Setting up a new droplet on Digitalocean with Webmin, LAMP and SSL

The current article contains resources and ideas on how to setup an Ubuntu 16.04 droplet on Digitalocean, together with Webmin, LAMP – where M might 🙂 stand for MariaDB – and SSL from letsencrypt.

First of all, for the domain name you could use a free domain name provided by freenom.com (.tk, .ga, .ml, .gq or .cf extensions). Also, you have a choice between using the Freenom provided DNS or the Digitalocean DNS, which are both free of charge. I am now going for the Digitalocean DNS, as they have a nicer interface.

Important notes:

our server’s address is example.com;
the dns needs to solve webmin.example.com the same as example.com;
our main example user is sudouser. So, please do replace that with your user wherever you have it in the commands;
to enable monitoring – which is free of charge, at least at the moment – via SSH in a droplet, use the following command:
curl -sSL https://agent.digitalocean.com/install.sh | sh
for some operations in the server, you could use Midnight Commander: sudo apt-get install mcto install and mcto open the interface.

Initial setup

To begin, we need a fresh and clean droplet. Except for the OS, we do not need anything else.

Security aspects

Using the root account directly is not recommended, as it has way too extended privileges in the system. Therefore, we will create a new user with sudo access and disable the root account:

adduser sudouser
usermod -aG sudo sudouser
sudo passwd -l root
su - sudouser

For enhanced security, we could use Public Key Authentication with disabled password authentication.

Also, it is important to setup the firewall rules and enable the firewall:

sudo ufw app list
sudo ufw allow OpenSSH
sudo ufw enable
sudo ufw status
sudo ufw disable

Please remember to add a specific rule for each of the programs you install and also to enable the firewall at the end of this tutorial.

Set up locale settings

Use the following commands to fix your locale environment:

locale
apt-get install language-pack-en-base
sudo dpkg-reconfigure locales
To change the locale settings with an interface
exit and log back in

Enable a swap file

sudo swapon --show
sudo fallocate -l 4G /swapfile
ls -lh /swapfile
sudo chmod 600 /swapfile
ls -lh /swapfile
sudo mkswap /swapfile
sudo swapon /swapfile
sudo swapon --show

SQLite

sudo apt-get install sqlite3 libsqlite3-dev

A Webmin-only setup

LAMP

Apache

sudo apt-get update &&sudo apt-get install apache2 -y
sudo apache2ctl configtest
sudo systemctl restart apache2
sudo ufw app info "Apache Full"
sudo ufw allow in "Apache Full"

MariaDB

sudo apt update
sudo apt install software-properties-common -y
sudo apt-key adv --recv-keys --keyserver hkp://keyserver.ubuntu.com:80 0xF1656F24C74CD1D8
sudo add-apt-repository 'deb [arch=amd64,i386,ppc64el] http://lon1.mirrors.digitalocean.com/mariadb/repo/10.1/ubuntu xenial main'
sudo apt update
sudo apt install mariadb-server -y

PHP

We will use the latest version of PHP.

sudo apt-get install php libapache2-mod-php php-mcrypt php-mysql
sudo systemctl restart apache2
sudo systemctl status apache2

Add some necessary packages

sudo apt-get install php7.0-zip

Other necessary software

Postfix

sudo apt-get update
sudo DEBIAN_PRIORITY=low apt-get install postfix
sudo ufw allow Postfix

Composer

sudo apt-get update
sudo apt-get install curl php-cli php-mbstring git unzip
cd ~
curl -sS https://getcomposer.org/installer -o composer-setup.php
sudo php composer-setup.php --install-dir=/usr/local/bin --filename=composer

NVM

sudo apt-get update
sudo apt-get install build-essential libssl-dev
curl -sL https://raw.githubusercontent.com/creationix/nvm/v0.33.8/install.sh -o install_nvm.sh
bash install_nvm.sh

Node.js and NPM

nvm install 8.9.4
nvm use 8.9.4

Webmin

sudo nano /etc/apt/sources.list
append the following line to sources.list:
deb http://download.webmin.com/download/repository sarge contrib
press Ctrl+x and then confirm saving with y
wget http://www.webmin.com/jcameron-key.asc
sudo apt-key add jcameron-key.asc
sudo apt-get update
sudo apt-get install webmin

Change default access settings

For changing these settings, we will use the webmin interface. Login to your webmin interface via http://example.com:1000 with sudouser and the established password;

Webmin

We will asume that the new host is webmin.example.com and the port is 30000

In the sidemenu select “Webmin > Webmin configuration”;
Click “Ports and Addresses”;
Change “Listen for broadcasts on UDP port” to 30000;
Change “Web server hostname” to webmin.example.com and save the form;
Click “Restart Webmin”.

Mysql

In the sidemenu select “Servers > Mysql Database Server”
Select “MySQL Server Configuration”
Change the value for “MySQL server port”;
Click “Save and Restart MySQL”.

SSH

In the sidemenu select “Servers > SSH Server”;
Go to “Networking”;
Change the value for “Listen on port” to a different number and save the form;
Click “Apply changes”

SSL

Webmin

In the sidemenu select “Webmin > Webmin configuration”;
Select “SSL Encryption”;
Complete the “Hostnames for certificate” with the domains you want in the certificate;
For “Website root directory for validation file”, select the “Other Directory” button and enter /var/www/html
For “Months between automatic renewal section”, deselect the “Only renew manually” option by typing 1 into the input box, and selecting the radio button to the left of the input box;
Click the “Request Certificate” button. After a few seconds, you will see a confirmation screen and then you will need to restart webmin.
Wait for about 30 seconds, reload the page and login again.

Apache

All hosted websites will have a specific configuration file structure, which will enforce the usage of https://

E.g.:

<VirtualHost *>
  <Directory "/var/www/sites/subdomain.example.com">
    Allow from all
    Options +Indexes

    <IfModule mod_rewrite.c>
      RewriteEngine On
      RewriteBase /
      AllowOverride All

      <IfModule mod_ssl.c>
        RewriteCond %{SERVER_NAME} =subdomain.example.com
        RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
      <IfModule>
    </IfModule>

    <IfModule mod_ssl.c> 
      SSLCertificateFile /etc/webmin/letsencrypt-cert.pem 
      SSLCertificateKeyFile /etc/webmin/letsencrypt-key.pem 
      SSLCACertificateFile /etc/webmin/letsencrypt-ca.pem 
    </IfModule>
  </Directory>

  DocumentRoot /var/www/sites/subdomain.example.com
  ServerName subdomain.example.com
</VirtualHost>Code language: HTML, XML (xml)

The configuration files for Apache are usually in /etc/apache2/sites-enabled . Also, do remember to add your domains to the certificate.

If you have made changes to the configuration files, use service apache2 restart to apply them.

About the directory structure

All the websites will be stored in /var/www/sites;
All the websites will be stored in the root of the public file, without parent directories.
E.g. /var/www/sites/example2/ or /var/www/sites/firstsubdomain.example.com

phpMyAdmin

sudo apt-get update
sudo apt-get install bzip2 zip unzip
sudo apt-get install php7.0-bz2
sudo apt-get install phpmyadmin php-mbstring php-gettex
Use the defaults provided by the installation, spacebar to select.
sudo phpenmod mcrypt
sudo phpenmod mbstring
sudo systemctl restart apache2

phpMyAdmin should be available at: http://example.com/phpmyadmin

If the result is an not found page, the following might help you:

sudo ln -s /etc/phpmyadmin/apache.conf /etc/apache2/conf-available/phpmyadmin.conf
sudo a2enconf phpmyadmin.conf
sudo systemctl restart apache2

Further configuration can be done with:

sudo htpasswd -c /etc/phpmyadmin/htpasswd.setup admin
sudo pma-configure
Then go to http://example.com/phpmyadmin/setup (here the browsers ask for auth, the user is admin and the password is what you write in first command), with that wizard you configure your servers
sudo pma-secure

A Virtualmin setup

For our server, we do not the full power of Virtualmin: the main thing we will use is the security it provides though easy to use and good looking interfaces. Another thing is that it can easily be extended, though it would be better to have the options figured out before actually using the server.

Resources inside this article

setup locale;
setup the sudo user;

Virtualmin

sudo apt-get update
sudo apt-get dist-upgrade -y
wget https://software.virtualmin.com/gpl/scripts/install.sh
sudo /bin/sh ./install.sh --minimal --force

Complete the post install by accessing https://example.com:10000 .

Edit apache landing page

sudo nano /var/www/html/index.html
delete all the content and something basic and new (e.g. “Hello world!”);
press Ctrl+xand confirm with Y

Remember to

add SSL from letencrypt;
change default ports and addresses;
activate automatic updates, wherever you think it’s useful.

Setting up a new droplet on Digitalocean with Webmin, LAMP and SSL

Initial setup

Security aspects

Set up locale settings

Enable a swap file

SQLite

A Webmin-only setup

LAMP

Apache

MariaDB

PHP

Add some necessary packages

Other necessary software

Postfix

Composer

NVM

Node.js and NPM

Webmin

Change default access settings

Webmin

Mysql

SSH

SSL

Webmin

Apache

About the directory structure

phpMyAdmin

A Virtualmin setup

Resources inside this article

Virtualmin

Edit apache landing page

Remember to

Sources

A quick note