Code: Select all
#!/bin/sh
# Instructions on how to use this script:
# chmod +x SCRIPTNAME.sh
# sudo ./SCRIPTNAME.sh
#
# SCRIPT: self-full-famp.sh
# SET FOR: Production
# (For Alpha, Beta, Dev, Test and Production)
#
# PLATFORM: FreeBSD 12/13
#
# PURPOSE: This script installs a FAMP stack
#
# set -n # Uncomment to check your syntax, without execution.
# # NOTE: Do not forget to put the comment back in or
# # the shell script will not execute!
##########################################################
################ BEGINNING OF MAIN #######################
##########################################################
# This is a full Wordpress install on:
# FreeBSD 12 + Apache 2.4 latest pkg + MySQL 8 + PHP 8.2
# Apache HTTP is set on MPM Event and PHP-FPM
# Certificate is self signed
# Change ServerName, DB name, usernames, etc to your needs.
# Change the default pkg repository from quarterly to latest
sed -ip 's/quarterly/latest/g' /etc/pkg/FreeBSD.conf
# Update packages (it will first download the pkg repo from latest)
# secondly it will upgrade any installed packages.
pkg upgrade -y
# Install Apache
pkg install -y apache24
# Add service to be fired up at boot time
sysrc apache24_enable="YES"
# Install MySQL
pkg install -y mysql80-server
# Add service to be fired up at boot time
sysrc mysql_enable="YES"
sysrc mysql_args="--bind-address=127.0.0.1"
# Install PHP 8.2 and its 'funny' dependencies for WordPress
pkg install -y php82\
php82-bcmath\
php82-bz2\
php82-ctype\
php82-curl\
php82-dom\
php82-exif\
php82-extensions\
php82-fileinfo\
php82-filter\
php82-ftp\
php82-gd\
php82-iconv\
php82-intl\
php82-mbstring\
php82-mysqli\
php82-opcache\
php82-pdo\
php82-pdo_mysql\
php82-pdo_sqlite\
php82-pecl-mcrypt\
php82-phar\
php82-posix\
php82-session\
php82-simplexml\
php82-soap\
php82-sockets\
php82-sqlite3\
php82-tokenizer\
php82-xml\
php82-xmlreader\
php82-xmlwriter\
php82-zip\
php82-zlib\
php82-pecl-imagick-3.7.0_1
php82-extensions
# Set a ServerName directive in Apache HTTP. Place a name to your server.
sed -i -e 's/#ServerName www.example.com:80/ServerName California/g' /usr/local/etc/apache24/httpd.conf
# Configure Apache HTTP to use MPM Event instead of the Prefork default
# 1.- Disable the Prefork MPM
sed -i -e '/prefork/s/LoadModule/#LoadModule/' /usr/local/etc/apache24/httpd.conf
# 2.- Enable the Event MPM
sed -i -e '/event/s/#LoadModule/LoadModule/' /usr/local/etc/apache24/httpd.conf
# 3.- Enable the proxy module for PHP-FPM to use it
sed -i -e '/mod_proxy.so/s/#LoadModule/LoadModule/' /usr/local/etc/apache24/httpd.conf
# 4.- Enable the FastCGI module for PHP-FPM to use it
sed -i -e '/mod_proxy_fcgi.so/s/#LoadModule/LoadModule/' /usr/local/etc/apache24/httpd.conf
# Enable PHP to use the FPM process manager
sysrc php_fpm_enable="YES"
# Create configuration file for Apache HTTP to 'speak' PHP
touch /usr/local/etc/apache24/modules.d/003_php-fpm.conf
# Add the configuration into the file
echo "
<IfModule proxy_fcgi_module>
<IfModule dir_module>
DirectoryIndex index.php
</IfModule>
<FilesMatch \"\.(php|phtml|inc)$\">
SetHandler "proxy:fcgi://127.0.0.1:9000"
</FilesMatch>
</IfModule>" >> /usr/local/etc/apache24/modules.d/003_php-fpm.conf
# Set the PHP's default configuration
cp /usr/local/etc/php.ini-production /usr/local/etc/php.ini
# Fire up the services
service apache24 start
service mysql-server start
service php-fpm start
# Make the hideous 'safe' install for MySQL
# Install GNU sed to circumvent some of the syntax challenges the BSD sed has
# such as inserting a line of text in a specific location needing a new line, etc.
pkg install -y gsed
# Be aware we are using GNU sed here.
# When inserting lines do it from bottom to top or inserting new lines can disrupt
# the default order of a file, eventually breaking the configuration.
# Consider using echo instead.
# 1.- Removing the OS type and modifying version banner (no mod_security here).
# 1.1- ServerTokens will only display the minimal information possible.
gsed -i '227i\ServerTokens Prod' /usr/local/etc/apache24/httpd.conf
# 1.2- ServerSignature will disable the server exposing its type.
gsed -i '228i\ServerSignature Off' /usr/local/etc/apache24/httpd.conf
# Alternatively we can inject the line at the bottom of the file using the echo command.
# This is a safer option if you make heavy changes at the top of the file.
# echo 'ServerTokens Prod' >> /usr/local/etc/apache24/httpd.conf
# echo 'ServerSignature Off' >> /usr/local/etc/apache24/httpd.conf
# 2.- Avoid PHP's information (version, etc) being disclosed
sed -i -e '/expose_php/s/expose_php = On/expose_php = Off/' /usr/local/etc/php.ini
# 3.- Fine tunning access to the DocumentRoot directory structure
sed -i '' -e 's/Options Indexes FollowSymLinks/Options -Indexes +FollowSymLinks -Includes/' /usr/local/etc/apache24/httpd.conf
# Use the following entries (by uncommenting these and commenting the above GNU sed ones)
# if you are using the stdard-famp.sh script, or things will break.
# echo 'RewriteEngine On' /usr/local/etc/apache24/httpd.conf
# echo 'RewriteCond %{HTTPS} !=on' /usr/local/etc/apache24/httpd.conf
# echo 'RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]' /usr/local/etc/apache24/httpd.conf
# 5.- Secure headers
echo "
<IfModule mod_headers.c>
Header set Content-Security-Policy \"upgrade-insecure-requests;\"
Header set Strict-Transport-Security \"max-age=31536000; includeSubDomains\"
Header always edit Set-Cookie (.*) \"\$1; HttpOnly; Secure\"
Header set X-Content-Type-Options \"nosniff\"
Header set X-XSS-Protection \"1; mode=block\"
Header set Referrer-Policy \"strict-origin\"
Header set X-Frame-Options: \"deny\"
SetEnv modHeadersAvailable true
</IfModule>" >> /usr/local/etc/apache24/httpd.conf
# 6.- Disable the TRACE method.
echo 'TraceEnable off' >> /usr/local/etc/apache24/httpd.conf
# 7.- Allow specific HTTP methods.
gsed -i '269i\ <LimitExcept GET POST HEAD>' /usr/local/etc/apache24/httpd.conf
gsed -i '270i\ deny from all' /usr/local/etc/apache24/httpd.conf
gsed -i '271i\ </LimitExcept>' /usr/local/etc/apache24/httpd.conf
# 8.- Restart Apache HTTP so changes take effect.
service apache24 restart
# Change the ownership of the DocumentRoot path content from root to the Apache HTTP user (named www)
chown -R www:www /usr/local/www/apache24/data
# Preventive services restart
service apache24 restart
service php-fpm restart
service mysql-server restart
I have checked the httpd.conf and find nothing which transfers to SSL.
I did remove httpd-ssl-conf from the Apache24/extra folder. However it still persists.
I'm considering downloading the quick install from phpBB website... but prefer to continue on this path.
Please tell me what to do to eliminate this obnoxious referral... I've checked the code and I can't see what needs to be done.
