Installing and configuring Apache+ PHP+MariaDB in Debian

Read 6 minutes

16 08 2022

LAMP is a web development stack. Debian 13 "Trixie" includes PHP 8.4 and MariaDB 11.8. All commands are executed as root or with sudo.

Prerequisites

If you have a clean system, you can skip this section and proceed to Apache installation.

If you already have web components installed, execute the following commands for safety:

Creating backup of existing configurations

<code>mkdir -p /backup; dirs=""
[ -d /etc/apache2 ] && dirs+="/etc/apache2 "
[ -d /etc/mysql ] && dirs+="/etc/mysql "
[ -d /var/www ] && dirs+="/var/www "
[ -n "$dirs" ] && tar -czf /backup/lamp_$(date +%F).tar.gz $dirs
</code>

System update and port checking

<code>apt update && apt full-upgrade -y
ss -tuln | grep -E ':(80|443)\s' || echo "Ports 80/443 are free"
systemctl is-active nginx >/dev/null && { systemctl stop nginx; systemctl disable nginx; }
</code>

These commands:

Create backup of only existing configurations
Check availability of ports 80/443
Stop Nginx if installed (to avoid conflict with Apache)

Apache Installation

<code>apt install apache2 -y
systemctl enable apache2 --now
a2enmod rewrite ssl headers expires deflate
systemctl reload apache2
</code>

Test: Open your server's IP in browser:

<code>hostname -I | awk '{print $1}'
</code>

Firewall Configuration

<code>apt install ufw -y
SSH_PORT=$(ss -tuln | grep -w ssh | grep -oP '0.0.0.0:\K[0-9]+|:::\K[0-9]+' | head -1)
ufw allow ${SSH_PORT:-22}
ufw allow 80,443/tcp
ufw --force enable
</code>

Virtual Host

Creating directory and test page:

<code>mkdir -p /var/www/helloworld.net && chown -R www-data:www-data /var/www/helloworld.net && chmod -R 755 /var/www/helloworld.net
cat > /var/www/helloworld.net/index.html << 'EOF'
<!DOCTYPE html><html lang="en"><head><meta charset="UTF-8"><title>Hello World</title></head><body><h1>Hello World - Debian 13</h1></body></html>
EOF
</code>

Configuration:

Create /etc/apache2/sites-available/helloworld.net.conf:

<code><VirtualHost *:80>
    ServerName helloworld.net
    ServerAlias www.helloworld.net
    DocumentRoot /var/www/helloworld.net
    ErrorLog ${APACHE_LOG_DIR}/helloworld.net.error.log
    CustomLog ${APACHE_LOG_DIR}/helloworld.net.access.log combined
    <Directory /var/www/helloworld.net>
        Options +FollowSymLinks -Indexes
        AllowOverride All
        Require all granted
    </Directory>
    Header set X-Content-Type-Options nosniff
    Header set X-Frame-Options DENY
</VirtualHost>
</code>

Activation:

<code>a2dissite 000-default.conf 2>/dev/null
a2ensite helloworld.net.conf
apache2ctl configtest && systemctl reload apache2
</code>

Test: Visit http://helloworld.net

PHP 8.4 Installation

<code>apt install php8.4 php8.4-fpm php8.4-mysql php8.4-cli php8.4-common php8.4-curl php8.4-gd php8.4-mbstring php8.4-xml php8.4-zip -y
a2enmod proxy_fcgi setenvif
a2enconf php8.4-fpm
systemctl enable php8.4-fpm --now
systemctl reload apache2
</code>

PHP Testing

Create file /var/www/helloworld.net/test.php:

<code><?php
echo "<h1>PHP ".phpversion()."</h1><p>Server: ".php_uname()."</p><p>Time: ".date('Y-m-d H:i:s')."</p><h3>Extensions:</h3><ul>";
foreach(['mysqli','curl','gd','mbstring','xml'] as $ext) echo "<li>$ext: ".(extension_loaded($ext)?"✅":"❌")."</li>";
echo "</ul>";
?>
</code>

Test: Visit http://helloworld.net/test.php

MariaDB Installation

<code>apt install mariadb-server mariadb-client -y
systemctl enable mariadb --now
mysql_secure_installation
</code>

MariaDB 11.8 uses unix_socket for root by default. Recommended answers in the wizard:

N — don't change root password
Y — remove anonymous users
Y — disallow root login remotely
Y — remove test database
Y — reload privilege tables

Database Connection Testing

<code>WEBAPP_PASSWORD="secure_webapp_$(date +%s)_$(openssl rand -hex 6)"
mysql -e "CREATE DATABASE test_db CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; CREATE USER 'webapp'@'localhost' IDENTIFIED BY '$WEBAPP_PASSWORD'; GRANT ALL ON test_db.* TO 'webapp'@'localhost'; FLUSH PRIVILEGES;"
echo "$WEBAPP_PASSWORD" > /root/.webapp_password
chmod 600 /root/.webapp_password
</code>

Create config.php:

<code><?php
$webapp_password = trim(file_get_contents('/root/.webapp_password'));
$conn = new mysqli('localhost', 'webapp', $webapp_password, 'test_db');
?>
</code>

Create db_test.php for verification:

<code><?php
require_once 'config.php';
if($conn->connect_error) die("DB error: {$conn->connect_error}");
echo "<h2>✅ MariaDB</h2><p>Version: {$conn->server_info}</p>";
?>
</code>

Test: Visit http://helloworld.net/db_test.php

phpMyAdmin Installation

<code>apt install phpmyadmin -y
</code>

Create virtual host /etc/apache2/sites-available/phpmyadmin.conf:

<code><VirtualHost *:80>
    ServerName phpmyadmin.local
    DocumentRoot /usr/share/phpmyadmin
    <Directory /usr/share/phpmyadmin>
        Options +FollowSymLinks -Indexes
        AllowOverride All
        Require all granted
        <Files "config.inc.php">Require all denied</Files>
    </Directory>
</VirtualHost>
</code>

<code>a2ensite phpmyadmin.conf
systemctl reload apache2
</code>

Access: http://phpmyadmin.local

Optimization

Apache

<code>a2enmod cache cache_disk expires
systemctl reload apache2
</code>

MariaDB

Add to /etc/mysql/mariadb.conf.d/50-server.cnf:

<code>[mysqld]
innodb_buffer_pool_size=128M
innodb_log_file_size=32M
max_connections=100
slow_query_log=1
long_query_time=2
</code>

HTTPS with Let's Encrypt

<code>apt install certbot python3-certbot-apache -y
certbot --apache -d helloworld.net -d www.helloworld.net
</code>

Monitoring and Logs

Create status.php:

<code><?php
header('Content-Type: application/json; charset=utf-8');
echo json_encode(['status'=>'ok','time'=>date('Y-m-d H:i:s')], JSON_PRETTY_PRINT|JSON_UNESCAPED_UNICODE);
?>
</code>

Additional Security (for Production)

For development and testing environments, this section can be skipped — basic UFW protection is sufficient.

For production environments, additional protection is recommended:

Fail2Ban

<code>apt install fail2ban -y
systemctl enable fail2ban --now
</code>

Create configuration /etc/fail2ban/jail.local:

<code>[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3

[sshd]
enabled = true

[apache-auth]
enabled = true
port = http,https

[apache-badbots]
enabled = true
port = http,https

[apache-noscript]
enabled = true
port = http,https

[apache-overflows]
enabled = true
port = http,https
</code>

<code>systemctl restart fail2ban
fail2ban-client status
</code>

Diagnostics

Create script /usr/local/bin/lamp-check:

<code>#!/bin/bash
echo "=== LAMP Status ==="
systemctl status apache2 mariadb php8.4-fpm
echo "=== Web Status ==="
curl -s http://helloworld.net/status.php | jq .
</code>

<code>chmod +x /usr/local/bin/lamp-check
</code>

Updates and Maintenance

<code>apt install unattended-upgrades -y
</code>

Create cron job for weekly maintenance:

<code>echo "0 2 * * 0 apt update && apt upgrade -y && mysqlcheck --all-databases --optimize -u root" >> /etc/crontab
</code>

Complete!

LAMP on Debian 13 with PHP 8.4 and MariaDB 11.8 is installed, optimized, and secured!

facebook twitter telegram linkedin

Nataliya Oteir

Copywriter

Nataliya is a skilled content marketer and writer with great experience in a variety of niches.
She is prompt in delivering the best result with the essence of uniqueness. In addition to creating the website copy and blog content for our website, Nataliya is passionate about solving problems. In her prior role at INTROSERV, she was the communications manager.