirect to the 'Manual Partitioning' menu. If you did every step the correct way, there will be a 'Unknown' header in the 'New Rocky Linux 9.5 Installation' as depicted in Figure 9. Open the header to find the sda1 and sda5 encrypted partition, open the sda5 partition with the password.
Figure 9.
Now all the logical volumes and primary partition can be reformated and mounted properly. Select a logical volume, check the 'Reformat' checkbox, edit the 'Mount Point' field and select a filesystem type in the 'File System' field. Press the 'Update Settings' to update the information and repeat for all the logical volumes. The figure below is an example of what to expect:
Figure 10.
NOTE: the swap volume has a unique filesystem type.
Create a user without administrative powers (this will be set up inside the server) and create a root password for the super user. Begin installation.
After the final reboot of the installation, decrypt the disk and enter the user login and password to access the server. At this stage, a serie of actions must be completed to make the server secure and operational with different types of services. A list of the objectives is shown below:
| 1. Set up SSH service | 6. Create bash script |
| 2. Change hostname | 7. Set up lighttpd service |
| 3. Create groups and users | 8. Set up mariadb service |
| 4. Implement secure password policy | 9. Set up WordPress website |
| 5. Set up sudo rules | 10. Set up additional service |
At this point, the virtual machine has a full operating system installed and operational. The VM harness the processing power, memory, disk and other physical resources from the host hardware. "An entire OS-level virtualization enables multiple isolated and secure cirtualized servers to run using only a single physical server" (source here). Virtual Machine can be defined as:
"An efficient, isolated duplicate of a real computer machine." - Gerald J. Popek & Robert P. Goldberg.
Before the set up and configuration of the server, some topics will be introduced for better comprehension and utility of the project.
Secure shell (SSH) is a cryptographic communication protocol over insecure mediums. It enable secure remote access to computers and servers, over the internet. This is the service that allow developers to work from home, administer networks and servers from a distance in some third world beach around the world.
The primary goal of SSH is to secure remote login and command execution to a server or network which enable the capacity to manage, transfer and administer services inside the said network/server. This program came to replace the previoius client-server application protocols, such as Telnet, rlogin and rsh. The SSH protocol at its inception in 1995 gain rapid adoption by the community and now stands as the golden standard of secure system administration.
The OpenSSH, a free open-source software (FOSS) implementation, is pre-installed on the majority of Linux distributions including Rocky. The service must be running, normally as server side daemon, which makes it possible for a client (e.g. user's local machine) innitiate a connection over Transmission Control Protocol (TCP) to the server on a specific port. The default port for a SSH service is the port 22.
The architecture of SSH is organized as a layered architecture. This design provides modularity, flexibily and clear separation of concerns which contribute to the maintance, robustness and security. There are three main layers that build on top of each other, the first one is the transport layer protocol, the second is the user authentication protocol and the Connection Protocol.
The first layer provides the low level implementation of communication protocol that provides strong encryption, cryptographic host authentication and integrity protection. The second is used to process client-side requests, by managing password authentication, public key authentication and other forms. And, finally, the connection protocol, as defined by the Internet Engineering Task Force reference, establishes "interactive login sessions, remote execution of commands, forwarded TCP/IP connections, and forwarded X11 connections. All of these channels are multiplexed into a single encrypted tunnel".
A firewall is a program that monitors and administer communications send and recieved by a system. It is configured to follow certain rules for the process and flow of communication. This protects the system from unwanted traffic from outside actors and minimizes attack vectors via ports, for example.
The case for firewalld comes from its predecessor, iptables. The goal of firewalld is to simplify the complexities of iptables in implementing firewall rules and policy. Firewalld offers a dynamic and user-friendly method to manage firewall rules by using abstractions like zones, binning services which allows a fine grained configuration, and maintain seperate configurations for runtime processes and the rules saved to disk (permanent).
Firewalld comes pre-installed and enabled by default on RHEL distribution and Rocky. The default zone for network interfaces is set to public, normally used in public networks where other computers of the network are not trustworthy. The utility command to manage the firewalld policies and rules is the firewall-cmd.
Security-Enhanced Linux is a security layer built mixed with the kernel in some GNU/Linux distributions for, you guessed, enhanced security over sensitive data and processes. It was developed in a joint colaboration between linux developers and the National Security Agency (NSA). The feature allows administrators to have advanced and fine granied control over the access and permissions of the system.
It uses Mandatory Access Control (MAC) security policies, a set of rules for deciding what can and can not be accessed, to enforce the policy of entry for allowed users, file/directory permissions, services connectivity and more. In a situation where a subject, term used to categorized applications or processess, makes a request to access an object, for example a file or a directory, SELinux guarantee such subject has the permission to modify, read or write such object by checking the access vector cache (AVC). The said permissions context are loaded into a cache at boot time.
SELinux can run in three different modes of operation. The default is the enforcing mode, the recommended mode, where the policies apllied follow the labels loaded in cache. Verify the status of SELinux with the command:
getenforce
If the status of SELinux needs to be modified temporarily the following command can be used to set it to different modes of operation, more on here:
setenforce
Before starting with the set up of the SSH service, a brief explanation about the network setting of the VM VirtualBox. Go to Settings -> Network, by the 'Attached to:' field, select a mode type for the network adapter (as in Figure 11) which will be virtualized by the VM (source). It determines how the virtual machine will connect to the host machine and broader network.
Network Address Translation (NAT) and Bridge adaptor will be considered for the purpose of this project. In NAT mode, the VirtualBox program acts as a virtual router and DHCP server. The virtual machine router will be assigned an IP in a separate subnet of the host machine network, therefore the virtual machine has access to outside network but there is no direct access from the outside to the virtual machine.
In Bridge adaptor mode, the VirtualBox uses a device driver on your host system that filters data from the physical network adapter. This driver serves as a filter to intercep and inject data into the physical network data stream, which effectly creates a new network interface in software. To the host machine, the newly created interface appears to be connected physically. This means that it is possible to set up routing between the guest and the rest of the host's network, it emmulates being an extended part of the same network as the host.
In effect, the use of Bridge adaptor mode splifies the set and use of services that communicate with communication protocols different than TCP/UDP, as the NAT mode primarily communicates only through these suits. So, make sure which mode is currently in use and the scope of the work.
NOTE: The IP of the virtual machine will change for this configuration to be in effect.
Figure 11.
First step in setting up the SSH service on port 4242 is to download the tools to manage the SELinux rules and policy. Start by installing the selinux-policy-targeted package which provides the semanage command:
dnf install selinux-policy-targeted
dnf install policycoreutils-python-utils
With these utilities installed, now it is possible to add port 4242 to the right type and context. Run the following command:
semanage port -a -t ssh_port_t -p tcp 4242
List the ports types in the SELinux type and verify that port 4242 was correctly added. The output of the following command must be similar to Figure 12.
semanage port -l | grep ssh
Figure 12: semanage commands.
Generate a SSH key pair for the VM. This is the standard process of creating a public-private key, use the ssh-keygen command and follow the instructions prompted by the program. The SSH key allow the server to stablish a remote secure connection with asymmetric cryptography.
ssh-keygen -t rsa
Navigate to the /etc/ssh/sshd_config file to edit the default configuration of the ssh service. Read through the file and find the line which contain the port number, if you have not edited this file before it will be set to the default port.
Also in this file, change the permission for root login by setting it to 'no'. The final document after modification is presented in Figure 13 below:
Figure 13: edited ssh config file.
For the last step, the port 4242 must be open over tcp by the firewalld program. Use the next command to add permanently (on disk) the 4242 port:
firewall-cmd --permanent --add-port=4242/tcp
NOTE: the command need super user level access for it to be used.
In case of the necessity to remove a certain port, just substitute the --add-port in the command above to --remove-port.
Check if the configuration was successful with the first command below, shown in Figure 14, and check all the services and ports available with the second command:
firewall-cmd --list-port
firewall-cmd --list-all
Figure 14: firewall config check.
Verify the status of the service with the systemctl utility command. The SSH service probably will be already running, but in case there is a problem or it is disable, use:
systemctl status sshd
systemctl start sshd
systemctl enable sshd
NOTE: this command will be useful throughout the journey in system administration, it is possible to list more than one service at a time, just list the services to be checked one after the other separated by spaces like so:
systemctl status service_name_1 service_name_2 service_name_3
At server installation the default name for the machine is localhost, in order to modify this name use the following command:
hostnamectl set-hostname newhostname
NOTE: A reboot is necessary to see if the changes are permanent. Also, changing the hostname can lead to problems with services that utilize the hostname as a parameter in configuration files.
This is one of the core requirements for being a system administrator. The operations of create, remove and edit users and groups are essential in managing a server. Start by adding a new user to the server, this can be acomplished by running:
useradd -u 4242 -d /home/username -m username
Some useful flags are the -u flag to set an specific user ID number, the -d flag sets the path of the home directory for the new user (in case the default directory is not desirable) and -m creates the home directory. NOTE: if you want to set up default files/directories inside the user's home directory when creating a new user, add the necessary files in the /etc/skel directory.
Together with the username of an user, a password needs to be set in place for the user to access the server. This can be achieved with the command:
passwd username
In case the administrator need to delete an user from the server, run the command:
userdel username
By default, this command does not remove the user's home directory, if it is necessary to delete the user's information, together with its directories and files use the -r flag.
Create groups with the following command:
groupadd groupname
View all listed groups and the users inside any specific group in the server by inspecting the /etc/group directory.
cat /etc/group
Add a user to a spcific group with the usermod command utility. This command can do a variety of tasks related to groups and users, if a username have to be changed it is done via usermod. Explore the functionalities of usermod in the manual or here.
usermod -a -G groupname username
The -a flag stands for append and the -G flag tells the usermod command to edit groups.
The server must have a strict password policy in place. The passwords in the server must have a maximum number of days in use, a minimum amount of days between password changes and a number of days warning before a password expires. This specifications can be edited in the /etc/login.defs, shown in Figure 15 below:
Figure 15: login.defs final edit.
Configure the password minimum characters length and other rules in the /etc/security/pwquality.conf file, follow the instruction in it.
Navigate to the /etc/pam.d/system-auth and /etc/pam.d/password-auth to update the password settings on both files. In the following line, if there are more configurations on the file just add to them the following parameters instructions:
password requisite pam_pwquality.so try_first_pass local_users_only retry=3 authtok_type= minlen=10 ucredit=-1 lcredit=-1 dcredit=-1 difok=3 reject_username enforce_for_root
Modify the following line to enforce history checks.
password sufficient pam_unix.so remember=7
Alternatively, since these files use the pam_pwquality.so file to load the requisites, by editing the file /etc/security/pwquality.conf the same goal can achieved. For this method, read through the commentaries and check the final configuration file will look something like the Figure 16.
Figure 16: pwquality file config.
The policy for the sudo command is editted in the /etc/sudoers file, however modifying this file raw with the text editor of your choice can make the system brake if wrong modifications are done and there are syntax errors, for example. So, use the command:
visudo
This 'visudo' command opens the /etc/sudoers file where it can edit for specific permissions and configuration safely. Now, add or edit the following lines:
Defaults passwd_tries=3
Defaults log_input
Defaults log_output
Defaults iolog_dir=/var/log/sudo/
Defaults logfile=/var/log/sudo/sudo.log
Defaults requiretty
Defaults secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin"
The expected file configuration must be similar to the Figure 17, shown bellow:
Figure 17: visudo config file.
NOTE: Reset all the passwords to comply with the new policy and check if the rules are being enforced.
The main goal of this section is to introce the reader to the bash scripting language although it will not in depth about the particularities of the language or either specifically explain each command used in the script for the contents of these subjects can spawn guides of their own. I suggest using the 'man' command line utility to search specific terminal commands used to fetch the necessary information and process it.
Beyond the script to monitor system specifications and resources usage, there is the need to schedule such task so it can be automated. As the system administrator of the server, there is the need of "programatically schedule tasks to be executed at specific intervals" (source). This tasks can be regular updates, backups, system logs management or simple monitoring tasks.
The script in bash should look something like Figure 18. The important commands that will be used to fetch the necessary information are:
| Command | Description |
|---|---|
| uname | Print some system information. |
| lscpu | Display information about the CPU architecture. |
| free | Display the total amount of free and used physical and swap memory in the system. |
| df | Display the amount of disk space available on the file system containing each file argument. |
| top | It provides a dynamic real-time view of a running system. It can display system summary information. |
| uptime | Give a one line display of the following information. The current time, how long the system has been running, how many users are currently logged on, and the system load averages for the past 1, 5 and 15 minutes. |
| ip | show/manipulate routing, network devices, interfaces and tunnels. |
| ss | Another utility to investigate sockets, used to dump socket statistics. |
| lsblk | List block devices. |
| journalctl | Query the systemd journal. |
Figure 18: monitoring script example template.
Check if the cronie package is installed. If not installed, run the following command:
dnf install cronie
Start the service and enable it with the 'systemctl' tool in the same way as the SSH section.
systemctl start crond
systemctl enable crond
Once the service start, edit the cron cofiguration file and add the script to be run. Access the cron file through the following command:
crontab -e
The syntax of cron is simple yet it can cause some confusion the first time you see it. A cron job can be scheduled by utilizing the following syntax: "* * * * * bash /path/to/some/script.sh". Each asterisk represent one field of time, minutes, hours, day of the month, month, day of the week, respectively. The asterisk means expand to all values for the field, the comma can be used as a list separator, the '-' as a range separator and '/' as a step for ranges. For example, schedule a job to run the 'annoying_script.sh', located at /usr/local/bin/, every 5 minutes of every monday of April:
*/5 * * 4 1 bash /usr/local/bin/annoying_script.sh
Run the commands following commands and make sure it is consonant with Figure 19.
NOTE: If there is another service running on port 323 of the server, disable it the same way any other service would be stopped and disabled.
Figure 19: verification commands and outputs.
Lighttpd is an open-source, secure, lightweight and fast web server optmized for high-performance environments with a low memory footprint and minimum CPU load. This software is suitable for static web pages and server that have issues with load problems. It support a wide range of features such as load balacing, FastCGI, HTTP proxy, WebScokets and more.The documentation of the lighttpd server can be found here if any problem arises.
Another open source software, focused on the free availability of a relational databse that can perform with standard proprietary databases. Also, it is built for permance and stability, with integrated cloud services and compatibility features with Oracle Database and Temporal Data Tables. It is a fork of the MySQL relational database, created bu the original developers of MySQL, after its acquisition by oracle Oracle Corporation.
Personal Home Page (Hypertext Preprocessor) is primarily a server-side scripting language. As a C-based programming language, it is high performance, integrates with the most common web servers and has an extensive library of built-in functions and extensions that facilitates web development. The PHP programming language is the backbone of Content Management Systems (CMS) such as WordPress, Joomla, Drupal. It also has a high performance when dealing with dynamic websites that heavily rely on database connection, user interaction and dynamic content display.
The setup of the PHP and the fastCGI module is requisite for the integration with MariaDB and WordPress.
A Content Management System where the user can edit, administer and manage a webpage in a graphical interface.
Install the Extra Package for Enterprise Linux (EPEL) which contains the tools to connect to other open-source repositories. Use the command bellow and afterwards install the necessary packages for all the above server services.
sudo dnf install epel-release
dnf install -y lighttpd lighttpd-fastcgi mariadb mariadb-server php php-mysqlnd php-fpm php-gd php-xml php-mbstring wget unzip
In sequence, set up the lighttpd service by starting and enabling the service with the systemctl command tool.
systemctl start lighttpd
systemctl enable lighttpd
Next, edit the configuration file for the lighttpd service, path of said file is /etc/lighttpd/lighttpd.conf. The configuration file must be ismilar to Figure 20. Check the 'server.bind' IP address (it must be the IP of the VM) and add the this line to include the 'fastcgi.conf' file for the next steps (this line probaly will be commented out, it can be just uncommented).
include "conf.d/fastcgi.conf"
Edit the modules files of lighttpd, /etc/lighttpd/modules.conf, add "mod_fastcgi" under "mod_access".
Figure 20: lighttpd configuration.
Open the port, listed in the configuration file above, in the firewall and reload it.
firewall-cmd --permanent --add-service=http
firewall-cmd --reload
Manage the SELinux context types:
semanage permissive -a httpd_t
Edit /etc/lighttpd/conf.d/fastcgi.conf and put the following at the bottom of the file:
fastcgi.server += ( ".php" =>((
"host" => "127.0.0.1",
"port" => "9000",
"broken-scriptfilename" => "enable"
)))
In sequence, set up the lighttpd service by starting and enabling the service with the systemctl command tool.
systemctl start lighttpd
systemctl enable lighttpd
Initialize the MariaDB service with the following command:
systemctl enable --now mariadb
Use the next command to safely start your installation. This command will prompt a series of options, follow the instructions and enter in the database.
mysql_secure_installation
Enter the MariaDB program and create a new database. Afterwards, create a new user and give it all the privileges.
CREATE DATABASE database42;
CREATE USER 'user'@'localhost' IDENTIFIED BY 'password';
GRANT ALL PRIVILEGES ON database42.* TO 'user'@'localhost';
FLUSH PRIVILEGES;
EXIT;
With MariaDB and Lighttpd configured and running, the service to connect it all and finish with the WordPress website is the configuration of the 'PHP-FPM', Figure 21 and 22. Navigate to the /etc/php-fpm.d/www.conf file and edit the 'user', 'group' fields to be equal to 'lighttpd', the 'listen' field to be '127.0.0.1:9000', add 'lighttpd' to 'listen.acl_users' (if there are more services listed in this field like apache and nginx, remove them), and 'listen.allow_clients' to be equal to '127.0.0.1'.
With the VIM text editor (as you should), the configuration to be edited are in lines 24, 26, 38, 55, 64, respectvely.
Figure 21: php-fpm configuration file part 1.
Figure 22: php-fpm configuration file part 2.
Finally, for the set up of a WordPress website. Download from the WP website the latest tar with the configuration files needed to the /tmp directory. Next, create a directory on the /var/www/lighttpd/ directory to be used to hold the WordPress files. Adjust the permission and the ownership of the directory and files inside it.
cd /tmp/
wget https://wordpress.org/latest.tar.gz
tar -xzvf latest.tar.gz
mkdir /var/www/lighttpd/wp_dir
mv wordpress/* /var/www/lighttpd/wp_dir
chown -R lighttpd:lighttpd /var/www/lighttpd
chmod -R 775 /var/www/lighttpd
Now it should be possible to access in the browser the website configuration page of WordPress by entering the IP address of the server with the directory created, for example http://10.11.242.240/wp_dir. Follow the steps propmt in the webpage and input the MariaDB database created in the previous steps.
NOTE: if you have any issue, go to the documentation of the service you are having problems, another way to check is seeing the logs of the console or by disabling SELinux enforcing temporarily.
All the required services are now installed and running, the only thing left to be incorporated into the server is the additional service of your choice! I installed and set up an e-mail service, however you can choose and pick any service that would be useful in a server. This could be a monitoring service such as Prometheus or Logwatch, a service to improve even further the security of the server like Fail2ban, a backup solution for efficient backup, encryption and automation, as Restic/BorgBackup, or another communication protocol such as FTP, IPFS, ...
By now, if you have reached this far into the document, you can consider yourself brave and full of endurence. I hope you have learned useful knowledge for your programming walk and if I wrote outright wrong information or innacurate takes, please issue a ticket for me to correct it!
Thank you for taking your time to read this document/guide.
If you have any doubts or suggestions for improving the guide, please, reach me in a email.