How to install LEMP environment for Nginx server in Ubuntu

Preparation

Install ubuntu 16.04 server version

Step 1: Install nginx server

1, nginx It is an advanced, resource-optimized web server program used to display web pages to visitors on the Internet. We start with the installation of the nginx server and use the apt command to obtain the nginx program from the official software repository of ubuntu.

$ sudo apt-get install nginx

Install nginx on ubuntu 16.04
2. Then enter the netstat and systemctl commands to confirm that the nginx process has been started and bound to port 80.

$ netstat -tlpn

Check nginx network port connection

$ sudo systemctl status nginx.service

Check nginx service status

When you confirm that the service process has been started, you can open a browser, use the http protocol to access your server IP address or domain name, and browse the default web page of nginx.

http://ip-address

Step 2: Enable nginx http/2.0 protocol

3. Support for http/2.0 protocol is included by default in the latest release of nginx on ubuntu 16.04 Binary is included, it only connects via ssl and promises a huge improvement in loading web pages.

To enable this protocol of nginx, first find the website configuration file provided by nginx and enter the following command to back up the configuration file.

$ cd /etc/nginx/sites-available/
$ sudo mv default default.backup

Back up nginx website configuration file
4. Then, use a text editor to create a new default file and enter the following content:

server {
    listen 443 ssl http2 default_server;
    listen [::]:443 ssl http2 default_server;
    root /var/www/html;
    index index.html index.htm index.php;
    server_name 192.168.1.13;
    location / {
        try_files $uri $uri/ =404;
    }
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;
    ssl_protocols tlsv1 tlsv1.1 tlsv1.2;
    ssl_prefer_server_ciphers on;
    ssl_ciphers eecdh+chacha20:eecdh+aes128:rsa+aes128:eecdh+aes256:rsa+aes256:eecdh+3des:rsa+3des:!md5;
    ssl_dhparam /etc/nginx/ssl/dhparam.pem;
    ssl_session_cache shared:ssl:20m;
    ssl_session_timeout 180m;
    resolver 8.8.8.8 8.8.4.4;
    add_header strict-transport-security "max-age=31536000;
    #includesubdomains" always;
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }
    location ~ /\.ht {
        deny all;
    }
}
server {
    listen     80;
    listen  [::]:80;
    server_name  192.168.1.13;
    return     301 https://$server_name$request_uri;
}

Enable nginx http 2 protocol
The above configuration snippet adds the http2 parameter to all ssl listening instructions to enable http/2.0.

The last section added to the server configuration above is used to redirect all non-ssl traffic to the ssl/tls default host. Then replace the server_name option with your host's IP address or DNS record (preferably the fqdn name).

5. After you follow the above steps to edit the default configuration file of nginx, use the following commands to generate and view the SSL certificate and key.

Use your custom settings to complete the certificate production. Note that the common name is set to match your dns fqdn record or server ip address.

$ sudo mkdir /etc/nginx/ssl
$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/ssl/nginx.key -out /etc/nginx/ssl/nginx.crt
$ ls /etc/nginx/ssl/

Generate nginx ssl certificate and key
6. Use a strong dh encryption algorithm by entering the following command, which will modify the previous configuration file ssl_dhparam configuration document.

$ sudo openssl dhparam -out /etc/nginx/ssl/dhparam.pem 2048

Create diffie-hellman key
7. After the diffie-hellman key is generated, verify whether the nginx configuration file is correct and whether it can be served by the nginx network program application. Then run the following command to restart the daemon and observe any changes.

$ sudo nginx -t
$ sudo systemctl restart nginx.service

Check nginx configuration
8. Type the following command to test that nginx uses the http/2.0 protocol. If you see h2 in the protocol, it means that nginx has been successfully configured to use the http/2.0 protocol. All latest browsers support this protocol by default.

$ openssl s_client -connect localhost:443 -nextprotoneg ''

Test the nginx http 2.0 protocol

Step 3: Install the php 7 interpreter

With the assistance of the fastcgi process management program, nginx can generate dynamic web content using the PHP dynamic language interpreter. fastcgi can be obtained by installing the php-fpm binary package from the ubuntu official repository.

9. Enter the following command in your server console to obtain php7.0 and the extension package, which allows php to communicate with the nginx network service process.

$ sudo apt install php7.0 php7.0-fpm

Install php 7 and php-fpm
10. After the php7.0 interpreter is successfully installed, enter the following command to start or check the php7.0-fpm daemon process:

$ sudo systemctl start php7.0-fpm
$ sudo systemctl status php7.0-fpm

开启、验证 php-fpm 服务
11、 当前的 nginx 配置文件已经配置了使用 php fpm 来提供动态内容。

下面给出的这部分服务器配置让 nginx 能够使用 php 解释器，所以不需要对 nginx 配置文件作别的修改。

location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php7.0-fpm.sock;
    }

下面是的截图是 nginx 默认配置文件的内容。你可能需要对其中的代码进行修改或者取消注释。

启用 php fastcgi
12、 要测试启用了 php-fpm 的 nginx 服务器，用下面的命令创建一个 php 测试配置文件 info.php。接着用 http://ip_or domain/info.php 这个网址来查看配置。

$ sudo su -c &#39;echo "<?php phpinfo(); ?>" |tee /var/www/html/info.php&#39;

创建 php info 文件

检查 php fastcgi 的信息
检查服务器是否宣告支持 http/2.0 协议，定位到 php 变量区域中的 $_server[‘server_protocol'] 就像下面这张截图一样。

检查 http2.0 协议信息
13、 为了安装其它的 php7.0 模块，使用 apt search php7.0 命令查找 php 的模块然后安装。

如果你想要 安装 wordpress 或者别的 cms，需要安装以下的 php 模块，这些模块迟早有用。

$ sudo apt install php7.0-mcrypt php7.0-mbstring

安装 php 7 模块
14、 要注册这些额外的 php 模块，输入下面的命令重启 php-fpm 守护进程。

$ sudo systemctl restart php7.0-fpm.service

第 4 步：安装 mariadb 数据库

15、 最后，我们需要 mariadb 数据库来存储、管理网站数据，才算完成 lemp 的搭建。

运行下面的命令安装 mariadb 数据库管理系统，重启 php-fpm 服务以便使用 mysql 模块与数据库通信。

$ sudo apt install mariadb-server mariadb-client php7.0-mysql
$ sudo systemctl restart php7.0-fpm.service

安装 mariadb
16、 为了安全加固 mariadb，运行来自 ubuntu 软件仓库中的二进制包提供的安全脚本，这会询问你设置一个 root 密码，移除匿名用户，禁用 root 用户远程登录，移除测试数据库。

输入下面的命令运行脚本，并且确认所有的选择。参照下面的截图。

$ sudo mysql_secure_installation

mariadb 的安全安装
17、 配置 mariadb 以便普通用户能够不使用系统的 sudo 权限来访问数据库。用 root 用户权限打开 mysql 命令行界面，运行下面的命令：

$ sudo mysql 
mariadb> use mysql;
mariadb> update user set plugin='‘ where user='root';
mariadb> flush privileges;
mariadb> exit

mariadb 的用户权限
最后通过执行以下命令登录到 mariadb 数据库，就可以不需要 root 权限而执行任意数据库内的命令：

$ mysql -u root -p -e 'show databases'

查看 mariadb 数据库

The above is the detailed content of How to install LEMP environment for Nginx server in Ubuntu. For more information, please follow other related articles on the PHP Chinese website!