NIX/WIN/WEB

I recently decided to try something new and perform a custom install of an AMP stack on my Fedora 10 box. I configure, build, and install everything by hand. It was an extremely rewarding experience (because it works and you learn a ton about your Linux box), but it took a while.

I kept track of each step along the way with the hopes it might help others at some point. The reason for the exercise was to give the newly released PHP 5.3 RC 2 a run through with FormBoss. I’m happy to report FormBoss runs without issue, so let’s hit the road and see if we can get you up and running too.

6/11/10 Update – Turns out this exercise has had other benefits as well. GoDaddy servers have a rather ancient build of Fedora 7 (oldy, but goodie), which in turns means the MySQL you get is a memory-leak happy 5.0.45. Unfortunately Fedora 7 has long been abandoned for updates, which means you simply cannot update past 5.0.90, and even then, though some rather risky third part channels.

For me then the solution was to roll my own custom build of MySQL to the server and deploy it in a hot-swap- manner. One hint I can give on doing this is to make sure you build a virtual machine test box and test before you try it live. So for example, you can still download Fedora 7, so I did and created a very close copy of my existing server on a virtual box. With the base system set up I took a virtual machine ‘snapshot’ for easy rollbacks if I borked something up.

Important notes:

• I start in my ~/home directory. You’ll notice a few lines down I create a directory called source–this is where I download all files to, and you will see me dive in and back out of this directory repeatedly
• Speaking of which, you’ll also notice I tried to include all shell code, and I mean all. Where I change directories, you’ll see cd /* and cd ../ The idea is one could literally follow along step-by-step.
• See that [#YOUR_USER_NAME] below in the code? Because I want to issue sudo instead of using root the whole time, I need to be on the ‘list’ of sudoers, which by default on a Fedora install you won’t be. Thus, we need to use the visudo utility to update our /etc/sudoers file with your user name and give it all privileges. However, you could always skip this and simply su – to root, but apparently nerds frown upon that.
• Any instructions in parenthesis () are not shell commands but a keystroke or an action you need to perform in the Desktop environment. For example, the (INSTALL ‘Development file for the Ncurses Library’) line means we need to use the excellent System > Add/Remove Software tool to find and install that package.
• We use /opt/ to install everything into as opposed to /usr/local/. Apparently this is a good thing, as it helps us keep /usr/local/ cleaner.
• However, that also means we need to add the /opt directory to our shell, which is outlined below.
• Lines with a double dash – + – are comments, aimed at breaking each section into smaller parts.
• I’m using Fedora 64 bit, though x32 should be the same process mostly
• I was not able to get several PHP extensions installed, notably SSL, XML, and GD. SSL and XML was mainly due to external libraries not being found, and could have been fixed if I had more time. GD was because their is a known error with Athlon 64 Processors and some library named libtool — this compatibility problem causes a build error which prevents a shared version of the JPEG library from being installed, which blah blah, problem problem. I was too tired by that point to care. You can always ./configure and make PHP again, that’s the beauty of the ‘self roll’ process. In short, I’ll get it fixed soon, but for now, the important point is that the instructions below allow you to use FormBoss or any number of modern apps just fine. That said, because I’m not using GD, you can skip the Freetype and JPEG steps.
• I should give a small disclaimer–these instructions should work, but just to be safe, build yourself a virtual test box (or boot drive) that you don’t care about for play times like this.

On to the code:

– Tested On Fedora 10 – x86_64, but works on basically any Fedora release from 7 on up–

–PREP

We need to be root to perform almost every step here, and we can become root by using:

su – [then typing password in Fedroa ]
sudo + the command we want [ Ubuntu ]

The su – method (Substitute User) may be easiest, as it allows us to skip the next step and is probably safer.

This is because in Fedroa like distros in order to use sudo we need to be a sudoer,
which the next step will allow us to become.

However, using su – gives us the same root access without needing to edit the sudoers file.
It should be noted that in Debian distros (Ubuntu), we can use sudo right out of the gate.

Which one you’ll want to use is up to you, though I suggest the su – method for Fedora. If you decide to use that, simply remove any reference to sudo in the code below, as you will already be impersonating the super (root) user, and the command is therefor redundant.

If you want to add your self to the sudores list:

With that done, lets create some directories.

Now let’s install some software using yum or apt-get. Yum for Fedora, apt-get for Ubuntu as in:

yum install libxml

apt-get install libxml

(INSTALL ‘Development file for the Ncurses Library’)
(INSTALL ‘Libxml development tools’)
(INSTALL ‘Files for development of applications which will use OpenSSL’)
(INSTALL ‘OpenSSL crypto plug-in for XML Security Files’)
(INSTALL ‘Files needed for building applications with libcurl’)

(Create the user and group ‘apache’, if you haven’t already)
(Create the user and group ‘mysql’, if you haven’t already)

–Do in the GUI if possible as: System > Administration > Users and Groups)
Important note: We want to set the home directory of the MySQL user to be where the
database table data is stored–in most environments this will be /var/lib/mysql/

–SET SHELL PATH FOR BUILDING TO /opt

–APACHE

** Please see Auto Start and troubleshooting below for more hints and tricks.

–MYSQL

** Please be sure to checkout the Auto Start section below for hints on auto loading MySQL.

–Quick note:
This chown and chgrp step is also done to the directory where the MySQL table data resides, which for most servers will be at [ /var/lib/mysql ]. It is important to note that this directory will only exist in new installs after the mysql_install_db step, but of course in existing setups, may already exist.

–Start MySQL

–Set the root passwords and allow localhost access.

–helpful paths

–PHP AND RELATED FILES

–get back to ~/home/source if not already

–FREETYPE (OPTIONAL)

http://freetype.sourceforge.net/download.html#stable

–JPEG (OPTIONAL)

–PHP CORE

The following configure command assumes a 64-bit OS! If you have a 32-bit OS, you should be able to remove any reference to the ’64-bit’ options, or replace or remove any instance of ’64′.

–END OF INSTALL PROCESS. NOW TIME TO CONFIGURE.

–configure Apache config to work with PHP

First we comment out this next line as we are going to use a different config style in the Debian tradition of having conf.d/ directories for better separation of settings. It should be said though that if we had installed Apache and PHP using Fedora’s built-in package manager it would use this same style we are about to set up:

–add towards the bottom near the other includes (this is the include dir we’ll use):

–search for:
User [some user, possibly daemon or your user name]
Group [some group, possibly daemon or your user name]

–and change user and group to: apache

–add two files (vi alias.conf and vi php.conf or however you create text files):

–the above step should be able to be done with your still open gedit,
as you sudo (gksudo if on Ubuntu) launched it

–open (again vi or gedit) php.conf and add:

–save and close

–open alias.conf and add (mind the last line about changing the ‘name’ setting!)

–save and close

This next step creates a public_html directory for our current user.
You can make this whatever you want, but be mindful that it must match the
Alias /home “/home/matt/public_html/” setting from the previous step.

–USER AND GROUP FOR WEB INFO

– I like to create a user and group called www that both my user (matt)
– and apache belong too, then then set the [user] and [group] of my web folder
– (public_html), to www. So long as apache, matt, and www are members of the
– www group, I can write files, apache can serve them, and everyones happy.
– Even better, I can chmod -R 770 on the public_html folder, which means we
– have no world anything on that folder.
– At any rate, our apache config expects a public_html folder, so eiether create
– one or change the config to something else.

A Note on Security:

In some cases you may have a problem getting Apache to read from your web directories. If this happens, a common result will be a web page error like:

You don’t have permission to access / on this server.

To fix something like this the first step is to check our error logs…only problem is, the error log will say the same thing as the web page, that the page could not be accessed.

However, we may get lucky and see a more specific error like:
(13)Permission Denied

If so, this is good because it tells us that we have an operating system error, not an Apache configuration file one.

To help solve this issue, as an interesting exercise we can use the su command to see exactly what the server does when a file access operation happens.

To do so, we enter this command:
su – apache -s /bin/bash

We are now impersonating the Apache user, complete with access privileges.

We can then issue a cat command, for example:

cat /home/matt/public_html/formboss/index.php

…which will give us the Permission Denied error if we had the (13)Permission Denied message.

If this is the case, then it means that at some point in our file path to the web folder we have a set of permissions that prevent Apache from accessing files. The italic part is key — We can set say, 755 on the:

/home/matt/public_html

folder, but if the:

/home/matt

directory has 700, then that setting will prevent the downstream folder from granting Apache access, even when the specific folder Apache wants has the correct permissions!

To fix this then we simply set 755 on the entire path all the way to root.

-Auto Start Apache and MySQL

It would be quite undesirable for us to have to restart each service after a reboot. The good news is the chkconfig program makes this really easy to set our services to autoload.

When we install MySQL or Apache using the package manager we will get a startup scripts installed to:
/etc/init.d/

Though in a custom build like ours, we have to move these files manually. I know this is a bit of a cheat, but please check Apache and MySQL documentation for the directions on what files we need to move. It should be a simple one-file move though.

We can then issue a chkconfig command that refers to that script such that at the next bootup, the service starts automatically.

in our case we will issue:
(please note those are double dashes below – -)

Please note that on Ubuntu we can install chkconfig, but most scripts do not support this tool, but rather upstart or BUM (Boot Up Manager).

All Done?

A ask that as a question as much can go wrong. However, if we did everything right we can find our  home page (public_html) by typing this into a browser:

http://localhost/home

SELinux to the Rescue?

With this done we still have to deal with the important SELinux system.

I’ll have to recheck this at some point, but for now I’ll just paste in what I wrote at the time I was setting up my initial server:

6. SELinux creates some issues for us when trying to use home directories:

http://beginlinux.com/server_training/web-server/976-apache-and-selinux

Issue: getsebool -a | grep httpd

To see that the home directory serving is off.

Navigate to the public_html directory as root and issue:
restorecon -R -v ‘.’.

This should allow for proper access.

In order to allow HTTP to write files, we need:
httpd_TYPE_script_rw_t

via: chcon -R -t httpd_sys_script_rw_t *

in our web directory or possibly:

chcon -R -t httpd_user_script_rw_t *

In a nutshell, you will get errors when trying to serve web pages without doing these and possibly other tasks. Doubly so with PHP, and even more so with PHP trying to write files to the file system.

Apparently many users get fed up with SELinux and end up turning it off–I’m not adverse to that. I realize it’s a great system, but honestly, I routinely hear of even seasoned veterans getting fed up in the same manner.

If you want to disable SELinux you can do so by editing your /etc/selinux/config file by changing :

SELINUX=Enforcing

to

SELINUX=disabled

You will then need to retag your file system, which will take a reboot.

In Closing

I consider this R1, and hope to improve upon this post in the coming weeks. Any thoughts, let ‘em be heard!

UPDATE LOG

6/8/09 – Fedora 11 is being released in a few days, will be updating this code on a new build.
6/11/10 – Updated with more detailed steps for command line MySQL setup.