Newb-Friendly Linux Flavor For LAMP Server?

First time accepted submitter bhcompy writes "I need to setup a system to serve 2500 users and I've been looking at a LAMP setup. This is not commercial, more of a personal side project for some friends. I've no experience configuring or administering a Linux server having worked with MS and PICK based solutions my whole life, so I'm looking for something that will be relatively straightforward to implement and not a chore to manage and preferably not completely CLI. I will be serving a forum(phpBB 3 suits my needs and seems adequate) and a variety of PHP driven content with a MySQL backend. Requirements are PHP 5.3.0+ and MySQL 5+. Suggestions?"

Comments

SME server

[Raleel]

I haven't verified that it has all the versions that you want, but I've used SME server on and off over the years for such things. It's quite newb friendly, and not completely command line. There are quite a few other options as well.

Re:SME server

[b0bby]

I agree - if SME has what you want, it's really simple to get running and keep going. I've used it for years for personal stuff, and it's solid.

Otherwise, I use Ubuntu server these days, just because it's got the most momentum so if there's a problem, someone knows how to fix it, and there are tons of tutorials available.

Easy.

[grim4593]

Pick Debian or something Debian based like Ubuntu.

Re:Easy.

[houstonbofh]

Ubuntu has the largest mindshare, and the most nubie friendly support http://ubuntuforums.org/ as well as paid support if you get in over your head. You can install the "Server" version, and with "sudo apt-get install ubuntu-desktop" you would have the full GUI. You you can run a server on the desktop version, but with that many users, you will want a server kernel.

Re:Easy.

[Keruo]

Debian testing should fit those requirements nicely. It's stable enough to be run in non-profit production.

Re:Easy.

[drosboro]

I agree with the suggestion to use Ubuntu, especially due to the massive amount of old forum posts online that will answer most questions. However, installing ubuntu-desktop will certainly give you a GUI, but that GUI won't particularly help you to administer your LAMP stack.

Going completely CLI isn't as bad as you might think - there's a relatively small number of commands you'd need to use. My advice is to find a tutorial or small book on setting up an Ubuntu LAMP server, and then keep a personal "cheat-sheet" of the commands you've been using, because you'll probably want them again at some point. And, on the plus side, you learn something new!

Re:Easy.

[houstonbofh]

The default kernel installed with Ubuntu server id different from the default kernel installed with Ubuntu desktop. Short version is that the desktop kernel is optimized for a single user at the desktop, where the server kernel is optimized for lots of threads, but a slightly laggier desktop experience.

Re:Easy.

[vlm]

1) rely on Debian and their 500 mirrors to keep your security up to date. The debian maintainer group outnumbers you, oh, about a hundred to one, so if you're planning on deploying your own hand compiled security patches you're doing it wrong... just "apt-get update" and "apt-get upgrade" on a regular basis and/or when you see something interesting on the security mailing list.

2) Speaking of #1 above, "apt-get install phpbb3". Its a maintained package... Unless you're a better maintainer than the package maintainer (sometimes this happens) you are better off using the standard supported package.

with a MySQL backend

Don the asbestos suit... I'm not going to flame you, but others will, especially since phpbb3 supposedly works fine with the php5-pgsql module.

Re:Easy.

[taiwanjohn]

Yes. Don't fear the CLI. As the GP says, UbuntuForums is a great resource, and in many cases you can cut-n-paste commands directly from there into your terminal. If the OP is completely new to the CLI, he/she will want to be cautious about this and do some research (RTFman-page) to make sure the commands do what's wanted.

From the summary, it sounds like the OP wants to set up a forum for some group. Therefore, most of the "hard" part (the CLI stuff) will be required during initial setup. Once phpBB is up and running, most of the admin stuff will be done within the native phpBB interface.

One suggestion: get familiar with one of the numerous backup/restore utilities available. Google around for a comparative review and you'll probably find one that fits your GUI requirements. Figure out how to use it (preferably before you go live with the server) so you can easily save your bacon in case of a catastrophic fuckup.

Re:Easy.

[Walter White]

I agree with the suggestion to use Ubuntu, especially due to the massive amount of old forum posts online that will answer most questions. However, installing ubuntu-desktop will certainly give you a GUI, but that GUI won't particularly help you to administer your LAMP stack.

I find it very useful to have a GUI when administering an Ubuntu system. It's great to have a couple CLI windows open in which commands can be typed. I can 'tail' a log file while I type commands in another terminal window. A web browser can be used to check the results of commands that will affect the outward facing parts of the system.

When you get to using the on line support forums to help deal with issues, it's great to be able to copy a command from the web browser into a term window. I do have CLI only Ubuntu installations but I administer by SSHing into the box and administering it from the GUI on another PC.

And WRT your suggestion to keep a cheat sheet of common commands, I do that as well. I keep them in a text file so I can cut and paste them into a terminal window.

Of course this can all be done using something like PuTTY from a Windows PC but is slightly more convenient on the system console using X copy/paste. (Highlight text and paste with or middle mouse button.)

Re:Easy.

[drosboro]

Good points - I was thinking along the lines of a VPS where there's no physical access to the console (since that what I generally use for projects like this). I generally keep two to four SSH sessions running, along with my web browser and whatever other software I'd like on the client side (usually a text editor for keeping my cheat-sheet), so I do use a GUI - just not on the server itself.

If you were actually working on the server itself, it would make a lot of sense to have a GUI for exactly the reasons you suggest.

Re:Easy.

[smpoole7]

I'm surprised that no one here has suggested Suse/OpenSUSE yet. It's extremely easy to install and set up, with a LAMP stack, ready to go off the disk. I realize that there are some philosophical reasons amongst the free software community against Suse, but I've never cared about those, just to be frank. And once you do get familiar with the CLI, Suse has an advantage that I haven't found in any other major distro: I can go in remotely with SSH and use the CLI Yast program. which uses an NCurses interface that duplicates the GUI version of Yast. Everything's in the same place. This is absolutely wonderful. :)

I've used Ubuntu, and the last thing I want to do is start a flame war. Ubuntu LTS is extremely stable and yes, the online support is excellent. However ... it is almost entirely CLI for administration (unless you install Webmin/Virtualmin, as someone else here suggested), and if you go into the Ubuntu forums with a problem, the help provided will almost certainly be CLI. Also, speaking from experience, if it's a really puzzling problem, you'll get two or three conflicting suggestions. (Again, speaking from experience.)

Remember, the original poster's experience is entirely with Microsoft-style stuff. That's where I was a decade ago, I can still remember how difficult it was to transition to Linux. Mandrake (now Mandriva) made my switch a breeze, even though others were screaming at me to use Red Hat or Debian (both of which I tried, and both of which almost soured me to Linux entirely). When you recommend something to the OP, keep that in mind. What's easy for YOU (going into /etc and editing a file, for example) might completely baffle him or her. Now add in the fact that most error reporting under Linux is via the log files, instead of pop-up screens.

Re:Easy.

[http]

Pay no attention to the troll, it lies. I notice you said this was personal, as in, not a non-profit. Anyways, non-profits have no lesser need of stability.
Debian's testing branch is something that they are, well, testing. As in, they're not sure it works. One offhand combination of installing scheme9 and apache-mod-lisp could bring things to a grinding halt. If anyone other than yourself is expecting it to be available in the morning, use debian stable. Heck, if you'd like it to be available in the morning without being up part of the night, use debian stable.

As for the CLI, I've got news you might think bad, but it's not. Administering a LAMP stack without basic familiarity with a shell is like using a web browser without knowing what a scrollbar is - you may be able to do stuff, but not a lot, and not well. The tools that debian includes are command line oriented (as in, no webmin) because point-and-click interfaces require pointing and clicking, and are truly resistant to automation. Automation makes life easier, freeing up time better spent with wine and women (and/or moonshine and men, depending).

The good news is, shells are not terribly difficult to learn the basics of, though it is possible to go into very intricate depth. If you settle on bash, I recommend visiting http://mywiki.wooledge.org/BashFAQ once in a while.

Re:Easy.

[oakgrove]

For historical reasons, it is generally better to go with unstable rather than testing due to the way packages are merged. From the Debian FAQ:

3.1.5 Could you tell me whether to install testing or unstable?

This is a rather subjective issue. There is no perfect answer but only a "wise guess" could be made while deciding between unstable and testing. My personal order of preference is Stable, Unstable and Testing. The issue is like this:

Stable is rock solid. It does not break.

Testing breaks less often than Unstable. But when it breaks, it takes a long time for things to get rectified. Sometimes this could be days and it could be months at times.

Unstable changes a lot, and it can break at any point. However, fixes get rectified in many occasions in a couple of days and it always has the latest releases of software packaged for Debian.

But there are times when tracking testing would be beneficial as opposed to unstable. The author such situation due to the gcc transition from gcc3 to gcc4. He was trying to install the labplot package on a machine tracking unstable and it could not be installed in unstable as some of its dependencies have undergone gcc4 transition and some have not. But the package in testing was installable on a testing machine as the gcc4 transitioned packages had not "trickled down" to testing.

Re:Easy.

[afabbro]

I'm surprised that no one here has suggested Suse/OpenSUSE yet.

SuSE is still around?

Re:Easy.

[Dr_Barnowl]

When you don't have the GUI...

byobu is a nice alternative. It's a wrapper on `screen`, but it gives you shortcut keys to rapidly switch between terminals and create new ones (amongst other things).

It doesn't carry all the weight of setting up a whole bunch of client libraries on the server and an X server on the client.

Re:Easy.

[webmistressrachel]

Quit trolling and learn.

If you're running a mission-critical server, the less code you have in the kernal the less chance you have of buggy code affecting you, and the smaller the attack surface which will leave you vulnerable to attacks.

Windows uses the same kernel for both desktop and servers, but optimises for neither, as the UK government learned the hard way when they lost their Child Benefit database (>3 million direct identy thefts).

Re:Easy.

[Lanteran]

But the performance would be less because it's not at the kernel level, and even if not, are you seriously thinking of running windows on a server? That's got to be one of the worst ideas I've ever heard. Even 70% of the suits know that linux is better for the server.

Re:Easy.

[Sepultura]

I run a few sites with equal or slightly larger audiences as the questioner. My servers are evenly split between Ubuntu server and Debian. A few things to note:

1. Don't be afraid to go headless and learn the bit of shell commands you'll need to know. You'll need them at some point anyway. Besides, most web-based packages you'll be using these days can be administered with either a web-based interface or an administration app. eg. For administering sql servers I use Sequel Pro on my Mac and connect over an ssh connection. Also definitely look into installing Webmin http://www.webmin.com/ - it definitely eases admin responsibilities.

2. Debian-based distros are all easy to find help for. As the parent mentioned Ubuntu has some of the best support out there, but even if you choose Debian 99% of what you'll find on Ubuntu-specific forums will apply. LTS Ubuntu server is rock-solid, easily as stable IME as Debian. And although my desktop systems have switched to Deb lately due to the recent odd GUI-related decisions of Canonical, these issues haven't spread to the base distro.

3. Administering any system is a learning process. If someone tells you that it's problem-free if you use X and Y they're lying. Expect a bit of a learning curve.

Re:Easy.

[somersault]

In your terminal window, you could use control-r to search through your history of commands (start typing part of the command and the terminal will find it for you - keep pressing control-r to go back through more results). I find this a lot more convenient than pressing up repeatedly or typing out the same commands all the time :)

Re:Easy.

[HiThere]

SUSE has, essentially, not been heard of since it was split off Novell. I don't know what the status of that distribution is. At one point I would have declined to recommend it for the same reason I wouldn't recommend Mandrake: Too much pixie dust in the administration. I don't, however, know it's current status.

Yes, GUIs are quite useful. I'm NOT a neophyte, and I practically always use a GUI. But I like to be able to understand what's happening underneath. So the CLI commands need to continue to work, and changes shouldn't happen without my asking them to. SUSE and Mandrake BOTH violated this. The only distro I'm current with is Debian, but I would have no hesitation in recommending Debian stable for someone getting started. (That wasn't the case a few years ago, but it is now.) If you want to play flash or DVDs or something, you'll probably need to add things from non-free that I've avoided, so I can't really talk about the support there.

Re:Easy.

[Deltaspectre]

keep pressing control-r to go back through more results

You learn something new every day! I've always been frustrated by ctrl-R only hitting up the most recent, but didn't know where exactly to look for more information.

Re:Easy.

[gfody]

Okay let's learn: Windows is a Microkernel and Linux is a Monolithic kernel - fundamentally different approaches to OS architecture. Which one do you think has less code in the kernel and therefor less chance of bugs and vulnerabilities?

Re:Easy.

[thetoadwarrior]

You still have to edit conf files for your sites and other CLI taks which he seems to want to avoid. I think that is nearly impossible but likewise I see no reason to be scare of the CLI. Setting up apache and PHP is dead easy even with having to use the CLI.

Re:Easy.

[Mathinker]

> OK, let's learn

Learn what? To read?

You obviously didn't read your own references, or you would see immediately that all versions of MS Windows up to including Windows 7 aren't microkernels. Miss the part where

Traditional operating system functions, such as device drivers, protocol stacks and file systems, are removed from the microkernel to run in user space

> Which one do you think has less code in the kernel and therefor less chance of bugs and vulnerabilities?

I wouldn't know, not having access to the source code for Windows. And you know what? Given how well you're batting with classifying OSs as microkernels or monolithic kernels, I'm pretty sure you don't have (legal) access to the source code for Windows either, and you're just spitting out recycled factoids you've heard from other sources.

Re:Easy.

[Lisias]

I second you about YAST.

The YAST is the main and almost sole reason I'm using OpenSUSE for almost a year now, without major issues (but there is some issues, be aware - not serious one if you can find your way on CLI when needed).

When I contracted some VPS for personal and professional reasons, I gone through some real pain to put OpenSUSE on them (as the provider do not support it) just for YAST.

Be advised that, at least for the Apache2 module, YAST has issues with vhosts configuring. It sometimes combine your vhost individual conf files into one big one (ip-based-something, I don't remember now). Everything still works fines, but this is annoying.

I keep versioned backups of all my configuration anyway, so this is not a serious issue. (using or not YAST, I strongly recommend you keep versioned backups of your configuration files. Use CVS if you want, but use something. It really worths the pain)

OpenSUSE has its merits on this own. I was advised that it is one of the best developer oriented distributions around (what leaded to me to choose it over Ubuntu). But as a no-more main stream distro, sometimes I feel some packages are released too early.

I depicts the framebuffered console (besides being cute), I would really proffered a text mode console as in Debian - this is annoying when setting up a VPS, but does not matter too much after you setup your SSH.

If you use a NVIDIA videocard and likes GNOME (as me), your live will be miserable. The OS drivers for NVIDIA does not support Hibernate, and the proprietary Nvidia driver has serious issues on Gnome. I would rather recommend an ATI video card if you can choose your box 's videocard.

(What I cannot do, since I'm using a notebook and so I'm stuck with NVIDIA. At least, until I can replace the notebook with one using ATI drivers or, what would be cheaper for me, the Nvidia resolves the Gnome issues - as you can see, I do not plan to wave out YAST).

On the botton line, I'm not 100% happy with OpenSUSE (because the NVIDIA issue), but YAST is good to the point I'm considering replace the hardware.

Re:Easy.

[ArsenneLupin]

And you, go learn about trolling.

Hint: don't feed the trolls...

Re:Easy.

[ArsenneLupin]

Okay let's learn: Windows is a Microkernel and Linux is a Monolithic kernel - fundamentally different approaches to OS architecture.

Pigs can fly and cows are ruminants - fundamentally different animals. Which one do you think is more difficult to catch, and thus less chance of making you as fat as a whale?

Re:Easy.

[somersault]

It's an emulation of an emacs feature - bash works with a few emacs bindings, but that one is the handiest. Ctrl-s to search forwards if you overshoot, ctrl-g to cancel :)

Re:Easy.

[Pieroxy]

You know, if the guy (poster) has only worked with Windows systems in the past, I'd go the last mile and let him get a WAMP install instead of LAMP. It's probably a bad idea to get in the Linux bandwagon while deploying a production server for 2500 users.

Re:Easy.

[bhcompy]

Thank you for the indepth information. The computer I will be using as a server does have an ATi card in it, so this is definitely something to look in to.

Re:Easy.

[nzac]

SUSE has, essentially, not been heard of since it was split off Novell. I don't know what the status of that distribution is.

Try opensuse.org they are still very much alive they had a conference and have contributed their package management to Meego. I don’t think they are having any funding issues.

Re:Easy.

[bhcompy]

My problem is that I don't want to spend any more money on it than I have to, plus I get to expand my knowledge in the process. It's a "production" server, but it's not commercial/business related and there is no cash at risk.

Re:Easy.

[bhcompy]

The reasoning for MySQL is based solely on the path of least resistance for some of the database integrated software I'm going to be using. I don't want to spend time converting from one dialect to another. Perhaps in the future if I find MySQL inadequate, but not currently.

Re:Easy.

[i_ate_god]

Once you've solved some problems through the CLI by looking at forum posts, you will realize how amazing the cli is.

Re:Easy.

[danomac]

I rarely physically visit the machine. Using a remote ssh client on a machine that already has a gui/web browser makes far more sense, especially considering the amount of users this machine will service - having the least amount of stuff running on the server is better for resources.

There's quite a bit of information on the internet for administering an Ubuntu system, or at least I've not had problems finding it with Google. (I remote admin Ubuntu via ssh for family/friends, I don't actually use it myself.)

Re:Easy.

[smpoole7]

> SuSE is still around?

On the assumption that you're serious, try www.opensuse.org.

I personally think that their support forum is the best, by the way -- and I'm including Ubuntu in that comparison. By far.

And by the way, for the original poster: Swerdna has a complete walkthrough on setting up LAMP for OpenSuSE here:

http://www.swerdna.net.au/linux.html

And of course, Falko has some great stuff over at How-To Forge as well: www.howtoforge.com

Re:Easy.

[SirSpammenot]

I 3rd the vote for YaST! THE easiest way to transition from windows to Linux is through a menu driven configuration utility, and YaST runs in ncurses too so you can run your server without loading a GUI (and it's security issues). That aside, don't deploy to 2500 users an unfamiliar tech you can't fix...

Re:Easy.

[quantumphaze]

I keep versioned backups of all my configuration anyway, so this is not a serious issue. (using or not YAST, I strongly recommend you keep versioned backups of your configuration files. Use CVS if you want, but use something. It really worths the pain)

Have a look at etckeeper.

etckeeper is a collection of tools to let /etc be stored in a git, mercurial, darcs, or bzr repository. It hooks into apt (and other package managers including yum and pacman-g2) to automatically commit changes made to /etc during package upgrades. It tracks file metadata that revison control systems do not normally support, but that is important for /etc, such as the permissions of /etc/shadow. It's quite modular and configurable, while also being simple to use if you understand the basics of working with revision control.

Re:Easy.

[WorBlux]

It is the same kernel, just compiled with different options. Some of the things like disk schedulers (CFQ, Deadline, no-op) can be switched according to boot options, but other things like preemption (none, voluntary, and yes) can't be. In fact being able to reach into the code lets you be a lot more flexible with a smaller binary. Timer ticks are another thing that I believe needs to be compiled in. High numbers 300 or 1000 are better for real-time applications (music and video) whereas a smaller number of ticks increase throughput by decreasing interruptions for scheduler decisions.

Re:Easy.

[WorBlux]

No, windows is not a micro kernel, it's just not entirely monolithic. The outward facing API's run in their own address space and interface with the kernel via some unpublished interface. Still most of the heavy lifting is done in a continuous memory in kernel space. There are certainly differences, but nothing that crazy.

Re:Easy.

[xenobyte]

Mandrake (now Mandriva) made my switch a breeze, even though others were screaming at me to use Red Hat or Debian (both of which I tried, and both of which almost soured me to Linux entirely).

I started out using Mandrake but quickly tired of the Red Hat family. The thing that really killed it for me was an update where the RPM's couldn't be installed because the RPM program needed an update. Okay, so I grabbed the new version of that, only to find out that it too required the new version to unpack. I had to install a new machine on some additional hardware and copy the binary RPM-manager over to do the upgrade. So incredibly stupid.

I then switched to Debian (potato-distribution was current back then) and never looked back since. Only issue with the distribution was the switch between woody and sarge where the sarge distribution was so crappy that an upgrade to what basically was a server with 100+ LAMP-sites resulted in hours of cleanup because tons of stuff was either removed and not re-installed, installed in incorrect configurations or simply left half-un-installed. Also most configured configurations was overwritten with defaults.

When etch came around I upgraded another similar server from woody to etch in one jump with zero issues. I've even had a customer upgrading directly from woody to squeeze (skipping sarge, etch and lenny) without any problems. Impressive.

I'd unconditionally recommend Debian - or its 'bastard child' ubuntu... ;) They both share the same superior package system.

Re:Easy.

[Machtyn]

They've even got ready to use virtual machines for download. Does anyone have any experience with these?

Re:Easy.

[RoboJ1M]

Or eBox (now called Zentyal). This is based off of Ubuntu (10.04 currently) and is designed to fill the same niche as Windows Small Business Server
Zentyal
Zentyal HTTP Publication module doco
J.

Re:Easy.

[Xacid]

Seconded here. I actually took a linux class last semester just to get some formal training and they were still using an old version of Novell's SUSE that couldn't be updated without going through a pile of hoops so I asked if could be guinea pig and gave OpenSUSE a try to see if it'd be compatible with the material. Worked out just fine if not better.

I started off with Linxu on Mandrake a while back too, go figure. :) Then went to Ubuntu and Mint for a bit which aren't bad, but so far OpenSUSE has been my personal fave. And this is coming from a guy who's primarily doing Windows support and runs Windows at home. If I was to ever switch formally I'd most likely go the OpenSUSE route. /advertisement

As for other suggestions - I'd definitely recommend taking a course at your local community college if you can find such. That did wonders for my understanding of how the system is put together and how to wrap my head around navigating and operating within command line.

Now as for LAMP I've never really don't much with that other than some minor tinkering. Definitely sounds like the way to go though.

Re:Easy.

[webheaded]

Also Webmin/Virtualmin are VERY easy to install on Ubuntu. They are one of the distros on the support list and it couldn't be easier to do it. I specifically used Ubuntu Server over Arch Linux because of this simple fact. I just didn't want to have to dick it with it too much.

If the OP is that new with a CLI, then he will definitely appreciate Webmin. Hell, I'm quite familiar with it as well as the Apache and PHP config files, but I'll be damned if I'm go back and edit THAT clusterfuck when I have webmin. :p

Re:Easy.

[crutchy]

I use testing on a production server. Never had any problems. Those who complian have too much of the new shit installed. If you're running a production server without the shit, testing isn't that much different to stable.

Re:Easy.

[crutchy]

i dunno about postgre but the only hiccup that i've had with mysql was getting it to work with data files on a nas. otherwise it works pretty sweet for my (low traffic) server. keep op's situation in perspective

Re:Easy.

[http]

It's a shame there's no online equivalent of a snort of derision. You're a fool to think the differences trivial, and I wouldn't trust any of my data to you. If you have a boss, the organization would be better off with you fired.

That you have not had problems so far is not debian's fault, or yours.

Or do you read and subscribe to every one of the 2500-odd release-critical bugs and determine that they don't apply to software you have installed? I'm trying to imagine such an unhappy life, and eeeeww. If this is your life, I'm sorry.

Re:Easy.

[crutchy]

provoking trolls can be as much fun as trolling itself :)

Wow

[asto21]

You sure have a lot of friends!

Try Virtualmin

[fatgreek]

I suggest Virtualmin on top of Ubuntu. Its easy to configure and setup and maintain.

http://www.virtualmin.com

Re:Try Virtualmin

[gshegosh]

I second this. Installing latest Ubuntu Server LTS and then copy-pasting one single command to download and run Virtualmin setup is a no-brainer. And it will take care of all hosting needs (DNS, e-mail, LAMP stack and MUCH more) with a simple web-based GUI. It is also free, although if you try it out, you'll most probably feel the need to donate/buy "pro" version.

Re:Try Virtualmin

[bhcompy]

Thank you, I'll check it out

Re:Try Virtualmin

[dasherjan]

Ubuntu is a great way to go. The community is very newbie friendly.

Re:Try Virtualmin

[wolgamot]

I agree with Virtualmin GPL or Virtualmin Pro.
Fantastic community support as well as professional support from the Developers.
I started on Webmin years ago. It was so helpful I finally bought Virtualmin Pro 50 server license.

I use the latest Ubuntu 11.04 as my daily system however on a server I use Centos because of it's Long Term Support (LTS).

Ubuntu 10.04 (LTS) is a rock solid server as well.

I just prefer Centos and Scientific Linux because they are based on Redhat Enterprise binaries and I grew up on Redhat so it is just easier for me.

INSTALL a Linux DESKTOP install.
Don't do the server install because the Virtualmin install.sh script downloads, installs and configures everything using the Virtualmin repositories.

You can do it with a minimal install that gives you only a shell to start but I like to start with a minimal Desktop install for convenience.

Go to http://www.webmin.com/vinstall.html and download the install.sh script.
bring up the shell terminal and execute the 2 commands they give on the above page
I just tested it yesterday on the new Centos6 and it did the setup flawlessly.

After it completes the install you'll be able to examine how they setup everything in the server.

You may want to test it on Scientific Linux as it is based on Redhat Enterprise.
http://www.scientificlinux.org/

I use ubuntu 11.04 on my desktop but I use Centos5.3 on my servers and am now in the process of upgrading to Scientific Linux6 which in essence is Centos6 or Redhat Enterprise6

There is a debate about Centos kind of dragging their feet and many are switching to Scientific Linux since it is looking to be aggressively maintained.

Read this post.
http://www.virtualmin.com/node/17463#comment-80722
For some reason the post link in the drupal forums would not link to the one I wanted however if you search the above link thread for Posted: Wed, 2011-05-04 14:51
and read from there, it may cause you to try scientific Linux.

You have to be root for the script to install the system. Centos already has the Root user enabled.

In Ubuntu, you'll need to temporarily enable the root user, then disable it after Virtualmin installs.

I suggest Centos6 for your first test because I know the install.sh script worked OK on it. I'll assume it will work in Scientific Linux since the binaries are the same as Centos or Redhat Enterprise.

I think, Joe at Virtualmin mentioned they are going to switch from Centos to Scientific Linux for their servers.

http://www.virtualmin.com/os-support

Virtualmin GPL Supported Systems
The automated installation script supports the following operating systems:

CentOS 5 and 6 on i386 and x86_64
RHEL 5 and 6 on i386 and x86_64
Scientific Linux 6 on i386 and x86_64
Debian 5.0 and 6.0 on i386 and amd64
Ubuntu 8.04 LTS and 10.04 LTS on i386 and amd64

All Virtualmin GPL supported systems are considered "Grade A" and provide an excellent platform for virtual hosting

* * * *

Here is a little background to try and convince you to give Virtualmin a try.

You're in for a wild ride being new to LAMP servers. Running a Linux server is an addictive experience. A blessing and a curse ;-)

In 2002 on Redhat 7.3. I hired a friend, Lee Bertagnolli, to help me get my first server going. He setup the server manually.

I couldn't follow all he did at the time. I was an ultra Linux noob at the time.

I made a Ghost backup of the drive in case I messed it up so I could restore and be up and running again.

What really sped up my learning was the discovery of Webmin.

Fedora or RHEL/CentOS

[Karrde712]

There's a nice article here on setting up the LAMP stack on Fedora (or its relatives, Red Hat Enterprise Linux and CentOS):

http://fedorasolved.org/server-solutions/lamp-stack

Re:Fedora or RHEL/CentOS

[bahstid]

Don't have much to compare it with, but its easy on Fedora.... only commandline you need at least as far as LAMP goes is setting up your mysql root password. Although Ubuntu has historically been the noob-friendly version, changes with the latest version has been chasing a lot of people away. That said I'm a KDE user anyway, so don't know if the Gnome changes have affected Fedora too.

On any modern Linux, think LAMP is going to be pretty much part of the install process anyway... the part that might frustrate is getting your head around firewalls and permissions, but that doesn't necessarily involve commandline either. The Red Hat family has a good server reputation and you could pick up a bit of a marketable skill while you're at it...

Re:Fedora or RHEL/CentOS

[jroysdon]

I'm a long-time RedHat distro family user (since '99 with Red Hat Linux 5.2).

For the non-technical, I would not recommend Fedora. Fedora installs systems go End of Life (EOL) every 13 months, and that's if you install right after a release. Current supported Fedora 14 will EOL ~Dec, 2011. Latest Fedora 15 release will EOL ~June, 2012. Fine for a desktop user who likes to do fresh installs once or twice a year and play with the latest thing. Not wise for a server install (unless you want to reinstall every year and troubleshoot breakage/incompatibilities each time).

RHEL self-support Server is $349/year, but you want this so you get all the security updates in a timely fashion (hours, worst case within the day). I would recommend this method. Ask folks to chip in $5/year. Most won't, some will (you just need 70), bank the extra for the next year subscription renewal. The advantage is that if you install RHEL6 now, you're good on support until at least 2016 with support.

The free version of RHEL, CentOS, is constantly out of date with Security updates. The team works for free, but it's a closed development process ("" CentOS is a Community distribution for download and install, not community for development processes). I would not recommend CentOS to anyone who can't manually chase down security fixes.

Frankly, assuming you're on a free-lunch budget, I would find a LTS version of Ubuntu or something where you can install it and follow some best-practice hardening guides and basically forget it for 5 years. I'm tempted to go that direction as well for my personal stuff, but as I maintain RHEL at work, not sure I want to have to learn/maintain two different knowledge sets of "how to do things."

turnkeylinux

[Anonymous Coward]

LAMP Stack
www.turnkeylinux.org
Turnkey provide many popular stacks, dev environments etc on pre-configured virtual machines. Can be run from sny host linux/windows.

Highly recommended

Re:turnkeylinux

[JeffSh]

I came here to recommend turnkey linux also. They have a PHPBB turnkey linux, and their backup solution to Amazon S3 ROCKS. So cheap to keep a backup.

Re:turnkeylinux

[bananaquackmoo]

+1 recommendation for Turnkey Linux. So far it has been the only distro I've been able to successfully setup as a webserver since I don't know Linux very well. Easy to setup and easy to contain in a virtual-machine, if that's your kind of thing.

Re:turnkeylinux

[bhcompy]

Interesting, thank you. I'll check it out

Sorry, but go with what you know

[dbIII]

For a completely unknown platform I'd suggest mucking about with a very small project with just yourself as a user or maybe a couple of others that don't care if it's down or broken. Once you know your way around you can then move on to something else.
Making stupid mistakes in front of an audience of 2500 users would be embarrassing no matter how trivial the subject matter of the site is. You are better off making the stupid newbie mistakes where only you can see them. Having test and production environments only go so far if there is nobody in the project that really knows what you are testing for - if you don't know what you are doing your stupid stuff will go live.

Re:Sorry, but go with what you know

[wvmarle]

I was thinking in those lines too. Why go for Linux when you have experience with Windows? And why doing your first-ever Linux deployment for a 2,500 user set-up?

The answer for the first is probably either cost or philosophy. But still I'd start much smaller when talking about a totally unknown system.

Re:Sorry, but go with what you know

[Anonymous Coward]

By far the best platform for Newbies is... brace yourselves...: Gentoo!

Yes that's the opposite of what others suggest. But that's the point.
All those dumbed-down OSes only make it harder to actually understand the whats and whys. Which works nicely as long as everything works and you don't have to leave the golden padded cell. But if there is even the slightest problem, for which there isn't a switch in that room, you're fucked. Which will happen at all the worst times. And on top, you will not even know what you could do, thereby severely limiting your abilities and freedoms.

With Gentoo, you will learn what you need to know right while installing the system. Which is a fun project for every geek. And then, there is no such thing as a problem you can't solve on your own. After that, you can still move on to other distributions.
It's like you should not use a scientific calculator if you haven't learned how to do it without one first. Except that in this case the "scientific calculator" is the most complex tool on the planet any normal human has access to. So it's shocking that people suggest to avoid understanding it.

And the best thing is, that learning it is not hard at all. If you know how the system starts, from the BIOS over the bootloader, kernel, init and X to the desktop environment... If you know how to get, read and understand log files... If you know the file system structure, including device nodes and a couple of simple tools... And if you know how to edit config (text) files, using the man pages and other help... Then you're good!
That isn't hard. You only need to learn things when you actually need them anyway.
A bit of bash scripting, shortcut assigning / cron and udev triggering, etc, and life already become a lot easier than with any dumbed-down OS where you never have gotten anywhere.

So do yourself a favor, and allow yourself to learn, instead of intentionally assuming you're dumb, and then making sure you fulfill your own prophecy. Take that from someone who only realized this about himself after a decade of running away, and now thinks that the only way he was dumb, was assuming he was dumb.

Re:Sorry, but go with what you know

[JonJ]

http://funroll-loops.info/

Re:Sorry, but go with what you know

[mrmeval]

You can go with what you know but also leave yourself room to do a drop in replacement of a Linux stack when needed. The only reason I can see in not using what you know is excessive cost. If you cannot recoup those costs and cannot afford them then you can use a Linux solution. I would however point to a corporate Linux solution such as RHEL and only use what they recommend.

Re:Sorry, but go with what you know

[aztracker1]

It has to be philosophy, Windows Server Web Edition is pretty reasonably priced. I run about half linux, half windows on my own server(s), Linux host OS with VMs. I would say it depends on one's needs. Though, not fond of PHP in general.

Re:Sorry, but go with what you know

[catmistake]

I was thinking in those lines too. Why go for Linux when you have experience with Windows? And why doing your first-ever Linux deployment for a 2,500 user set-up?

True that Windows may get him where he's going faster, as linux installs with only one or two users by default. Well, Windows has a similar default, but an hour later on a web facing machine, he may just have his 2500 users. :P

Re:Sorry, but go with what you know

[znerk]

While I see your point as to learning the ins-and-outs of your server and configuring it to be as efficient as is humanly possible, I find myself disagreeing with your post on a fundamental level.

While your method will probably produce a much leaner system, with slightly higher performance-per-clock-cycle, you are suggesting a system that requires a huge amount of "free time" to learn, and a willingness to dive head first into a tar pit of new knowledge. If you have a year or so to beat your head against a thousand brick walls while you climb a rather steep learning curve, then Gentoo is perfectly acceptable, and can (eventually) produce a leaner, cleaner server environment, tailored exactly to the task at hand.

If, on the other hand, you want your server to operate much like an appliance, then a simpler distribution (for example: something Debian-based that practically configures itself for you out of the box) can get you off the ground with enough knowledge to actually administer the thing, inside of a week... and throwing a multi-core CPU and a few gigs of ram at the hardware end of things is not only relatively inexpensive, but also pretty much nullifies Gentoo's "tuned performance" argument.

A cheap machine with enough power to be "good enough" (combined with a LAMP stack from any major distribution) will suffice, and doesn't require a masters in computer science to get running well enough to push a forum's backend.

* Note: I am assuming the user requesting the assistance is not familiar with Linux at all, thus increasing the potential learning curve steepness. Not everyone has been using *nix for 15 years, and not many people have the free time available to drop everything and immerse themselves in building a system from the ground up for several months of really intense self-education.

Re:Sorry, but go with what you know

[bhcompy]

No, it's not philosophy. It's cost. I'm not getting anything back from this other than experience

Re:Sorry, but go with what you know

[ladoga]

While your method will probably produce a much leaner system, with slightly higher performance-per-clock-cycle, you are suggesting a system that requires a huge amount of "free time" to learn, and a willingness to dive head first into a tar pit of new knowledge. If you have a year or so to beat your head against a thousand brick walls while you climb a rather steep learning curve, then Gentoo is perfectly acceptable, and can (eventually) produce a leaner, cleaner server environment, tailored exactly to the task at hand.

I think that OP meant just the opposite of what you are saying. He's not suggesting gentoo due to small performance gains that you might or might not get from using it. Instead the point of his post is that by exposing yourself to how your system works you learn faster and save time in the end.

I started with gentoo stage 1 install when I was complete newbie to Linux and I've never regretted it. With the help of their good documentation it took me a day or two. I quickly switched to Ubuntu - and then Debian - afterwards, but as for educative task, installing gentoo from ground up was really worth it and has saved me from countless of hours of "hitting my head into brick wall" when dealing with random issues later on. The simple fact is that during those few days I learned more of Linux than I would have learned from years using Ubuntu.

The point is entirely about exposure and quick learning, not about what distro to use for the actual task. After you have learned the basics you'll do fine with all or any of them.

Re:Sorry, but go with what you know

[znerk]

I see what you're saying, and I don't disagree that installing Gentoo from scratch may be the fastest method of learning a Unix-like OS... my point was that this is akin to learning how to launch a boat by flinging yourself into the ocean. Yes, you will likely learn to swim extremely quickly, or... not. I'm not a big fan of the "Portal" method of learning; "Here at Aperture Science, we believe that if at first you don't succeed, you fail."

Jumping into Gentoo would be an excellent method for acquiring a ton of information at a very rapid pace, but (to bring in the car analogy), I don't want to have to build a car if all I wanted to do in the first place was learn to drive.

What a lot of geeks are missing today is the little piece of information that many people don't actually care about *how* a computer works, any more than they care about how their refrigerator or toilet works. It causes problems when it doesn't, and they call someone to take care of it... other than that, they expect it to Just Work(tm). Computers are just another appliance to many (most?) users.

I don't mean to imply that the submitter feels that way, I merely wish to point out a potentially overlooked viewpoint.

Re:Sorry, but go with what you know

[gig]

If he wants an easy Unix, that is the Mac, duh. There is no reason to bring Windows into a discussion about Apache and PHP.

If you want Unix, then either do it the easy way with Apple or the hard way with everyone else. At least in both cases you will do it right.

Re:Sorry, but go with what you know

[AdamWill]

"A bit of bash scripting, shortcut assigning / cron and udev triggering, etc, and life already become a lot easier than with any dumbed-down OS where you never have gotten anywhere."

Until three years later when you realize something you duct taped together with bash scripts three years ago doesn't work any more and you haven't a fucking clue how to fix it.

I do get _tired_ of Gentoo ricers who convince themselves that hacking stuff together in ugly ways based on the mistaken assumption that building everything from source magically taught them how their operating system actually works is the highest form of achievement. That isn't how it works.

Re:Sorry, but go with what you know

[fuzzywig]

"Why go for Linux when you have experience with Windows?" So that the OP can get experience with Linux I'd guess, we all have to start somewhere.

As for sticking with what you know, that'd certainly be what I'd do if this was a commercial project, but as the OP goes out of their way to say they're doing it for friends I guess they don't mind a few early fails.

As for actual advice, I'm mainly a windows admin, but I can get along fine with Ubuntu, and there's plenty of documentation avaliable.

Ubuntu and Virtualmin

[watermark]

Ubuntu 10.04 server with Virtualmin installed. Makes managing one or more websites dead simple. It has one click install for phpBB through virtualmin, has php5.3, and MySQL 5.x. I use this config in a small commercial setting and it's been working well for years. My boss is a MS junkie, so it had to be easy if I was going to deploy a LAMP stack. Without webmin/virtualmin, I'm not sure we'd have any Linux servers...

CentOS

[firegate]

CentOS and RHEL have become the industry standard for LAMP setups, for whatever its worth. Given that you probably don't need a support contract, CentOS 6 would fit the bill nicely. A free control panel like Webmin would probably make your life a bit easier in the configuration department.

Re:CentOS

[thechemic]

I agree. I was asking myself the same question about LAMP stacks a couple years ago. I ended up choosing CentOS and Virtualmin/Webmin. It's been fairly painless to manage and it just runs forever.

Re:CentOS

[HTMLSpinnr]

Be very careful on how you expose Webmin though. It wields a lot of power - both for you and an attacker who discovers the open port and a weak password (or other exploit). Personally, if I were to use it at all, I'd only expose it on localhost, and require using SSH port forwarding to access it.

CentOS 6 is a good recommendation though if you have background with Red Hat, or want to pursue a future support career with a RHEL based environment. If not, Ubuntu is equally well supported.

Re:CentOS

[javanree]

Ubuntu is NOT a proper server OS, no matter how many fanboys may like it... get a proper enterprise distro (RHEL or clone, or SLES) or get Debian to be sure you get timely fixes. Ubuntu is an obvious example of how NOT to treat 'enterprise' users; just look at the tons of bug reports still open for 10.04 (which IS the latest LTS release) ; many of the the reports contain trivial fixes but they hardly ever get pushed. It may be a nice desktop OS but IMHO it has no place on a server.

Re:CentOS

[CRC'99]

Given that you probably don't need a support contract, CentOS 6 would fit the bill nicely.

Its been a long time since I've posted here on Slashdot - and I agree with the idea of your post - however I would not recommend ANYONE currently doing any new rollout to use CentOS. After just getting a heap of updates pushed through for CentOS 5.x that are mostly security and bugfixes that are mostly a few months old, I would highly recommend using Scientific Linux instead.

You can find more details on Scientific Linux on their site.

In a nutshell, its still RHEL (with a few minor changes), however updates seem to be delivered on time and with minimal delay. The project also doesn't seem to have the infighting that has infested the CentOS world.

Re:CentOS

[Machtyn]

After doing some research, this was what I came up with as well (not the person asking the question up top.)

CentOS? http://www.howtoforge.com/centos-5.1-server-lamp-email-dns-ftp-ispconfig

Of course, that howtoforge.com site has a bunch of different setups for different distros. They also have free to download virtual machine files. The whole thing is already setup for you to use... I suppose they have some script thing on initial boot that allows you to set the specifics of the server.

Thoughts? Anyone use this?

Re:CentOS

[webheaded]

This is a link to the Virtualmin Installer and it mentions CentOS is supported so that is definitely another possibility. Personally I went with Ubuntu due to how many people are using Ubuntu and the fact that it supported this installer, but CentOS is definitely another good choice.

Go mainstream: Ubuntu or RHEL

[Nemilar]

I'd suggest that you go with one of the mainstream/common Linux server distros: either RHEL (for which you can use CentOS, which is essentially the same, minus the RedHat-copyrighted bits) or Ubuntu Server.

Either of these can be configured to use a GUI. I'd actually pick RHEL/CentOS over Ubuntu, and during the install (which is graphical), you can select to install a web+database server along with a Desktop (GUI). The installation is fairly straightforward; the most complex part is arguably the partitioning, although you can use the guided partitioner to just use all free space on the disk. Partitioning isn't something that's linux-centric, although the partition scheme for Linux is perhaps a bit more complex than what'd you would expect coming from a Windows world (dedicated swap device, LVM to virtualize the partitions, etc..). If you use the guided "do it for me" option, you can avoid getting your hands wet with this complexity.

The primary reason I'd suggest going mainstream is that the support will be there. If you choose some OS that no one really uses, you'll be hard-pressed to find distro-centric documentation for it. If you go with Ubuntu or RedHat, you can use Google to get through any obstacles you may find. There are plenty of tutorials available when you google for a simple [do this task] on [this distribution]. For example:

http://www.google.com/search?gcx=w&ix=c1&sourceid=chrome&ie=UTF-8&q=install+phpbb+on+rhel
http://www.google.com/#sclient=psy-ab&hl=en&safe=off&site=&source=hp&q=install+phpbb+on+ubuntu+server

While you could probably use this documentation to complete a task on another distro, it's helpful to have a tutorial for the specific OS you're using; all the commands will be the same, and any dependency problems, etc... will all be accounted for.

Additionally, should you decide that you want to learn more and play around, having something mainstream installed means that your learning experience will be directly relevant to anything you want to do down the line.

As an alternative, you could go with a pre-built phpBB appliance. http://www.turnkeylinux.org/phpbb is a single ISO or VDK that is built on Ubuntu Server and comes pre-configured with phpBB (they have many other applications available as well - highly recommended!). It'll ask you a few questions during the install, and once complete, you'll boot up into a fully-functional Linux server with phpBB already running.

Re:Go mainstream: Ubuntu or RHEL

[sourcerror]

Well, Ubuntu Server doesn't come with a GUI, so I would suggest normal desktop Ubuntu and then download the servers from the Software Center that you need. Also, go with LTS.

Re:Go mainstream: Ubuntu or RHEL

[houstonbofh]

Well, Ubuntu Server doesn't come with a GUI

Yes it does. http://www.google.com/#q=ubuntu+server+gui Hell, when I started typing "Ubuntu Server" the suggestion on google was GUI... And you will want the server kernel, not the desktop kernel with a few thousand threads going on.

Re:Go mainstream: Ubuntu or RHEL

[sourcerror]

Well, by default Ubuntu server doesn't have GUI, but you can install one if you want to.
Also, what is the difference between a server and a desktop kernel (guess mainly scheduling and paging strategies), and how significant is it? (I have not much experience running Linux servers.)

Re:Go mainstream: Ubuntu or RHEL

[houstonbofh]

The server kernel can handle a lot more threads. That is handy on a busy web server.

Re:Go mainstream: Ubuntu or RHEL

[andrew3]

Good luck getting support from phpBB.com. They only support fresh installations from phpBB.com, mainly because Fantastico does such a bad job.

Really, it's not that hard to install PHP, MySQL and phpBB from scratch on a Linux Server. You learn a lot more that way as well.

Side project for some friends, eh?

[turkeyfeathers]

Is that you, Zuckerberg? I'm not setting up any systems for you without a firm contract.

Re:Side project for some friends, eh?

[fat_mike]

Yeah, like Zuckerberg and the OP actually have friends!

Re:Side project for some friends, eh?

[Provocateur]

Yeah, like Zuckerberg and the OP actually have friends!

Uh-oh, if I'm not mistaken, it was a line almost exactly like this that actually started Zuck on the road to billions...

Debian

[G3ckoG33k]

www.debian.org

The essential, and without any brown lipstick smeared all over.

Re:Debian

[marcosdumay]

+1

But he won't follow that advice, because he doesn't want to use a CLI, and altought all the stuff Ubuntu uses to avoid a CLI are available on Debian, they aren't installed by default. Or, in other words, because he doesn't want the essential, and wants brown lipstick smeared all over it.

I'd tell (hell, I'm already telling) that it is a mistake, and all those stuf he thinks will make his life easier will just stay there waiting for their turn to bite him, but as a good newby, he won't listen. So, the best advice is to get Ubuntu, so he can upgrade to some stable thing later, and avoid CentOS because altought it is way more stable than Ubuntu, the upgrade option is missing.

CentOS or Debian(Ubuntu)

[opportunityisnowhere]

These are arguably the best options for beginners. Both have great communities and any issue you have you can typically find a solution on Google in 5 minutes. Ubuntu even has a LAMP package that will setup everything(well, most everything) you need. Couple pointers: Disable root login via SSH as soon as possible. You're asking for a bruteforce attack if you leave that enabled. Set up something like fail2ban or OSSEC monitoring to help thwart bots that are trying to break into your server.

Re:CentOS or Debian(Ubuntu)

[houstonbofh]

Disable root login via SSH as soon as possible.

Already done on Ubuntu. There is no "root" account on Debian based systems unless you go to some trouble to make one.

But good pointer on fail2ban. Good thing to have.

Re:CentOS or Debian(Ubuntu)

[hjf]

Disable root login via SSH as soon as possible.

How is this any safe than having a normal user be able to "su" anyway?

How is it any safer than having root access with only certificates and no keyboard-interactive?

Disabling SSH root acess is as stupid as blocking ICMP for "security". Man, all those ICMP-blocking fags are in for a surprise with IPv6...

Re:CentOS or Debian(Ubuntu)

[oakgrove]

I'm shooting entirely from the hip here but I'm guessing that if you allow logins via root, the crackers already have at least one half of your username/password combo whereas if you disable it, they have to guess them both.

Re:CentOS or Debian(Ubuntu)

[opportunityisnowhere]

So two things with bruteforcing, you need to know a valid user and you need to get their password. If you leave root enabled, you just gave away half of that puzzle, and unless you have some sort of monitoring to smack down bruteforcers you can expect your server to get hacked eventually. It's safer just having su priv's in my account because someone has to guess my actual account name to get access. On that note, it's good to avoid using common names, just check the sshd logs on any public facing SSH server, brute force attempts happen 24/7. Cert/no keyboard is okay, but leaving root enabled with a password is dumb.

Re:CentOS or Debian(Ubuntu)

[opportunityisnowhere]

I've only used OSSEC which I can configure to permanently ban any brute force attempts. By default it just puts a temporary ban which is better than nothing.

Re:CentOS or Debian(Ubuntu)

[bsDaemon]

It's not so much that it is "safer", per se. Forcing users to login as themselves and then use sudo allows you to restrict access to groups based on roles, as well as leaving an audit trail that allows for greater accountability. If everyone can go all willie-nilly around acting as root, then you're screwed when no one owns up to fucking something up. Of course, this also means needing to disable 'sudo su' for all but the lead admin or a couple of other seniors for the policy to be really enforced. However, it doesn't sound like this guy needs to do all of that, and in fact would probably take a while to figure out how to configure his sudoers file properly, since apparently he has no experience with Unix or Linux systems.

As to his question though, I really like RHEL and am using it a lot at work these days. I used to work at a web hosting company that ran on CentOS, and its ok, but they've really dropped the ball with the 6.x series. I have one CentOS 6 server at work running PostgreSQL and MongoDB for some projects, and the core system packages don't get updated when the RHEL systems do. Additionally, you'll want EPEL and RPMFusion added to your Yum repos to get most of the "good" stuff that gets left out of core packages, like tmux, which whips screen's ass so hard it isn't even funny. After so many years using Free/Open BSD and Red Hat (well before RHEL), I honestly can't stand Ubuntu server. It is completely counter-intuitive for me. If you don't have anything to unlearn, it's probably ok, and not needing to add additional repositories would be a bonus.

It really sounds like he should just buy some cheap shared hosting that has something like cPanel and automated software installers and skip all of this, unless he's really, really interested in learning and taking the time to do it right.

Re:CentOS or Debian(Ubuntu)

[a_nonamiss]

Disable root login via SSH as soon as possible

Serious question: Why is this routine advice demanded of all noob linux admins? If my root password is geka#r#t-epu6ramAthap_eke (that's not my password) people can feel free to brute force away. Perhaps in 300 trillion years, they might have a 50/50 shot at breaking it, but I won't lose sleep over that. Besides, there are a lot of perfectly valid reasons to log in as root. Off the top of my head, you can't escalate to root permissions using SCP, so right there's a fine reason to have a remote account with root permissions enabled. Running certain remote backup jobs often requires root permissions. I realize that these concerns have workarounds, but why turn a 1-step process of transferring a file into a 6 step process for no real gain in security?

Re:CentOS or Debian(Ubuntu)

[Oxford_Comma_Lover]

Disable root login via SSH as soon as possible

Serious question: Why is this routine advice demanded of all noob linux admins? If my root password is geka#r#t-epu6ramAthap_eke (that's not my password) people can feel free to brute force away. Perhaps in 300 trillion years, they might have a 50/50 shot at breaking it, but I won't lose sleep over that. Besides, there are a lot of perfectly valid reasons to log in as root. Off the top of my head, you can't escalate to root permissions using SCP, so right there's a fine reason to have a remote account with root permissions enabled. Running certain remote backup jobs often requires root permissions. I realize that these concerns have workarounds, but why turn a 1-step process of transferring a file into a 6 step process for no real gain in security?

Because there is also a gain in n00b-insurance.

If you are operating as root, it is a lot easier to screw up your entire system when you do something wrong. If you are operating where you have to run sudo, this keeps you from running commands you don't need root for as root. How many times are you changing directories, poking around in world or group-readable files, or otherwise doing things you don't need root for in the middle of a few commands you actually do need root for?

A classic example would be removing a file named -rf. n00b sees it, deletes it without using -- (perhaps because n00b doesn't know how to escape it), and realizes "Oh crap!"

If n00b was operating as root, n00b is screwed. If n00b was operating as a regular user, then the damage is usually smaller and is hopefully nonexistent.

Re:CentOS or Debian(Ubuntu)

[opportunityisnowhere]

The other comments pretty much say this, but here's the NSA's take:

"Direct root logins should be allowed only for emergency use. In normal situations, the administrator should access
the system via a unique unprivileged account, and use su or sudo to execute privileged commands. Discouraging
administrators from accessing the root account directly ensures an audit trail in organizations with multiple
administrators. Locking down the channels through which root can connect directly reduces opportunities for
password-guessing against the root account. ...

Root should also be prohibited from connecting via network protocols. See Section 3.5 for instructions on
preventing root from logging in via SSH."

http://www.nsa.gov/ia/_files/os/redhat/rhel5-guide-i731.pdf

Re:CentOS or Debian(Ubuntu)

[houstonbofh]

And if you go with the default, root is not really created. (OK it is, but it does not have a password)

Re:CentOS or Debian(Ubuntu)

[HiThere]

Debian definitely has a root account, and the last time I checked, so did Ubuntu. Ubuntu *does* want you to do everything through sudo, which to me seems LESS secure, but they do have a root account. All you need to do to "activate" it is to assign it a password. (Well, this was back around hoary hedgehog or whatever it was called.)

I used Ubuntu for awhile, but found it gave me no advantage that I was using over Debian. And I ended up going back to Debian over package availability. (Not a concern for most users, or even most developers.)

FWIW, I am appalled by Unity, but I don't like the Gnome3 desktop much either. I'll likely switch to something else...and I haven't yet chosen which "something". Those interfaces look like they were designed for mobile phones. Perhaps they are good in that area, but I'm primarily a desktop user.

Re:CentOS or Debian(Ubuntu)

[a_nonamiss]

That same document you quoted also recommends disabling SSH, X Windows, avahi, CUPS, DHCP, (client and server) NFS, DNS server, vsftp, apache, dovecot, samba, squid, and SNMP. I mean, sure, if you're protecting nuclear launch codes from the red Chinese, there really isn't an unreasonable security precaution you can take, but everything you disable limits the utility of your server. Every unjustifiable security precaution you implement wastes time you could be spending doing something useful. I completely understand there are instances where you need an audit trail, and this really is a good case for restricting root logins, but we're talking about a guy here who wants to set up a LAMP server at home. I doubt he needs an audit trail for privileged functions.

Read online tutorials, use strong passwords, disable services you aren't using, and make plenty of backups. You'll be fine.

Re:CentOS or Debian(Ubuntu)

[opportunityisnowhere]

I was simply giving you an answer as to why it's recommended, it's not something that just "noob linux admins" do. I recommend it to anyone because most people new to sysadmin aren't aware that their server will start to get bruteforced as soon as it's setup, and most people aren't going to make their password a random string with 25 characters.

Also, nice job making fun of the document for recommending disabling services you don't need, then saying "disable services you aren't using". If you don't need something, disabling not only removes potential security threats, it provides additional resources for the utilities you actually need.

Re:CentOS or Debian(Ubuntu)

[reiisi]

That, and being able to set it up so ordinary users can do small maintenance-type tasks, but can't (easily) do things like "sudo sh".

Re:CentOS or Debian(Ubuntu)

[m50d]

How is this any safe than having a normal user be able to "su" anyway?

It means you need a username to attack, which means the mindless robot scripts won't break in. Seriously, look at the ssh logs of any internet-facing machine; you'll see two or three attempts per second to log in as root, all from thoroughly mindless automated attacks. So you might as well make sure there's zero chance of those succeeding (sure, they shouldn't threaten any remotely decent passphrase, but even so).

Re:CentOS or Debian(Ubuntu)

[a_nonamiss]

I concede most of your points, and I'm didn't mean to imply that the NSA document was in any way wrong. Those are the people who are literally charged with protecting nuclear and diplomatic secrets, and they deserve every bit of paranoia they show in that document. I guess it just rubs me the wrong way a little bit when we view good security practices as something that are either "off" or "on." I can remember when I started learning Linux, I was very intimidated by all the things you had to do to "properly" secure a box. I think that we, as admins, should acknowledge that there are different levels of security for different situations. If you're running a LAMP at home, and it's behind a NAT firewall with only port 80 forwarded, you really don't need to do much to secure it except keep your installation up to date. If you're new to Linux, it's a good idea to get in the habit of running as a non-privileged user. If we tell noobs that they need to adhere to NSA level standards, we're setting an impossibly high barrier to entry that will discourage lots of good folks from learning. We'll have them thinking "Meh... I'll just use Windows, that's much easier to secure."

At some point in their career, every new admin is going to do something stupid and make a mistake. Whether it's leaving some service open to attack or deleting a critical folder by accident, it's going to happen. I think it's far more important to know why we do things, and constantly evaluate them to make sure they still make sense. Best practices are good, but if we just follow them blindly without knowing the purpose behind them, we're turning off our brains and opening ourselves up to hackers who are constantly figuring ways around them.

Re:CentOS or Debian(Ubuntu)

[webheaded]

I'm pretty much just replying to your post so that I don't lose it later. Thanks for the fail2ban and OSSEC recommendations. I hadn't really thought about using anything like that but even my pitiful little server gets those break in attempts...not that there is anything particularly valuable on my server. Years ago I actually used the Ubuntu Server LAMP thing. It was definitely a nice easy choice...installed Webmin+Virtualmin and never looked back.

My first distro upgrade was a bitch though. I apparently waited too long and the version I was using was no longer LTE and I had to make many changes. Then the drivers for my virtual network card didn't work. Lol. I think that was like version 8.04 or something. I've been much more careful to pay attention to new Ubuntu versions after that and ensure I was always on whatever the current LTE was. :p

Learn the CLI

[pcjunky]

A simple Ubuntu or Debian 5 installation will fill the bill nicely. Webmin will take some of the sting out of having to learn the CLI. However any true IT professional should learn and use the CLI (Even newer MS servers can not be installed sans GUI). Once learned, it is quicker, simpler, more powerful way to do things than any other method I know.

Don't let the unfriendly reputation of NIX scare you away. I did 16 years ago when I started our ISP. Went entirely Windows NT servers. What a mistake! These things were constantly failing for various reasons. I began learning Linux and slowly replacing the failed servers with Linux systems and they just didn't fail unless some hardware failed (not nearly as frequent).

Life is much easer now and I spend very little time on server maintenance.

Re:Learn the CLI

[Anonymous Coward]

Debian 5 is outdated. Debian 6 ("Squeeze") is the new Stable.

Re:Learn the CLI

[Antique Geekmeister]

> Debian 5 is outdated. Debian 6 ("Squeeze") is the new Stable.

If only. It's often difficult if not impossible to run production services on it without reaching out to "testing" or "development" repositories which are poorly managed and integrated, discard old packages from their repositories so there is no reference, and change package names without warning. Coupled with the tendency of updates to be applied on top of locally edited configurations written by admins who ignore package management, and the resulting chaos is predictable.

I am _exhausted_ with Debian admins who insist on manually editing httpd.conf and xorg.conf and refuse to use the various configuration subdirectories, then act so surprised when their changes are lost or do not integrate well with new packages.

Re:Learn the CLI

[GuldKalle]

Yeah, this. If you are set on wanting the L in LAMP, you are doing yourself a disservice by not learning a bit of bash. Some config file changes are easier to do in a web interface or similar, but if you use a CLI for most of your admining, it is a lot easier on the whole to track what you did wrong, what you changed on the test server (please make a test server - a VM will probably do) since last update of your production server.
A CLI is also useful if you are AFK since most smartphones can run an SSH client.

Re:Learn the CLI

[gig]

The Command Line is irrelevant. The main tool you need for setting up a Web server is a UTF-8 text editor and some kind of file manager. Doesn't matter if it is BBEdit and Finder running in the lush Mac GUI. Whether you want to use the command line is just a completely separate issue. I know how to do everything from bash, but it is too f'ing slow compared to the Mac.

Re:Learn the CLI

[dmexs]

How do you start/stop services with only a text editor and a file manager...? Definitely not irrelevant.

2500 users? Not really

[Bazman]

I thought you meant you wanted 2500 users on the Linux system itself. That's a fairly big /etc/passwd file, and if they all log in at once then I suspect even a high-end system will crawl a bit.

What you really want is a system that can run a forum that can support 2500 users, but you don't say how many simultaneously, or anything else useful. For 2500 simultaneous users, all posting and reading, you might need more than one box...

So, proper requirements spec plzkthx.

Maybe Amahi?

[dr2chase]

I am nearly equally Linux-ignorant, I set up Amahi as a "home cloud" (googling for that is what led me to it). It runs on Fedora by default. It's been mostly easy to install and maintain, and I even managed to install Trac on my own with not too much pain (given that I already have installed Trac on MacOS and Solaris).

phpBB is one of their apps that is in beta, where I suspect it will be for a while (it's volunteer-mostly), but the apps so far are click-and-go. I administer the box with webmin, which in practice means installing software updates from time-to-time, and watching the Smart status on one of my drives indicate that it is dangerously old and in need of replacement. No handy Linux app that I can see yet that replicates the user-friendly behavior of MacOS SuperDuper (sigh).

Re:Maybe Amahi?

[znerk]

No handy Linux app that I can see yet that replicates the user-friendly behavior of MacOS SuperDuper (sigh).

dd will probably do what you want. It's not exactly user-friendly by default, but there are tons of front-ends for it that make it more so, and I don't know of any *nix distributions that don't include it by default.

Technically speaking, dd "converts and copies a file"... but in *nix, everything is a file. That means disks, pipes, processes, and even, well, files.

Re:Maybe Amahi?

[dr2chase]

I was pretty sure that dd was going to be my best friend, but we could wish for a better best friend. As near as I can tell, I ought to boot single-user off a CD and do it from there. Is that overconservative? No-way-no-how can I just far up dd on the raw device underneath a bunch of partitions, can I?

Re:Maybe Amahi?

[znerk]

I was pretty sure that dd was going to be my best friend, but we could wish for a better best friend. As near as I can tell, I ought to boot single-user off a CD and do it from there. Is that overconservative? No-way-no-how can I just far up dd on the raw device underneath a bunch of partitions, can I?

Look for dd-based partition-manipulation tools; possible search terms might be "Linux Ghost" or "disk image dd". There are a plethora of solutions out there, and you can probably find one that suits you with only a small amount of experimentation. Many are available as a bootable CD, and come with a menu system or other helpful tools. Several allow you to backup to a massive variety of targets, anything from simply backing up a partition to a gzip'd archive on a separate partition to streaming a bit-wise copy of the entire disk over the internet to a remote system you have access to (and creating an exact duplicate of the partition/drive on that target).

A LiveCD of your favorite distro or "rescue disk" or "recovery tools" can also be extremely useful; Most either already contain some sort of disk/partition tool or allow it to be installed on the RAMdrive the system boots into, assuming internet access. For example, gparted is a graphical tool that will allow you to manipulate partitions, resizing, moving, cloning, etc... and it's available on the Ubuntu LiveCD by default (last I checked).

A persistence-capable "external" (USB or otherwise) boot device can allow you to keep configuration information or notes (such as which drives/partitions you have backed up, when and to where) between boots, as well as allowing a portable system that contains your preferred set of tools. Taken a step further, you can create your own LiveCD once you have a preferred setup (assuming you're not scared to learn even more).

As for firing up dd on the raw device underneath a bunch of partitions... well, your swap will be corrupted, for obvious reasons, and any disk writes during the read process will harf your data, too, so it's not necessarily the best plan... but it's theoretically possible. At this point, I would examine your motives for imaging the disks in the first place, as a direct image may actually take more time than simply backing up your configuration and data files, and keeping a list of where each file belongs and what packages need to be installed if the server should be "hit by a bus".

Disk imaging can be a simple solution, but a reinstall can be an excellent opportunity for "cleaning out the cruft", and may actually require less time or effort than imaging a full disk, depending on the size of the data involved and where the server is located (ie, your ability to gain physical access). I've lost count of how many times I have blown a new OS onto a machine, dropped the appropriate apps/data from backup into the appropriate locations, and told my users to have a nice day, turning what might have been a several-days-long recovery process into a several-hours-long "we'll test your ability to print when you get back from lunch," hand-wavy, user-happy-making experience.

You may question my abilities to administer systems based on that last paragraph, but in my defense the user base I am describing is several hundred independent offices, with users whose prowess ranges from "sure, I can ftp that to you when I get back to the office" to "what power button?"
I wish I were kidding. To make things more interesting, the offices range across 4 states, and deal directly with municipal infrastructure, typically not in "major" cities. Try explaining "minimum downtime" to someone who isn't aware that a computer is required to access "that innernut thang".

Re:Maybe Amahi?

[reiisi]

snapshot

then tar the the snapshot, not the live volume

Re:Maybe Amahi?

[gig]

Notice he said user-friendly and he is referring to a Mac. That means he is talking about so easy that it requires absolutely no work at all.

Re:Maybe Amahi?

[3p1ph4ny]

> No-way-no-how can I just far up dd on the raw device underneath a bunch of partitions, can I?

Yep, you sure can.

Re:Maybe Amahi?

[znerk]

iOS is a little more complex than that, and Apple users are not automatically retarded. Please note, I type this on a Windows machine, sitting on a network of Linux servers and clients, behind a Linux router/firewall. I don't own any Apple products, and there are none residing in my household. I disagree with the walled garden approach Apple has taken with their products, and choose not to use them, but many people find them much more suited to their task set than PCs.

Again, I'm not advocating any one OS over another, but I get really tired of seeing people who have never touched a Mac bitching about how retarded the Apple fanbois are. They're no more rabid or zealous than Linux users were a few years ago.

Go hosted?

[naelurec]

A forum and some custom LAMP pages ... soooo why not focus on that and leave the server/hosting/etc to someone else? There are a lot of LAMP hosting providers out there that you could use for a few $$ per month.. Go with a company that can give you SSH access so you can get familiar with some CLI management (or concurrently attempting to run the same stuff on a virtualbox linux setup) and perhaps down the road once your more comfortable with the LAMP config, then migrate the site to your own server.

Re:Go hosted?

[gladbach]

I'd agree with the hosted part. If you really want to roll your own, I'd personally go nginx and php5-fpm with mysql backend rather than apache. Its much more likely to perform well with a 2500 user phpbb than apache.

Re:Go hosted?

[Ariven]

Yup that was my thought as well, I use DreamHost for my hosting.. (just paid the bill so its on my mind).. not unreasonably priced, they have great tech support and you can do quite a bit with it.

Re:Go hosted?

[Ash-Fox]

I'd personally go nginx and php5-fpm with mysql backend rather than apache. Its much more likely to perform well with a 2500 user phpbb than apache.

That's really a side effect of not setting up the OS and Apache properly.

If you're expecting a large amount of simultaneous connections, configure the OS to provide that many file descriptors to Apache and configure Apache's MPM preforking accordingly to that ratio with mod_php. I suggest avoiding threaded MPM for security, recovery and stability reasons.

You will suddenly find that nginx's performance is not so great in comparison and doesn't have the disadvantage of PHP-FPM's additional usage of file descriptors.

Apache isn't very good against nginx when it's starved of file descriptors, but that's normally due to not configuring the system accordingly for the load expected. Regardless, by not configuring your system accordingly, you're generating additional CPU load as the software has to fall back on other more CPU intensive methods to deal with the lack of file descriptors. The extra load on the CPU usually costs more power as well as the potential capacity if it had more file descriptors available.

Re:Go hosted?

[bhcompy]

This is very interesting information that I have yet to come across. This will be very useful. Thank you

Re:Go hosted?

[bhcompy]

Cash is the problem, of course. I'm not going to pay for the hosting when I have a decent enough server and a business class pipe already available. I'm not getting any cash in return for this, it is merely hobby

Re:Go hosted?

[pionzypher]

Informative. Wish I had points to give.

Re:Go hosted?

[jwhitener]

It looks like Redhat default apache install has those settings by default. /usr/sbin/httpd -l
Compiled in modules:
    core.c
    prefork.c
    http_core.c
    mod_so.c

Re:Go hosted?

[Ash-Fox]

It looks like Redhat default apache install has those settings by default.

The configuration file still needs to be configured to spawn Apache's MPM preforking children accordingly to the expected load ratio, which you (as in you, not default install) should have already configured to a reasonable amount file descriptors in the kernel for the expected load.

So, technically, no, not "settings by default", binaries are as you pointed out however, compiled to support that configuration however.

Re:Go hosted?

[jwhitener]

Thanks for the clarification.

Conflicting goals?

[vlm]

not a chore to manage and preferably not completely CLI.

Aren't these inherently directly conflicting goals?

Easy to manage, is you change one little thing in your puppet config and puppet magically makes it happen, instead of having to babysit everything.

Easy to manage is someone tells you "make /etc/apache2/apache2.conf look exactly like this" instead of "click on the 2nd icon from the right that looks like two mating centipedes, then look randomly about the screen until you find the icon that looks like a discarded kleenex, oh you're seeing an icon that looks like a black hole, well, then click two pages back" etc for about ten minutes.

An analogy is "teach me physics, without any of that tedious math stuff".

Re:Conflicting goals?

[Zantetsuken]

Exactly - when I went to school they taught using Fedora 6 with Webmin and the non-working Fedora GUI tools for managing Apache and SSL. Even if the tool configured Apache to start and host a site, they NEVER configured SSL properly, no matter if you followed the textbook, or tried any combination or order of clicking buttons in the Red Hat tool or Webmin.

After a while, I installed Debian 4 (right after it came out) one of my systems, looked around for GUI configurators, saw none, and so it seemed that the only way to do so on Debian was through CLI. Turns out, a basic Apache config (probably not at all secure) was about 3 or 4 lines in the config file, and SSL is only another 5 or 10 minutes through the command line where weeks of playing with GUI tools at school yielded nothing.

Point of the story being that Apache and SSL really are easier to config through CLI. Also, I never really went back to Red Hat/Fedora/Etc after that since they always seemed to be too bleeding edge - giving Fedora dependency hell, you go to update all packages on a system, they require newer libraries than in the repo, and can't update. I've never really had this happen on Debian but for once or twice on experimental.

Re:Conflicting goals?

[ToasterMonkey]

Aren't these inherently directly conflicting goals?

Easy to manage, is you change one little thing in your puppet config and puppet magically makes it happen, instead of having to babysit everything.

Easy to manage is someone tells you "make /etc/apache2/apache2.conf look exactly like this" instead of "click on the 2nd icon from the right that looks like two mating centipedes, then look randomly about the screen until you find the icon that looks like a discarded kleenex, oh you're seeing an icon that looks like a black hole, well, then click two pages back" etc for about ten minutes.

No, they are not conflicting goals.

How do I put this gently... there is... *ahem* plenty of room to add value to open source projects. If you get my drift. Take Visual SVN Server for example. They didn't remove svnadmin, and you don't even need to know apache is there for the most part.

Also, I can't think of any case where Puppet makes managing a single instance of something easier. At best it is as difficult as doing the underlying work yourself. It solves a different problem, of managing looooooooots of things. A command line interface also has little or nothing to do with Puppet. You picked a bad example, Puppet would actually work better with programatic interfaces to all it manages, NOT some clunky CLI or configuration files. Good lord, I'm sure the LAST thing The Puppet devs want are more messy config syntaxes to manage. Dropping in whole config files like you said is not the ideal Puppet way of doing things, and the config has to be developed the first time anyway. That's just a kludge we have to use because so many things lack usable management interfaces.

There's no reason a program can't have more than one management interface, and not be a chore to configure.

Re:Conflicting goals?

[marcosdumay]

"There's no reason a program can't have more than one management interface, and not be a chore to configure."

There is no reason to not make a GUI available for configuring some program. But there is a reason the GUI configuration is always slower (demand more time from the user) and less powerful than the CLI.

Also, most software that are a chore to configure come from the "the GUI must do everything" philosophy, not from the "let's make a nice CLI, somebody can add a GUI latter" one.

Re:Conflicting goals?

[Zantetsuken]

Which is why I said it probably wouldn't be very secure :(

Also, I should have clarified that to get the server working in such a basic state takes "adding or modifying" said number of lines.

However, I still stand that no matter which server you choose it is currently easier to get it up and running through CLI instead of said kludged together RedHat or Webmin configurators, which seem to use backend scripts that fail to even write to the file properly...

If you're a Pickie....

[TSpec]

Why not use ScarletDME? It's a fork of the open source OpenQM project and would handle your needs quite well. There's a couple of ways to access it via PHP as well. If you know Pick no reason not to stay with it. :)

http://www.scarletdme.org/

Re:If you're a Pickie....

[bhcompy]

While I wish I could, the DBMS matters. That said, it is an interesting thought for the future when I have time to do it, and I know for damn sure it's(in general) a better solution performance-wise than MySQL(or PostgreSQL)

Re:If you're a Pickie....

[TSpec]

No problem. Keep in in mind though - if nothing else, it makes a great tool to use at home instead of paying through the nose for D3 or Reality when you're just doing local dev.

Why not WAMP?

[Culture20]

Have you even thought about a WAMP setup? A poorly admined Linux box is worse than a well managed Windows one. - from a *nix sysadmin

Re:Why not WAMP?

[hawguy]

Have you even thought about a WAMP setup? A poorly admined Linux box is worse than a well managed Windows one. - from a *nix sysadmin

I've come across some WAMP setups, and in my experience, the AMP part is harder to maintain on Windows than on Linux... and, doesn't seem to run as well under load though part of that may be the poor administration of the AMP stack in the first place.

Re:Why not WAMP?

[jedidiah]

If you are smart enough to do Windows right, you don't need to use it as some sort of delusional crutch.

A poorly managed Windows box is far more dangerous than a poorly managed Linux one and that's exactly what you will get if you try to tell people that they can use Windows if they want to be lazy. They will be lazy and disaster will ensue.

I don't think I've seen anyone mention yet that the P in LAMP/WAMP is the most problematic thing here. It's not something to be trifled with. The new user needs to understand and respect the potential security implications of running someone else's PHP app and the need to keep security patches current.

The "I will run Windows because it will let me be an idiot" attitude is entirely inappropriate for any 3rd party PHP app you are going to expose the world.

Re:Why not WAMP?

[gig]

A well managed Windows box is worse than a poorly admined Mac.

If the guy needs easy Unix, he needs a Mac. DUH.

Re:Why not WAMP?

[Culture20]

A well managed Windows box is worse than a poorly admined Mac.

I disagree most heartily. I admin Windows, Linux, and Mac OSX boxes (used to admin SGI and Solaris too). Mac OSX is sort of like Solaris used to be: you remember Solaris, with its remotely exploitable telnet daemons turned on by default, but with a little tweaking and patching before connecting to the internet, you could have a rock solid system? Mac OSX systems (with the exception of OSX Server) don't have firewalls on by default, nor do they have a fine-grained GUI for ipfw (just firewall:on/off). Furthermore, unless you're an _all_ Mac house, the Apple Remote Desktop can only be accessed via unencrypted VNC (have fun explaining to users that they aren't allowed to remote into their Macs from their Windows boxes; then when they complain enough, show them how to enable the standard VNC service to listen to 127.0.0.1 only, use an SSH tunnel to connect to encapsulate their VNC connection, and convince them that yes, they really do want to connect to localhost with VNC on their Windows machine). Also, iMac physical security is sorely lacking. The RAM is easily removed even if the machine is physically locked, and removal of the RAM causes erasure of the nvram/setup password, so users can essentially always boot from unapproved sources.
And... Apple tends to be last in any patch deployments for widespread security vulns like cross-platform libs or bad certs. Sometimes they're half a year late like with Java.

How about a web-hotel

[TheSunborn]

How about just buying a webhotel instead of setting up a server?  I mean if you just need to run php5.3 and mysql there is really no need to setup your own server.

Get someone else to do it

[ilsaloving]

If you don't understand Linux and won't/can't want to take the time to learn it properly, then it would make more sense to get a hosting account from a reputable web hoster. Or if you insist on running the machine yourself, hire someone to do the initial setup for you.

In todays environment, you need to understand a great deal about many OS level things, most of which revolve around security. Firewalls, mail configurations, etc. Not setting these things up correctly can have bad consequences. For example, your server IP address is blacklisted by RBLs because you left your SMTP port open and spammers started using it.

Re:Get someone else to do it

[znerk]

In todays environment, you need to understand a great deal about many OS level things, most of which revolve around security. Firewalls, mail configurations, etc. Not setting these things up correctly can have bad consequences. For example, your server IP address is blacklisted by RBLs because you left your SMTP port open and spammers started using it.

I'll respond to this with some EZ-Mode FixIt, and a small amount of snark directed at your pompous attitude.

Use a whitelist-based firewall (that is, only allow known legitimate connections (this can be per service/port rather than by remote IP, in case that wasn't obvious)). A firewall generation script can build you a good starting point, if you would prefer for it to be (mostly) done for you.

Use port knocking (look up knockd) for any "dangerous" services, such as SSH, as a further step in keeping the bad guys out of your box. No, this is not a good idea as the *only* security practice, but I have found that my SSH attacks have gone away completely from my logs since I implemented port knocking, whereas even port shifting and removing password-based authentication barely even slowed down the zombies blindly attacking my sshd (and fail2ban is useless for a distributed brute-force attack, such as the botnets that seem to do exactly that in their idle time).

Know that any decent (read: popular in the slightest) distribution of Linux will be fairly secure out-of-the-box, in that potentially dangerous services are typically not installed by default, and there are warnings about security all over the place when you attempt to install them. This means that your SMTP port scenario is an utter fabrication, because there's no mail server installed by default, and/or there's no configuration for it, so it's not running (or at least not accessible anywhere except 127.x.x.x). You are far more likely to be blacklisted because you're running it in your living room on your home's cable/dsl connection (via "public" IP range blacklisting) than because you accidentally left a port open on a default install.

Re:Get someone else to do it

[ilsaloving]

Pompous? Do you know what projection is? We're talking about someone who wants a convenient gui interface for managing a server. Instead of flipping out over one example (which I chose because it's relatively easy to understand without requiring deep explanation), how about you actually pay attention to the target audience and consider the larger issues.

And just to top it off, you are laughably wrong about mail servers. There is ALWAYS a mail server installed by default. At an absolute minimum, you will have sendmail installed, because the OS tries to send emails to the internal users (most often status messages to root). Yes, by default it only listens to 127.0.0.1. But that's the only thing protecting you. All you have to do is say to yourself, "Hey, I want to receive mails too!" update the binding address, and there's your open relay.

The point is that there are a lot of things to consider when setting up a server, much of which is not obvious It's not a matter of just popping in a disk, running the installer, and you're done. You gave another good example of the kinds of completely arbitrary things to worry about: violating the TOS on your dsl line.

Having linux be secure out of the box means nothing if you don't know enough to leave it alone. I've seen people disable the firewall completely because they didn't know how, or try to figure out, how to add just a couple of ports. Want to set up a mail server? Suddenly you need to worry about a myriad of DNS concepts including forward and reverse lookups, SPF records, etc etc.

Setting up a server is dead easy. Setting up a server PROPERLY, is not.

Now please crawl back into your parents basement where you can pretend that you're superior to everyone else, and leave the rest of us alone.

Re:Get someone else to do it

[znerk]

For example, your server IP address is blacklisted by RBLs because you left your SMTP port open and spammers started using it.

This means that your SMTP port scenario is an utter fabrication, because there's no mail server installed by default, and/or there's no configuration for it, so it's not running (or at least not accessible anywhere except 127.x.x.x).

And just to top it off, you are laughably wrong about mail servers. There is ALWAYS a mail server installed by default. At an absolute minimum, you will have sendmail installed, because the OS tries to send emails to the internal users (most often status messages to root). Yes, by default it only listens to 127.0.0.1. But that's the only thing protecting you. All you have to do is say to yourself, "Hey, I want to receive mails too!" update the binding address, and there's your open relay.

Except I said earlier in my post that you should

Use a whitelist-based firewall (that is, only allow known legitimate connections (this can be per service/port rather than by remote IP, in case that wasn't obvious)). A firewall generation script can build you a good starting point, if you would prefer for it to be (mostly) done for you.

... And you yourself reiterated my point that a default OS install includes a local only sendmail.

In addition, if the user is savvy enough to update the binding addresses, then they are (hopefully) savvy enough to secure their shiny new mailserver. If not, their ISP will cheerfully shut down their 25 and 110 for them when they start pushing more than a couple dozen emails per day. That is, of course, assuming they're running their server in their living room. If they're running it in a corporate environment, then either someone else in the building will ask them why their internet is suddenly slow, or their ISP will call them up and ask if they actually intend to be sending out thousands of emails with the subject line "V1@6R@ 4 U!!!!1!"

Add Webmin to your server

[seanmcgrath]

Webmin.com is a web based system administration tool that is free and runs on most Linux and BSD based systems.
It will give you an easy way to see and manage all the subsystems on a server.

Security Security Security

[Oxford_Comma_Lover]

Make sure your installations are up-to-date and *easy* to upgrade, and follow any program-specific "security" FAQs, instructions, manual chapters, etc...

A LAMP System with common server applications and without careful configuration is basically begging to be cracked. Following the basic instructions for tightening it down (limiting system access of www-data user, limiting database permissions of the database user your web applications are accessing the database as, making sure strong input validation is used on anything you create personally and that all applications are up-to-date, etc...) will go along way toward reducing the risk and consequences of an attack, and will take much less time to do in the beginning than it will take to fix if the system gets compromised.

Besides, you'll learn a surprising amount doing it, if you've never done it before.

Re:Security Security Security

[Oxford_Comma_Lover]

And move SSH to a non-standard port, assuming you're running it. You'll cut SSH attacks in half.

Re:Security Security Security

[znerk]

Non-standard ports and/or fail2ban are good at reducing the chances of an attacker gaining access, but if you also use port knocking, you'll minimize the chances of an attacker even finding your "vulnerable" service. Multiple layers of security are better than single layers, hands down.

Another approach

[Will.Woodhull]

I am surprised that no one has mentioned XAMPP or Portable XAMPP yet.

I used Portable XAMPP under WinXP as a development environment for several years. It comes with a couple of GUI management tools and has an active community behind it. Advantages: you get a LAMP-like setup on a removable drive running under an OS you are already comfortable with. If things go totally weird, you can replace the XAMPP drive with one loaded with an earlier backup and be confident that none of the weirdness has been left in your system. I found that was a very comforting thought when I was going through the newbie jitters phase.

XAMPP is probably powerful enough to handle 2,500 users doing typical Internet stuff (avoiding serving out hundreds of full length movies, etc). So it might be suitable for your production environment as well as development: install it on a fast fixed HD using Ubuntu Server as the OS and you will have a bullet proof operation that is easy to manage and develop for. XAMPP is plain vanilla and seems to play well with any of the Linux servers.

Here is a link to one source of XAMPP goodness. Anyone who is still using Windows should think about exploring the PortableApps site, too. There are some FOSS gems there.

Re:Another approach

[Anonymous Coward]

I just happened to play with XAMPP the other day at work. Someone installed it on a box for a test web server and they wanted some help to move it into production.

A word of caution: XAMPP with all of its defaults is a security nightmare. Passwordless PHPmyAdmin, mysql instance, security settings. I didn't dig too much into XAMPP so maybe there's a configuration guide for making it secure, but at first glance it seems its for developers who need to fiddle with everything and not production.

Re:Another approach

[Will.Woodhull]

The issues regarding Xampp security are well known and documented. (This is the link that would have made parent post a better post. But some persons prefer SHOUTING to backing up their assertions with useful informative statements.)

Basically, Xampp out of the box is not secure. It can be made reasonably secure for home / hobbyist level hosting and the link shows where to go to change settings and establish passwords. If the need is for a hardened site that adequately protects credit card data, health care data, patent almost pending data, etc, then there are better ways than Xampp. But if that level of security is needed, and the organization is seeking recommendations from Slashdot rather than its own security experts, then there will be a train wreck no matter what advice is given or taken.

Specific points in parent post are reasonable. In particular, if the only goal is to have a usable web site, then using Blue Host or a similar web hosting service is the best way to go. But you will not get much experience in configuring and securing your web site since the $6/mo that you are paying the host covers all that stuff.

Sounds like you are hosting a website.

[salesgeek]

Ubuntu server is very good, but you really will have to deep-dive into Apache and the mail server of your choice which adds about 200% over just learning Linux. In your case, though, it sounds more like you are setting up to serve a few PHP apps. If that is the case, I'd recommend setting up on a Cpanel based hosting service (Cpanel runs on CentOS and has become a de-facto standard for serving PHP apps like PHPBB 3). If you need a dedicated server, you can find places where you can get a Cpanel server for $100/month-$200/month... or you can license it for your own server. There is a reason that Cpanel is so popular...

Ignore all the static here about "another admin who doesn't know what he/she is doing". Every one of us here knew nothing at one time. Yes, you'll learn a few lessons the hard way, but as long as you have regular backups and pay attention to ensuring users have strong passwords, you probably will not do anything you can't recover from.

Short answer

[xebecv]

Just go with the crowd.

Re:Bitnami

[postbigbang]

turnkeylinux.org has great LAMP appliances, along with other loadable VMs. Free.

XAMPP

[Osgeld]

just be sure to tighten its security before letting it loose, by default its as secure as a wet paper bag ... it runs on windows as well if it makes you feel more at home

Ubuntu + Zend Community Edition

[l0ungeb0y]

As other posters have pointed out -- Ubuntu is your best bet for a user friendly Linux distro, especially if you plan on using a GUI for administration.
For the LAMP stack, Zend Server is your best bet, it's a free, self contained environment (installs to /user/local/zend) with everything you need pre-configured and packed up with an installer. It even includes a service monitor for easy access to log files.

Re:Ubuntu + Zend Community Edition

[LordThyGod]

Sorry ... strongly disagree. Ubuntu has a self contained LAMP environment already. No need to go outside the distro for core functionality. Its in the meta package called lamp-server. IIRC, its an option during the server installation, so its one stop shopping. If you miss it, then its 'sudo apt-get install lamp-server', or somesuch, and off you go. Also, you get integrated security updates with the built-in apt features. Stuff in /usr/local complicates all that and introduces the possibility of conflicts with native package management.

CentOS.

[rannmann]

If you're going to be learning it, may as well learn it the correct way. CentOS (short for Community ENTerprise OS) is great for servers, and LAMP on red-hat based systems takes about two minutes to install and configure. Any Linux distro will be hard to learn at first, and CentOS isn't any harder than the other big names. Keep this in mind as you struggle through learning the command prompt. If you end up liking CentOS, you could try Fedora for a workstation to really lock down the Linux essentials. If you end up hating CentOS, you could try Ubuntu. Which brings me to the "avoids CLI" comment. While GUIs are nice and all, honestly, the CLI is much simpler. Even if you don't know what you're doing yet, you can copy-paste commands from guides and get things setup rather quickly. I'm not sure I've ever setup much of anything in Linux without use of the CLI. To give you an example of CentOS installing a LAMP server using YUM (package manager), you would type this at the command line: yum install httpd mysql mysql-server php php-mysql Now you have Apache, MySQL, and PHP all installed. If you want phpmyadmin, just throw "phpmyadmin" to the end of that line. If you really want to avoid the CLI, you can install "webmin" as well. It's worth looking into, at least: http://www.webmin.com/demo.html And then to start the services: service httpd start service mysqld start If you want these services to run every time at boot: chkconfig httpd on chkconfig mysqld on Everything will be running, and will startup with reboots. Your website will be located at /var/www/html and directory read/write permissions should be set to the new user, "Apache". See how short and simple that was from the CLI? It was five commands! Anyway, I digress... Some people have suggested Ubuntu, but Ubuntu isn't a server distro. It will work, but if you want to run a stable server from a Debian standpoint, you would probably use the original: Debian. I don't recommend this, however, because Debian can be a PITA, if memory serves correctly. A lot of people out there will try to tell you that Ubuntu can be, and is, used for servers. Well, it's true. Anything can be used for a server, and there are quite a few Ubuntu servers out there, but that doesn't mean it's right. I mean, deep-fried Twinkies are still food, but that doesn't make them /proper/ food. If all this distro talk is going a little over your head, I wrote an article a while back as part of a series I never finished, introducing people to Linux. It's short, but you may find this section useful: http://drprofessor.info/index.php?option=com_content&view=article&id=151:a-brief-history-of-linux-and-distros&catid=50:linux and this one, too, if you want to know more about the directory structure differences between Linux and Windows: http://drprofessor.info/index.php?option=com_content&view=article&id=152%3Adirectory-structure&catid=50%3Alinux&Itemid=449

Re:CentOS.

[rannmann]

Sorry about the wall of text... I'm new to slashdot posting and it seemed to have killed my formatting.

Re:CentOS.

[znerk]

Sorry about the wall of text... I'm new to slashdot posting and it seemed to have killed my formatting.

That's one of the reasons I choose to use the "plain text" option, and add in my own HTML if I feel the need.
Also, you have now discovered the reason that the preview button exists.

Is this going to be on the public Internet?

[jimicus]

If this is going to be on the public Internet, I'd question the wisdom of managing it yourself when you've admitted it's not one of your core strengths. Instead, I'd set up a cheap & cheerful shared hosting account - it'll be locked down thoroughly, it'll have a pretty sophisticated set of management tools and if you install phpBB through the management tool there's every chance any security issues will be dealt with by your hosting company. Considering the security history of most PHP forums (dire), managing this yourself when you don't really know how and don't really need to seems to be asking for trouble.

Re:Is this going to be on the public Internet?

[Animats]

If this is going to be on the public Internet, I'd question the wisdom of managing it yourself when you've admitted it's not one of your core strengths. Instead, I'd set up a cheap & cheerful shared hosting account.

Agreed. Shared hosting is about $5 to $10 a month now. Dreamhost and Hostgator are quite capable of hosting a forum system of 2500 users on a low end account. They handle server administration, backups, and replacement of the hardware when it breaks. And, importantly, they have a lot more bandwidth to the Internet than you do.

There are reasons to run your own server, but none of them apply to your case. You're not developing new code. You're not running persistent processes like a game server or a virtual world, or even an IRC client. There's no background processing like a web crawler. You're not streaming video. So outsource.

Re:Is this going to be on the public Internet?

[bhcompy]

I will be serving other applications/services on top of phpbb, but they will be phased in(probably on another server, depending on how load goes). IRC, Jabber, etc. This is why I am looking to do it myself(along with the money issue).

SLAMPP (bootable CD)

[ItsPaPPy]

SLAMPP will give you what you are looking for on a boot cd. http://slampp.abangadek.com/info/

Any main distro

[jdc18]

Just use Centos/RH/Fedora or Debian /Ubuntu, yum install httpd php php-mysql mysql-server, in centos or rh might be php53, In debian/ubuntu apt-get install apache2 php mysql php-mysql or something like that if you know the basic of how apache php and mysql work, they work the same in linux.

Ubuntu

[desertlama]

You might look into Ubuntu Server running Virtualmin GPL. The Virtualmin installer script will install a LAMP stack. You can configure and management things via web browser.

Any flavour will do

[houghi]

After all, the installing of the server will be the main difference. Once it is installed, they will be basically the same.

I hope you did not bite of more then you could shew. With Apache and MySQL you wioll already have your hands full to make it secure. Add php on top of that, which you do not know and it will become a leaking basked when looking from a security point of view.

You are not even sure about phpBB as it only seems adequate.

The selection of the Linux Distro would be the least of your problems. In the 90-ies many managers asked who had Internet access and the chmuck who raised his hand was the Internet IT specialist from then on with all the responsibilities.

I would reconsider if you are the right person for the job.

I also know you won't listen, so here some tips. (Blatant distro plugging ahead.)
1) Use openSUSE. It installs very easy and has a GUI as well as a CLI to do the installation called YaST and an easy option to select a LAMP and anything else. Also easy to use YaST later for cvonfiguration of other parts, including basic configuration of Apache. Workable via ssh.
2) Also install phpMyAdmin as it is easy to do MySQL admin via the website
3) Learn all there is about securing you php site.
4) Learn to work via CLI
5) Make incremential daily or more often backups and know how to restore them
6) Look if there is somebody who can replace you while you are on a holiday or in hospital or worse, not interested anymore.

If 6) is nobody, don't even bother to start. It will be a short lived project that will die and you will be blamed for letting it die.

Re:Any flavour will do

[bhcompy]

I understand the risks, thank you. There is no data on here that will cripple anyone, or even hurt anyone, if someone manages to exploit security holes. That said, I take security very seriously and will obviously be learning new things here. I wouldn't be here asking this question if it was a server for some medical provider hosting all sorts of juicy bits of information. It's hobby related and if I do fuck up no one will be impacted negatively.

That said, thanks for the information.

Tell me why oh why ubuntu ouch

[uM0p ap!sdn]

Fuck ubuntu. Use the real thing --- DEBIAN. Ubuntu an ancient African word Meaning Debian for tots. Looking at the ubuntu forums and all the problems with ubuntu. Why the fuck would anyone use it ? especially for any type of server.

Go hosted

[saleenS281]

Seriously, if you don't know anything about linux, and don't want to be bothered with securing and updating it, just go with a hosted solution like Dreamhost who has a GUI panel for most of your administrative needs. Getting something "simple" is a recipe for you getting hacked.

Re:Go hosted

[DaMattster]

IMHO, this is a great learning opportunity and a chance to add to your resume. There are plenty of good howtos and tutorials to get you started. Securing it is not even that difficult. It just takes some willingness to do some reading and can be just as reliable as hosting. You might even continue reading more about failover and use a hosted site as a backup.

Use XAMPP as your LAMP setup

[sorton9999]

I agree with other posts about using XAMPP (http://www.apachefriends.org). I've used it quite a bit for development work and I found it super easy to install. It supports Linux (debian and redhat among others) and Windows. It comes with MySQL and SQLlite with the phpMySQLAdmin admin tool, PHP and perl for development). The best thing about it is Apache, MySQL and PHP are all pre-configured. There's even an FTP server included. I'm not too sure about security though as I never went live using it, but if you read up on server (esp. web server) security, you can configure it pretty easily from what I understand.

Re:MySQL is SO much easier to maintain

[Anne Thwacks]

If you think MySql is easier and more consistant than pgsql, it may be evidence of drinking or poetry skills, but not of actual esperience of administering pgsql.

Maybe MySql "just works", but pgsql "works properly"

2500 users

[mwvdlee]

2500 users doesn't say much. 2500 people that will log into a forum a few times a week or 2500 people that'll upload and download eachothers' entire lives in multimedia?

ClearOS

[linuxwebadmin]

ClearOS is a great choice for what you're describing in terms of your needs of the OS and your abilities with linux.

Re:ClearOS

[pr0f3550r]

Agreed. ClearOS is very easy to set up and the LAMP stack is already there. They just released beta1 of ClearOS 6 this last week which includes php5.3.3, mysql5.1, apache. You can configure multiple domains easily from a web interface and can install most php apps by just using your windows workstation to interface with the ClearOS server (minimal or no command line).

Re:first (4)

[thirdwikidotorg]

first url: http://open.spotify.com/track/6ddLlmOcS6GE7xVRYI0cgH !!

Nice and simple

[AlastairLynn]

I'd go with Linux From Scratch, and the TUX web server for a little speed boost.

Unease with CLI and LAMP don't mix

[gweihir]

Also, if you are uneasy with a CLI, you need to ask yourself whether you can actually do this. Unease with CLI is typically due to lack of understanding how things actually work. In that case you should stay in the MS world, where people are (mostly) protected from making severe mistakes but are seriously limited in what they can actually do.

If you are trying to break out of the MS-world corset, then do not fear the CLI, learn to use it instead. It is the only way to be free of those restrictions, as GUIs are not and cannot be powerful interfaces due to fundamental limitations. Remember, the CLI gives you the power to command (and shoot yourself in the foot), while the GUI just interfaces you, allowing you to do just what the GUI designer chose to allow you to do. Both terms are surprisingly self-explanatory.

Re:Unease with CLI and LAMP don't mix

[bhcompy]

It's not uneasy, it's inexperienced. I want to learn, but it will take time. Something that I can configure and work my way in to is much better for how I learn than being dropped at the CLI and given a manual and some forums to search(which is what I had happen to me with PICK, which I'd rather avoid).

Re:Unease with CLI and LAMP don't mix

[znerk]

Also, if you are uneasy with a CLI, you need to ask yourself whether you can actually do this. Unease with CLI is typically due to lack of understanding how things actually work. In that case you should stay in the MS world, where people are (mostly) protected from making severe mistakes but are seriously limited in what they can actually do.

If you are trying to break out of the MS-world corset, then do not fear the CLI, learn to use it instead. It is the only way to be free of those restrictions, as GUIs are not and cannot be powerful interfaces due to fundamental limitations. Remember, the CLI gives you the power to command (and shoot yourself in the foot), while the GUI just interfaces you, allowing you to do just what the GUI designer chose to allow you to do. Both terms are surprisingly self-explanatory.

I wish I weren't so deeply embroiled in this discussion, so I could toss a mod point your way. This was an excellent response, directly addressing the poster's unstated needs. Kudos to you, sir.

Re:Unease with CLI and LAMP don't mix

[gweihir]

Well, for example for Apache, you get an example configuration file that explains most options. And you can gradually start changing defaults. For Perl, there are excellent tutorials out there (although Perl is by its very nature a write-only language, until you are very experienced). I have not looked at MySQL recently, but 10 years ago the documentation was long and a bit obscure. And of course, Linux, like any UNIX-like OS can really only be used from the CLI. The upside is that the knowledge you acquire has a very long lifetime. Typically stuff still works decades later. The other upside is that there is no hidden depth. Once you have understood how something works, you have understood it.

Re:Unease with CLI and LAMP don't mix

[gweihir]

Thank you!

Re:MySQL is SO much easier to maintain

[Giant Electronic Bra]

Sorry, years of experience trumps statements by random /. posters. Years of running large line-of-business applications has clearly taught me that admin of pgsql is a pain in the ass, and the way many features are implemented in MySQL is simply more straightforward and easier to support. Nor have I ever witnessed any of the mysterious "doesn't do it right" nonsense. MySQL just works. It works in a way that is clearly designed to make administering it as easy as possible. PGSQL OTOH seems to have some other agenda. Its command line client is horrendous for instance. It is overly difficult to move databases around, restore rarely manages to recreate exactly what you had before, etc. For every hour I've spent running around doing a task on MySQL I spend 3 doing equally routine tasks using PGSQL. There's just no comparison. PGSQL is a perfectly fine database engine, it is simply not better than MySQL in any definable way that translates to an actual advantage in production. There will be cases where one will provide some little handy feature that is easier to use than the other, or perform some specific type of work more easily or more quickly, but that cuts both ways IME. Hands down I'll pick MySQL by default. If I have to use PGSQL for some specific reason, well, OK, so be it, I can live with that, but I'd usually prefer not to.

People who tell you that CLIs are hard are wrong

[Dwonis]

not a chore to manage and preferably not completely CLI

In my experience, you spend more time & headaches trying to avoid CLIs and config files than you would need to spend just learning how to use those tools.

Debian does a *really* good job of making it easy to work with the CLI and config files. Don't fight that; just learn it. The knowledge is very reusable, and it remains useful for years (even decades?) rather than months.

Host somewhere else while learning LAMP admn

[dn15]

Even if it's just for fun that's a heck of a lot of users to let down if you run into trouble. I'd be concerned that even if you get it set up and running, some day it will go down and it'll take several days to figure to while the community languishes. I'd host somewhere else until you are really comfortable and familiar with LAMP administration.

All that you need is ...

[Phantasmagoria]

(1) The latest Ubuntu LTS
(2) Webmin and Virtualmin.

That's It! Nuff said.

Bitnami or Turnkeylinux

[rsborg]

Get an ISO, AMI, or VM image complete with LAMP already configured. Hell, they even have configurations that include apps already configured like trac, mediawiki or redmine. You'll have full control including root, so no worries about lock-in.

I'd just test one of these out, get your deployment script tested, then roll out the AMI on Amazon EC2 (then apply your deploy script)... where you can scale up the capabilities as needed.

Ultimately, cost/capability will determine whether you host locally, remote or cloud, but there's almost no reason you'll need to roll your own. My only gripe with these services is that they don't have Ruby-on-Rails with Apache and the Rails Passenger module pre-configured (as I find Mongrel/Webrick to be too ligthweight for production usage)... but that's only an issue if you're going production RoR.

Suggestions..

[tsiene]

First time accepted submitter bhcompy writes "I need to setup a system to serve 2500 users and I've been looking at a LAMP setup. This is not commercial, more of a personal side project for some friends. I've no experience configuring or administering a Linux server having worked with MS and PICK based solutions my whole life, so I'm looking for something that will be relatively straightforward to implement and not a chore to manage and preferably not completely CLI. I will be serving a forum(phpBB 3 suits my needs and seems adequate) and a variety of PHP driven content with a MySQL backend. Requirements are PHP 5.3.0+ and MySQL 5+. Suggestions?"

My first and current linux server distro is CentOS. You have to know some obvious things about Unix/Linux, and be savvy enough to google what you don't know or otherwise find tech advice.

Also may I add Open Source Software all the way is great for a personal project!

Suggestions.. PHP 5.2 is the 'standard' for many things, but it's usually best to have have the latest version of anything running on your server. You'll find this is true until you actually build software that interacts with these elements and one day suddenly breaks on a software update. After this you are faced with the agony of A) using the deprecated software with possible gaping security holes or new features missing -or- B) Rewriting your software, because if you don't it won't work.

Here's some advice that EVERYONE learns, so don't say I didn't warn you. The #1 rule in all of Server Admindom:

Backup, backup, BACKUP!

If you have important data on the server, back it up to other things! WHENEVER you are going to edit any sort of crucial configuration file (and you won't be a good server admin if you can't face editing a file that could totally -FUCK- your system up, and probably will in fact, so it's a good thing you took those backups that were actually from last tuesday oops) BACK IT UP FIRST!!

You're going to learn that on your own anyways. Everyone does.

If you're an administrator, you're going to need to get proficient in programming languages like PHP and SQL; having a programming language background, or at least passion, is essential. The only time the Administrator wouldn't do this is if someone else on the team does, in which case maybe they should be in charge of the software.

For one box, managing 2500 simultaneous socket connections, like a server for a real-time shooter game, is not an easy thing. Where is this box going to be? If it's in someone's house and hooked up to a slow residential line, that's never gonna happen. Are you renting it from somewhere, how much are you paying, what are the data limits, etc etc etc. Managing 2500 users on a website where you have a load of maybe 50 or 60 at any given time consumes much less in the way or resources.

If you want to rent but not pay a lot and you don't have any particular hosting service in mind, may I humbly suggest http://www.wtfserve.com./

A quick note to performance. You need a system for 2500 users, and a lot of posts here will say 'Users doing what?' which is important because obviously they can't understand what you want server-setup wise, and you don't really know yet either, because you don't know linux servers. Don't be disheartened by this; your mind might be overloaded with a dream that is not easily attainable, but it is also the driving force for what you wish to accomplish.

Re:Bitnami

[somersault]

That looks pretty amazing, I was thinking about setting up my own VM for my webserver soon, and that sounds like it has some really cool infrastructure for management/backups - thanks!

2600 users is not a "newb" project

[Antique Geekmeister]

This is not something to do as a "newb", as you describe it. Such a large project requires attention to mirroring, high availability, backup, load handling, security, and API's for accessing the data that are beyond a weekend "just set it up and run" project. It's a good time to contact your local DBA's for their guidance, and their preferences, and let them help you save time addressing the concerns they will raise later, and which may not be on the original plan.

Stability for a server class project would suggest a commercially supported product, like SuSE or RHEL. Bleeding edge utility requirements would suggest a development version, such as Ubuntu or Fedora or Mandriva. Debian and gentoo are not good choices for new admins who are not already very experienced and comfortable hand-editing their own configurations, ore turning dozens of badly advised Google referenced solutions into one supportable choice.

Much of this depends on your local resources: will you deploy in a data center with remote support, which many ISP's will happily provide with backup and failover configurations built-in? Or do you need to build your own purely as a proof of concept?

Why use Linux?

[taustin]

I know I'll get booed for this, but why use Linux at all? Apache, PHP and MySQL are all available for Windows, and run on any version. I use a Linux distro for my firewalls, but Windows for everything else, including two internal web servers, two mail servers and multiple file servers. Yeah, you can do the same thing with less hardware with Linux, and it's probably a bit more stable, plus less work to keep up to date, but if you know Windows, and don't know Linux, you're better off staying with Windows. You don't really need that much more hardare, mostly RAM, and that's not that expensive these days, and you'll be more secure and stable with an OS you know than something brand new. Plus, it's more likely to work.

(As a side note, I'd be very, very cautious about using XAMPP. It's not intended for a production environment, and it installs in a very insecure state. Plus, last I checked, they were pretty slow about adding new versions of stuff to their package, so things tended to be out of date. You can get all the components - Apache, MysQL, PHP, for free, direct, at the current version, from the people who make them. And while Mercury is a fine mail server, it tends to be updated slowly. Even if you go with XAMPP, use hmailserver for your email instead.)

Re:Why use Linux?

[bhcompy]

I know I'll get booed for this, but why use Linux at all?

Cost, of course.

Re:Why use Linux?

[fostware]

Actually, why bother using Apache?

"IIS Web Platform Installer", select PHP & MySQL, select Install and then sit back and watch the fun.
IIS 7.5 has a lot going for it, and if the OP has Windows experience but no Linux experience, the likelihood of being rooted is likely equal for both platforms...

(Ha, let's see who gets booed more, now!)

Re:Why use Linux?

[taustin]

Sure those are available, but a stable enough Windows OS to handle it is going to cost him at least a license fee. So, why bother?

I've had rather more trouble with instabality with server versions of Windows than with XP home, myself. Especially the newest version, though that has more to do with trying to do too much on a single box. Windows is only hard to keep running smoothly if you don't know what you're doing.

Re:Why use Linux?

[taustin]

Cost difference is minimal, since all the needed components will run just fine on Windows home. And, in fact, if you know Windows and don't know Linux, and you're not working for free, it's actually cheaper to use Windows because of the time to figure it all out.

Re:Why use Linux?

[Billly Gates]

Because you can easily use and install php modules from Yum or synaptic and do things like cakewalk with ease. Xampp can't do anything besides basic things unless you want to config .ini files and deal with incompatiblities. Most php software still is unix based and will do things like look for $home etc.

Linux is what your server will run anyway and if you use virtualbox you can run it on your mac or Windows 7 system for free with CentOS/Fedora/Ubuntu. You can use VMplayer (free) too and download a VMware image of your favorite distro too if you hate virtualbox.

I use Postgresql in which the win32 version comes with apache and php for Windows in the addons. But for anything else not simple I fire up my VM and run Linux as it is very easy to use and setup. I like it more and run in in VM in Windows that way

Re:Why use Linux?

[gig]

Why use Windows to run Unix tools? I don't see that you are taking any advantage of Windows at all, yet you've introduced viruses, malware, endless patching, OS upgrade fees, DOS line endings, weird Windows text encodings all not only not helpful, but detrimental. Even with Apache, PHP, MySQL, you are still missing dozens if not hundreds of other great tools. You say "if you know Windows" how does knowing Windows help you to configure Apache? The fact that you are on a strange platform actually means you have more chance of trouble and fewer help resources.

If you find Linux is not to your taste, get a Mac. It has a full Unix as well as a full set of GUI tools. And a Mac uses UTF-8 text encoding and Unix line endings throughout, just like the Web. No viruses, it patches itself, it is $29 every 2 years to upgrade the OS, and it is f'ing stable like a rock.

Re:Mandriva - YES

[hduff]

I agree. Mandriva is a very newbie-friendly, easy to install and configure distro.

PLF.zarb.org provides lots of patent-encumbered software, but there is a lot in the CONTRIB repositories.

Has great hardware detection and their sysadmin tools are very easy to use/understand.

I've used the LAMP-task RPM before and it requires minimal post-install configuration.

Re:MySQL is SO much easier to maintain

[javanree]

PostgreSQL might have been better engineered, but running, and maintaining, a MySQL installation is a lot easier; when working at an ISP I maintained dozens of both and always preferred MySQL. Restoring a backup? MySQL is a LOT easier and needs less work. Making a special backup? MySQL is a lot easier. Adding a user and granting rights? I prefer MySQL's way of doing. (I'm assuming all commandline here... maybe if you used a GUI things would work out differently but he's talking server and LAMP, which in my book means no GUI)

Only when you need the extra features of PostgreSQL you should consider it, but for a simple webbased forum package it's very much overkill and only gives more maintenance grief, specially as the original poster doesn't appear to have much experience with either system and the PostgreSQL learning curve is a los sharper.

One of two routes....

[danzvash]

If you want to have a general purpose full-featured Linux server distro that will be easy to set up and maintain, and be flexible enough to adapt to any purpose, choose either Ubuntu or CentOS (the Redhat clone).
They are easy to work with, and both can do everything.
(I'm guessing you're going to be physically sat at the computer while you're working on it, or working over VNC or some such, and that therefore you'll want a GUI - in this case use the usual Ubuntu desktop installer (rather than the -server edition which contains no GUI stuff).

Otherwise, if you want a quick and easy route to LAMP web serving, then the above suggestions of XAMPP, Zend, and also possibly Bitnami are the obvious choices. (They don't necessarily involve Linux though.)

Personally, I would recommend Ubuntu. It is a cinch to install and set up, great active community support, and you're not limited in what you can do.

Here's a little demo of what setting up LAMP on Ubuntu would look like. You can get where you want to be pretty quickly:

- download and install Ubuntu to the server (installation could be 10 minutes)
- open a terminal and type:
    # sudo apt-get install apache2 mysql-server phpbb3
(this will take probably 2-3 minutes to complete)

You are now 90% set up with your LAMP server. Current versions of Apache, Mysql, PHP, phpbb3 and all their specific dependencies are now installed AND running.
Time to configure the services!

If you want to stay away from the CLI - and set up a web-based GUI to admin the server - here are four CLI commands :-) to achieve that:
# sudo echo "deb http://download.webmin.com/download/repository sarge contrib" >> /etc/apt/sources.list
# wget -q http://www.webmin.com/jcameron-key.asc -O- | sudo apt-key add -
# sudo apt-get update
# sudo apt-get install webmin
(probably another 2-3 minutes for all these steps to complete)

That's it. You now you have a full-powered LAMP server, configurable via a web GUI.

Total work? About 30 minutes.

Barring security concerns (firewall rules and following guidelines on apache/phpbb3 config, passwords etc), backups, and future updates (which Ubuntu will handle almost completely automatically for you), that's about all you need.

Re:One of two routes....

[danzvash]

The formatting got screwed on two of those commands ....

So here's the updated 3 minute Webmin install for Ubuntu, following Unix sys-admin best practices:

# sudo echo "deb http://download.webmin.com/download/repository/ sarge contrib" >> /etc/apt/sources.list
# wget -q http://www.webmin.com/jcameron-key.asc -O- | sudo apt-key add -
# sudo apt-get update && sudo apt-get install webmin

Re:One of two routes....

[bhcompy]

Thank you. Regardless of what I end up doing, knowing the theoretical implementation always helps the first time through. And yes, I will be doing this from the console. Remote administration will come later

Re:One of two routes....

[znerk]

(I'm guessing you're going to be physically sat at the computer while you're working on it, or working over VNC or some such, and that therefore you'll want a GUI - in this case use the usual Ubuntu desktop installer (rather than the -server edition which contains no GUI stuff).

A potentially critical difference you may not have considered is kernel optimization. The server version is optimized for "background processes", whereas the desktop is optimized for the "user experience"; these are two entirely separate concerns, and optimizing one will severely impact the other's performance.

A better solution might be to install the server, then "sudo apt-get install ubuntu-desktop", which will give you the desktop's GUI stuff without having the performance impact of the desktop's user-experience kernel optimizations.

The solution I have chosen is to use my preferred desktop OS on my preferred desktop machine, and interact with the server remotely via ssh and/or administration tools such as webmin or virtualmin. My servers have power and network attachment, and that's it. No keyboard, mouse, monitor, speakers, or anything else extraneous to their assigned tasks.

This has the added benefit of not requiring any procedural changes if/when you decide to move your server to the cloud, or otherwise outsource/co-locate it.

Re:One of two routes....

[reiisi]

I'm going to say this one more time.

Get an extra box for making your first mistakes in. Do not let all 2500 users play on your first efforts unless you are ready and they won't mind if you have to suddenly wipe the box and start from scratch because it is full of trojans and the like.

Keep backups of the data, preferably not on a drive permanently attached to either the production server or the dev/test/playground server.

And, just to emphasize what everyone is saying, go check out openbsd sometime. Don't fear the CLI, even if you choose to start with webmin telling you what it thinks your options should be. And, someone else pointed it out, but you want to keep webmin only accessible localhost. Even if you have to use the command line to set that up.

Re:One of two routes....

[danzvash]

Ok, I'll bite, since you responded to my response ....

I'm going to say this one more time.

That's good - I must have missed the first few times you popped out these gems!

Get an extra box for making your first mistakes in. Do not let all 2500 users play on your first efforts unless you are ready and they won't mind if you have to suddenly wipe the box and start from scratch because it is full of trojans and the like.

If you're careful in the set up, a non-critical project could be hosted on the first spin. Besides ... trojans on a LAMP server are not a big concern, are they?

And, just to emphasize what everyone is saying, go check out openbsd sometime. Don't fear the CLI, even if you choose to start with webmin

Dude. The guy asked for a "newb-friendly Linux flavor". And your considered response is to go and use OpenBSD - which is neither newb-friendly, or Linux? Really? The only reason that you would suggest that is down to your own preferences - not the poster's - and as such it appears quite irrelevant.

you want to keep webmin only accessible localhost. Even if you have to use the command line to set that up.

Again, not necessarily good advice. Webmin runs by default on HTTPS, putting the basic level of security on a par with an SSH server. No need for SSH tunnelling to the server.

So much noise in the world ....

Re:One of two routes....

[danzvash]

znerk makes a very good point. The kernel is an important difference between Ubuntu Server and Ubuntu Desktop - they use different schedulers, and the server version leaves out the "user interface" tweaks which the desktop has.

However, bearing in mind that you're a Linux newbie, and you probably want to have an easy GUI style installation, the desktop version is the way to go.
The differences in serving performance between the two kernels are unlikely to be noticeable unless the site is a high-throughput one.

But if you are concerned about performance, and you want to take on board znerks' advice, install the server kernel after installation, with a single CLI command like this:
# sudo apt-get install linux-image-server

Re:One of two routes....

[znerk]

znerk makes a very good point. The kernel is an important difference between Ubuntu Server and Ubuntu Desktop - they use different schedulers, and the server version leaves out the "user interface" tweaks which the desktop has.

However, bearing in mind that you're a Linux newbie, and you probably want to have an easy GUI style installation, the desktop version is the way to go.
The differences in serving performance between the two kernels are unlikely to be noticeable unless the site is a high-throughput one.

But if you are concerned about performance, and you want to take on board znerks' advice, install the server kernel after installation, with a single CLI command like this:
# sudo apt-get install linux-image-server

I hadn't considered installing the server kernel into the desktop system at some point after installation; good idea.

Re:One of two routes....

[reiisi]

You missed the other times I posted because they were in other subthreads, and not in reply to your posts.

Gems? opinions are like armpits. Everyone has at least two, and they all smell but your own. You don't like my "gems", well, it's no sweat off my back. I wasn't talking to you.

But why do you think trojans in a LAMP server are no big deal? That assertion kind of dilutes your optimism, you know.

I guess you didn't miss all of my posts if you saw my suggestion about openbsd. But you seem to have missed that in the post in which I was not joking, I was suggesting it as a way to study the command line when one has more time. Oh, well. Not helpful to you, I see. But I wasn't talking to you, so, whatever suits you there is fine by me.

But ssl is by no means equivalent to ssh. https and ssh are completely different beasts. https is particularly undermined by the clot of certificates, and all the add-ons that run in your browser. (I assume you weren't meaning that you should use lynx to access webmin?) And, did you notice the conversations recently about the way browsers are handling the block cipher initializations? ssh has no issues there.

Thus, if one really needs the hand-holding, webmin really should be open only to localhost.

If you are going to be as casual about trojans and differences in vulnerability levels as you indicate, please refrain from putiing more servers up on the open web.

Re:One of two routes....

[danzvash]

The points you make are quite valid - it's just that they had nothing really to do with the topic at hand.

A Linux newbie wanted an introduction to LAMP serving with an easy-to-use distro that would let him set up a hobby project. He specifically stated that he didn't want to use much CLI. (My personal preference is to use CLI with everything - but I totally respect the inclinations of others not to do so - other people don't necessarily share my priorities, and why should they?)

He is also unlikely to be running a mission-critical service with critical security requirements: following the generally accepted set of guidelines will provide a reasonable level of security.

I'd love if you could give examples of how easily he could be compromised by trojans on his newly-minted LAMP server. I suspect you are talking about marginal cases - which again takes us out of the area of relevance.

Re the insecurity of HTTPS ... If he is concerned about possible man-in-the-middle attacks on his hobby LAMP server (though I think we're heading into paranoia-level security here) then he can generate his own certificates/have them signed/etc. Yes, the browser provides more holes .... Does this mean that you would like to lock down his new LAMP server so that no browsers can talk to it?
Or does he have to communicate exclusively to his server via SSH tunnels?

By the way, do you ever buy anything online? As in, do you occasionally use HTTPS connections to supply credit card details?
Or do you live in a concrete basement, with a tin-foil hat, and do your shopping by mailing out cheques?
HTTPS works in the real world and will serve this man's purpose fine for running a webmin console.

Re OpenBSD - while I have all the time in the world for projects such as the *BSD, they have ABSOLUTELY no relevance to the poster or what he's trying to do. Again - he wants an introduction to LAMP serving on Linux, with minimal CLI to get him up and running. How helpful is it to people like him to have answers from security freaks saying, "You should really check out OpenBSD, and learn the CLI!"

That's not the kind of message that the Linux/Open-source community should be sending out to curious newcomers: "You're a long way from achieving anything, because you have to learn this huge mountain of marginally-relevant technical information to achieve your reasonable goals".

And I have put plenty of servers up on the open web and have never been compromised. So, thanks for the polite suggestion, but it's really my business how paranoid I choose to be.

Obvious: Use a hoster.

[Doctor O]

The solution is obvious - just use some $1/month hosting company and spare yourself the stress of managing something you don't (want to?) understand and the embarassment of 2500 people seeing you fail.

Not being rude, just not understanding why you would want to do that. Oh, and I'd rather go with a minimal FreeBSD installation with added Apache, PHP and MySQL instead, but that's purely CLI and therefore not what you want, plus it's not Linux. But I've used FreeBSD as web servers for more than a decade and am really impressed with the security and uptime.

TurnKey Linux plus VMWare plus WinSCP

[Beeftopia]

1) Check out TurnkeyLinux for pre-assembled Linux virtual machines.

2) Download the free VMware player from VMware.

3) Start the VMWare player and open the virtual machine on your windows box.

4) Hack away.

This is a very effective solution. I used WinSCP and notepad++ with this setup to create a sophisticated database-driven website. There are web hosts out there who will host your virtual machine.

Not a good idea

[93 Escort Wagon]

You have no experience with Linux, and given the question you're asking you likely have no experience with either PHP or MySQL. Trying to learn on the job with a public-facing server running this software is a bad idea. PHP-based forum packages routinely have security holes, as does the language itself - and you're going to give it access to a MySQL server? You're gonna get owned pretty quickly.

I really think a better solution for you is paying a hosting company to do this. They've got experience, and if things break - it's their problem to fix. Otherwise, get ready for your next Slashdot submission - "Hackers keep getting into my system and I can't keep them out".

Re:2500 users? Not really (3)

[thirdwikidotorg]

effect until cannonical which was originally a manx company (as of 1996) .

Dude, the guy's a genius. Is no-one else going to at least comment of the mastery of this guys rip on a wiki's way of tinkin' ??

OpenSuse

[DragonTHC]

This is exactly what you need. ignore all the tech speak and nerd lingo.

http://www.opensuse.org/en/

ABSOLUTELY Go Hosted

[SethJohnson]

I used to host my own server for a small user community. I found myself burning up dozens of hours at a go dealing with annoying and basic administration responsiblities when I really wanted to work on higher-level stuff like performance-tuning and content management. Hackers were an ongoing threat to my free time.

You can rationalize away all of this and intend to just do things right from the start.You're going to eventually get hacked in some way. This isn't your primary job, so eventually a vulnerability will arise in one of your web apps and it's going to get exploited on your server. What's your backup strategy? Are you going to want to reformat the hard drive, reinstall the OS, and roll the database back to a recent snapshot prior to the break-in?

Let the administration be the hosting provider's headache. With a company like Dreamhost, if your web app becomes compromised, you can roll back the database and filesystem to backups taken hourly, daily, weekly, and monthly. Your site will be up within minutes and then you can work on patching.

Seth

Re:MySQL is SO much easier to maintain

[geminidomino]

Oh, you know... Postgres was always yelling at him for stupid little things like passing invalid dates or breaking constraints and stuff.

By switching to mysql, he got all those errors, warnings, and notices to go away, with the simple little tradeoff having date fields full of 0000-00-00

Some supporting info RE:parent post

[znerk]

TL;DR: commandline-only interface on the server is fine, since you won't be administering the server locally in most cases.
To implement: "sudo apt-get install webmin sshd knockd", then read the documentation and edit/create your configuration files.

Webmin is a useful tool for "avoiding the command line"; it gives you a browser-based interface to many common server systems and tools.

Between webmin and SAMBA, you can avoid the CLI for many common tasks, if that truly is your goal.

On the other hand, if you're serious about administering your server, you'll just bite the bullet and learn the handful of commands you'll need on the CLI to do the things you need to do, and read the man pages for ssh ("Secure SHell", a remotely accessible command-line interface using cryptographic security measures).

Implement port-knocking (Google "knockd"), use a non-standard SSH port, and implement certificate-based security to simplify your security concerns and keep the bots from being able to crack your sshd.

None of my servers have anything attached except power and network, unless/until there is a reason to interact directly with them - remote administration is the way to go.

Re:Some supporting info RE:parent post

[bhcompy]

It's not that I want to avoid the CLI, but I'd rather ease my way into it rather than be forced to utilize it for everything from the get-go, and I understand about remote administration, but in this case it's not a server in some rack, it's under my desk next to my main tower. Thank you for the information, nevertheless. The tools do sound like what I am looking for to ease myself in.

Re:Some supporting info RE:parent post

[znerk]

Regardless of whether it's a server in a rack in some datacenter somewhere, or a re-purposed PC in your living room, the concepts are sound. Also, if you are already familiar with securely accessing the system remotely, you won't have to learn a whole new set of commands and procedures if/when you decide to go with a hosting service and/or move to the cloud.

Re:Some supporting info RE:parent post

[tehcyder]

To implement: "sudo apt-get install webmin sshd knockd", then read the documentation and edit/create your configuration files.

Pretty much the classic Linux response to any query. Hint: if the questioner is used to GUI Windows systems, that is about as much use as saying "download Linux, Apache, MySQL and PHP source code, compile, and read the documentation."

Friends

[dnewt]

You have 2500 'friends'? Do you know them all by name?

If you want to admin, learn the CLI

[msobkow]

The simple fact of the matter is that if you just want to use Linux as a desktop, all the distributios provide some sort of GUI interface for doing the basics of system configuration.

But if you're running a server, you are going to HAVE to get down to the CLI and edit configuration files, install software, test startup scripts, etc. At least SOME knowledge is required to run a server, and if you're not willing to learn, you're just wasting everyone's time -- your's, your potential user's, and whoever tries to help you along the way. Buckle up and stop whining about needing to use the CLI.

Re:If you want to admin, learn the CLI

[nzac]

I take it you have not used Yast. Though i am well aware not everything can be done YaST is a bit more extensive than other distros.

Yast is cross between a GUI and a config file wizard you can set/append the same options. I would think a basic server is entirely possible with yast with remote admin though the ncurses/screen interface (dont know what it uses but you don't need X).

Desktop x server kernel

[marcosdumay]

The difference between a server and a desktop kernel is the way all those questions you get when running "make menuconfig" are answered.

A few important (on my opinion) differences are the way the scheduler is optimized (to throuput instead of lantency) and the default stack size. In old times the desktop kernel normaly missed SMP, but those days are gone now.

nooooo! Not webmin!

[reiisi]

Wanted to do that in caps, but shouting is considered gauche here even when appropriate.

Please, no encouraging webmin.

I mean, I suppose they may have completely re-written it in the last eight years since I last had to work with it, but I don't think so.

Re:nooooo! Not webmin!

[smpoole7]

Actually, Webmin has been improved considerably. I use CentOS and OpenSuSE almost exclusively and on the Cent boxes, I install Webmin first thing. It makes maintaining a firewall, just to name one, a million times easier.

The second thing I do is write a script that tells my associates NOT to use the "system-config-securitylevel" tools because it will open some ports by default that really ought not to be exposed to the Internet. (CUPS comes to mind.)

(No, I'm not kidding. CentOS 6/RHEL 6 may have fixed this, but in Cent 5, as soon as you activate the firewall, it opens up CUPS and a couple of things. I first discovered this a couple of years ago when I did my usual routine NMAP check of a new server, just to see what it was exposing to the Internet. I almost fell out.)

Re:nooooo! Not webmin!

[crutchy]

my default vhost (returns 403) gets barraged by bots/hackers attempting to find what appear to be possible webmin exploits, along with phpbb, phpmyadmin, etc.

nice management interfaces are good to learn with inside a lan, but make sure you bone up on the art of server hardening before opening your router ports

Re:Tell me why oh why ubuntu ouch

[znerk]

An interesting (although completely wrong) viewpoint.

Nothing against you personally, but I find that people who spew party lines (such as "Ubuntu: an African word meaning (insert implication that user is retarded)") tend to have little or no experience with the distro itself, and are merely parroting information they picked up in some snarky forum in an attempt to appear to be somehow better than "the rest of the rabble".

That said, the Ubuntu forums are huge, bloated with reported issues because many desktop users (read: Windows-only users who wish to learn about their options) have been pointed at Ubuntu as an easy learning curve. On the other hand, how many of those problems go unsolved? The user base is large, but this means that solutions crop up almost as quickly as issues are brought to their attention.

A large amount of users engenders new potential issues that RTFM-shouting elitist assholes have no idea how to cope with, because only 6 or 7 people have managed to actually find and use their specific and precise (or home-rolled) distro of choice, so they have no idea how to support a larger user base, and are threatened if someone suggests there might be any issues whatsoever with their "perfect" platform.

In other news, when complaining that a specific solution is inappropriate, it is customary to offer a more appropriate solution; typically with supporting information as to why your preferred solution is better suited to a particular purpose.

Oh, and to bring you up-to-date: the distro flamewars died out several years ago. If you're going to troll, at least try to stay current and relevant.

Turnkey linux

[nurb432]

its based on Debian so its 'standard' in case you want to expand or need help, and will setup a lamp server with just a few simple questions like what admin password you want. It does all the hard work for you.

It also installs GUI tools to manage the thing.

webmin?

[reiisi]

I suppose I get too excited about things like webmin, and i haven't worked with it in something like eight years, but I'm going to warn you anyway.

Tools like webmin are just wrong in principle.

First, they expose way too much of the administration interface to the vagueries of ssl. (Thankfully, they usually at least give you that these days). You did notice the flap about the BEAST attack on chained block ciphers recently? (MSWindows tools also vulnerable, to the extent it's an issue.)

Don't confuse SSL with SSH, by the way.

Second, they hide the real tools from you. If you want to learn Linux/Unix tools, you don't want tools like webmin hiding the tools you want to learn from you.

Third, as many have said already, don't fear the command line. It really is your friend. Sure, the GUI tools show you the most used commands and options with a lot less excess information than the man pages. But you really want to learn to use the man pages, because sometimes the options you need aren't in the GUI interface. Searching the web is also necessary in many cases, whether you use the GUI stuff or not.

Well, I suppose I won't convince you.

Whether you use webmin and its ilk^H^H^H like or not, you really want at least one other machine for this project, for practice and backup.

If you do use the same machine for practice and backup, you probably want a detachable drive to keep the backup on. USB is okay, but don't try to just copy stuff onto VFAT or NTFS formatted USB drives. If you don't use a *nix format like ext3, you must at least pack up your archives with tar, so that permissions and stuff can be retained. ("man tar". And check the options for the ACLs if you use those.)

Practicing/designing on a machine that is not the live server is a good idea whatever OS you use, of course, but especially when you are learning a new OS/environment.

Which kind of brings me back to the command line. You are going to be doing remote work. You are going to be using ssh. You can tunnel an X session over ssh, but there's a kind of chicken-and-egg problem there, since you end up using command-line tools to set the tunnel up.

Don't fear the command line. Just get a practice server and make lots of mistakes on it. Problems solve themselves that way.

Re:webmin?

[bhcompy]

It's not convincing I need, I know I need to learn it. It's more about what's prudent given the timeframe. I'll pick up stuff as I need to, but I also have a timeline to implement things. I want to learn, I will learn, but I can't master it before I implement it

Re:webmin?

[reiisi]

Well, you've been warned.

You might have missed this reply to my angst up a bit in a different sub-thread. Something to consider, the hidden assumptions and the defaults that tend not to match what you plan to do.

Anyway, do go to the effort of procuring a server to make your first messes in, separate from the production server. Maybe even arrange for a VM on your workstation, and disk space to hold the VM and what you do in it. If it's worth doing, it's worth doing at least that much. And don't let webmin lull you to sleep about the command line. (It's a real danger, despite best intentions now.)

Re:webmin?

[znerk]

I love the services that fail to function from a "clean install", and scream about it in the logs (and on boot) - forcing you to locate the conf file and actually set it up in the first place before it will do a single thing it's supposed to.

I also love how those services' conf files tend to have comments like "don't touch this line if you don't know exactly what you're doing", or "for security's sake, you may want to set this variable to x". Head-scratchers in the conf files make you find the man pages.

Oh, and I actually agree with you on the webmin/virtualmin thing - I don't usually use them, myself, because I find the command line to be much more efficient and effective at doing exactly what I intend - no more, no less.

Re:Tell me why oh why ubuntu ouch

[uvajed_ekil]

Translation: "WAAAAAHHHH! I have nothing to add, but I HATE Ubuntu for no good reason, and I like to type poorly and swear! And I'm pissed-off because my mom doesn't have dinner ready yet. Sorry for being a rebel, like Pepsi drinkers, or Avril Lavigne. Ubuntu SUCKS, and I'm MAAAADDD!"

sudo is not su

[reiisi]

It takes some effort, sure, but you don't have to give out the root password with sudo. In fact, you can disable root logins with sudo.

Sure, it's a bit of a pain to be typing your admin user password every five minutes or whatever you set that to, and the real superusers are going to tend to "sudo sh" or such. But you can set up non-superusers with permission to do things like backups and, gasp, rebooting. And you can set them up so they can't easily type "sudo sh" and get root.

HIDS that server!

[Matey-O]

Whatever you used, install AND CONFIGURE OSSEC.
http://www.ossec.net/

That way you have some kind of indication when the box gets hacked.

Just go shared hosting

[Dynedain]

2500 users are "some of my friends"???

As someone who does this professionally, what you want to do is incredibly simple. Trust me in that you don't want to be doing maintenance and management of the hardware and OS yourself. Instead, just get a shared hosting account. It's cheap and will give you everything you need to do phpBB and MySQL. I'd recommend BlueHost for starters. They give you Plesk as the management tool (CLI available upon request) and it's only $6/month.

Once you grow beyond the capabilities of the shared hosting (not likely if this is truly for a group of friends) then you can switch over to Amazon's EC or another suitable cloud provider for the same tools, but the capability to scale your resources and manage the cost.

For what you've described, the flavor of Linux doesn't really matter at all. You'll save yourself a lot of headaches if you aren't the one responsible for the physical hardware and OS configuration.

Debian Stable

[Trogre]

I may get flamed by the Ubuntu/Fedora crowd for this, but for servers I use and recommend Debian stable.

There are two major reasons for this: great support and things don't change unexpectedly. Because of its long release cycle you rarely see the latest and greatest versions of anything in the repos, but if anything mission-critical is needed these can be installed manually. Some recent python libraries or Firefox builds come to mind. See http://bugs.debian.org/release-critical/ for a graphical view of recent Debian releases.

The current Stable release ("Squeeze") meets your MySQL and PHP version requirements (5.1 and 5.3.3 respectively).

Re:Debian Stable

[thatkid_2002]

What you say also applies to CentOS. I use both on servers. I think it is easier to strip Debain down to 20MB RAM usage (without services) so I use it on small machines, but I use CentOS for ease of configuration.

Re:Debian Stable

[Trogre]

That is true, and CentOS comes with the useful 389 LDAP Directory Server.

However I do worry about the future of such projects since it is maintained primarily by a single person (who has recently returned after a period AWOL). I realise this isn't 100% representative since most public RHEL support information on the web also applies to CentOS.

Re:Debian Stable

[Billly Gates]

Not at all. Hell Ubuntu is flakey for regular desktops. CentOS is what I would prefer with servers and I prefer Fedora (more stable) over Ubuntu. However, I would not run any production machine on it with CentOS around.

Re:Debian Stable

[TemporalBeing]

I'll third.

Debian has one of the best package managers (RPM is crap), and the installation is absolutely easy to do.

I'd keep away from Ubuntu for servers, namely because they're more end-user focused. However, if you have some hardware that needs none-FLOSS supported stuff, then Ubuntu may be the way to go as they do put more proprietary stuff in to resolve that - but that shouldn't be an issue with a true server as most support Linux out-of-the-box to start with.

Re:Debian Stable

[AdamWill]

well, since CentOS is a fairly close RHEL clone, even if CentOS goes down the tubes, it should be pretty damn trivial to migrate the system to any of the *other* close RHEL clones. Or, you know RHEL. That's kinda the point, I guess.

(and to OP, I can't see anyone from the 'Ubuntu / Fedora crowd' would flame you for that; it's perfectly sensible to choose a long-term supported distro for a fairly boring PHP server installation. I run my servers on Fedora, but I wouldn't tell anyone else to.)

correction/clarification

[znerk]

The paragraph in my above post that starts "As for firing up dd on the raw device" should have included "on a currently active system" for the rest of that paragraph to be valid and make sense.

Re:correction/clarification

[dr2chase]

USB key sounds interesting. The reason for the backup is that the (small, old) system disk is is starting to vomit out correctable errors at a good pace. I want to retire it.

an easy way...

[odirex]

Turnkey Linux: http://www.turnkeylinux.org/ I know roughly nothing about linux and have used this to set up a few servers. It's based on ubuntu server and has a nice web-based management interface.

Re:Mandriva

[hduff]

Also excellent at having a gay-sounding name.

Blame the lawyers and the French . Mandrake sounded very cool, but a lawsuit was threatened . Then they bought Connectiva. They should have bought a better name.

But LibreOffice makes them look smart by comparison.

Turnkey Linux

[Anonymous Coward]

If you want easy, quick, and simple, give Turnkey Linux a go, when I need a quick system up and running I tend to use one of these... then, prepare the "production" system afterwards. However, in a few cases I have ran these images as the production system with no problems.

http://www.turnkeylinux.org/lampstack

Keep it simple: CentOS.

[thatkid_2002]

With CentOS you get stability (Debian too, but *forget* Ubuntu) and friendly tools to help you configure your server. There are lots of recommendations for Virtualmin however I would discourage you from using this because it is full of vulnerabilities and does very little to educate you on how your server works. If you really want something like Virtualmin maybe look into an alernative like ISPconfig.

CentOS (and Debian) also both have mature and experienced communities who can help you. (Ubuntu community just suggests ugly hacks).

In CentOS (or any Red Hat based distro) you get the system-config-[blah] tools which give you friendly interfaces for the GUI, TUI and CLI and also I find the chkconfig tool useful (rcconf is similar to this in Debian). The command line takes all of half a day to learn and it is ofen the quickest and easiest way to get around and in my experience it avoids a *lot* of headaches that graphical/web based tools give you.

SELinux (blocks naughty behavior of programs) also comes with CentOS by default which is important for locking down your server. SELinux can be frustrating to learn however if you're only running a web stack you're rarely going to get into trouble with it (occasionally if you move files around their context can cause trouble in their new location) and when somebody exploits PHP or Apache it can really stop the spread of the damage.

My biggest piece of advice is to set up a few virtual machines and have a play. Make mistakes in tesing, not production. Also, if it smells like a dodgy way of doing things, it probably is.

Re:Fedora or RHEL/CentOS ... iff ...

[reiisi]

Fedora is good for this if and only if one can deal with the 6 month system release cycle.

Used well, the cycle can help push the development of the site. But if you get under the wave, that cycle can get torrid.

Re: discoverability

[reiisi]

Part of learning the CLI is learning how to use man pages, including the apropos (or man -k) command.

Another part is learning to search the web, but that's true of the GUI stuff, too.

openbsd

[reiisi]

heh.

bhcompy -- I'm kidding about openbsd as a real option at this point.

But when you get this project settled in a bit, take a look at it. Good place to practice CLI when you're ready, and learn basics about X11 when your ready for that. Fun times.

Slashdot got it wrong

[w1z4rd]

Slashdot got it wrong. The easiest LAMP server to setup is not Ubuntu, its not SuSe and its not Debian. Its ClearOS. Its very easy for a noob to configure. Has a nice web browser based configuration panel and is piss easy to setup.

Webmin Won't Help Much for a Newbie

[haulbag]

If the poster has no experience with administering Linux, Apache, PHP, and MySQL, what good does Webmin do? Webmin is only user friendly to those who know what they are doing already. There are no really good explanations for anything in Webmin, so they would all be confusing to a Newbie.

If you want to start with something that is pretty automated, check out the XAMPP project for Windows.

If you are planning on using LAMP (instead of WAMP), I would suggest just using some of the awesome tutorials out there. They will pretty much walk you through every step. If you use Ubuntu Server, either install Apache, PHP, and MySQL during the server install, or learn to use something simple like apt-get. The basic command is: "apt-get install apache2 php-5 mysql-server" and almost everything is configured for you. Or, if you want to use something like Drupal 6 for your forum, you could just issue the command "apt-get install drupal6" and all of the other stuff should be installed for you (I say should because I have never done it that way). If you want to stick with phpbb, just issue the command "apt-get install phpbb3" and it will be installed with all of the dependent programs.

Most of the tutorials will walk you through exactly what commands to issue. If you go to Linux.org you can take a basic tutorial on how to use the CLI. The Apache site has pretty good documentation for most things that you'll need to configure the Web server. If you're going to just put one site on the machine, the basic Apache server setup is already installed by Ubuntu. You just have to start placing your Web pages into /var/www/ and possibly configuring a few settings in your php.ini file at /etc/php5/apache2/php.ini to enlarge maximum file sizes, timeouts, etc. If you install phpmyadmin (apt-get install phpmyadmin), you can easily create the MySQL database and the database user and password needed for your installation.

When learning Linux, using the man pages and the "locate" command to find stuff is very helpful. Just remember to run the "updatedb" command to create or update the list of files and folders for the locate command. You can pretty much Google for anything you need help with, and you should be able to figure things out.

Or try using a hosting company with all this stuff already in place. Lots of them provide scripts that automate the basic install of everything. Once you get your feet wet, you can try installing it all from scratch, but that isn't really necessary at the beginning.

Repository with the latest AMP versions

[jcborro]

The best distro for LAMP would be one with a repository that keeps up with the latest stable Apache, MySQL & PHP. So instead of getting whatever versions happened to be current at the time of the distro release, you could actually regularly apply AMP bug fixes and security patches.

Unfortunately I don't know of such a repository for any distro. Maybe someone else does?

A newbe doesnt set up a 2500 user server. Period.

[Foske]

So if I understand you correctly you want to play around with Linux and think a 2500 user server is a nice playground ? Please mail me your CV, I'll make sure you never get hired by my employer...

uberspace.de: CentOS LAMPs from 1€/month, 1st

[D4C5CE]

not commercial, more of a personal side project for some friends. I've no experience configuring or administering a Linux server

Don't go it all on your own then. At the risk of sounding a bit like an advertisement, for the sake of brevity:
If you can read German, that's a host to be seen: fully documented configuration, minimal GUI, ssh account at one click without much of an appetite for personal information, avidly blogging webmaster, domains at just 5€ for registration and 50 cents extra/month.
They would appreciate a monthly 5-10€ contribution after the free trial month, but let you start as low as 1€ if you're on a budget.
Haven't found that kind of feature set lately (since hosting at French altern.org was lawyered out of existence more than a decade ago actually) at such a price point, let alone in English - is there any other host like this these days?

Take a Linux course or get a Mac

[gig]

Those are your only rational choices. Either invest the time in learning Linux so you can take advantage of Linux, or invest the money in a Mac so you can take advantage of the Mac. If you have more time than money, use Linux; if you have more money than time, use a Mac. The only work you will have to do with the Mac is the actual writing of the code. There will not be any configuration to do at all.

Another vote for Debian

[drinkypoo]

First, let me just say that since you're in a Windows environment, if you just want to play around with LAMP the easiest way to get started is to grab a LAMP appliance for vmware player and run it.

That out of the way, whether you're using a physical machine or not, I think you should run Debian. You will be able to find lots of help, because the solutions for Ubuntu will apply to your system as well (For problems with the LAMP stack, anyway.) But meanwhile, you will have a relatively simple system; I'm not especially pleased with some of the added complexity in recent versions of Debian, but you are unlikely to have to mess with any of it for the scope of your problem anyway.

There *is* merit to running an Ubuntu server, mostly that sometimes you find great stuff in PPAs and you don't have to go building it yourself. Sometimes, getting software to build is an epic journey. When I have found it to be so, I have sometimes packaged it and put it up on my PPA. Some of those things are now part of Ubuntu, although I don't think they bothered to use the packages I produced. There is a great tendency for people to reinvent the wheel over at Ubuntu so that they can get all the credit. Cue the violins.

Problem is, when you install Ubuntu you get a lot of junk. So I install Ubuntu with debootstrap, from a functioning Linux system. You probably don't want to figure that out right now. So just install debian and follow along. Once you log in you can just install the packages. An article from 1996 described the process with php4, but you could use its advice on finding packages to find the ones you're looking for. (I don't have any debian systems booted right now, sorry.)

Re:Another vote for Debian

[G3ckoG33k]

This link you provided ended up as:

      [debian-adm...ration.org]

which I assume would be something other than [debian-admiration.org]! ;)

Re:Another vote for Debian

[jafac]

Nope. Easiest is Cygwin.

Re:Another vote for Debian

[drinkypoo]

I've used Cygwin for many years and it is a lemon compared to a real Linux system. If you ever end up having to build some software there is a very good chance it won't build at all without help that most users won't be able to give. Performance also suffers. You can get much better results with Debian running with colinux.

Good Resources on CentOS

[adumonit]

Any recommended good Books & Resources?

Start at the right level

[Bltann]

Use Xampp or any turnkey local solution for starters and testing. From there i recommend ClearOs ( http://www.clearfoundation.com/ ) to run and experiment. If you need an even easier solution i'd say you go for hosted. There are tons of good virtual server or reseller deals if you want to have some freedom but even easier is a plain webhosting account. Still you should be prepared to do a lot of research and read some forums.

CentOS

[whitroth]

I'm running CentOS on my workstation at work (and at home), and 90% of our close-to-200 servers and workstations are, also. We're slowly rolling out 6.0 (and waiting for 6.1), but I just checked, and I think everyone has mysql 5.x, and CentOS 6 also has php 5.3.2-6 (spare me the "that's soooo ooooollllld", kiddies). It's *solid* (exactly equivalent to RHEL) - you're not going to waste time debugging the o/s, and I've almost *never* had an update that broke anything.

                mark

Get some experience

[WillgasM]

I've set up a few LAMP/WAMP stacks recently. I began with almost no web experience (other than writing HTML back in high school), but a fairly broad knowledge of nix/win administration. I recommend starting with some small project. I began with out of the box blogs, forums, intranets, etc. You can re-purpose some POS from your closet, or try some of the virtual environments. I started with WAMP since I thought it would be easier, but after tinkering around, I actually prefer linux. I've also found MySQL easy and adequate for just about everything I've had to do. Play around and you'll find your preferences along the way. Just sharpen your google-fu and dive right in on something. I've actually found it quite surprising how incredibly easy it was to set up some projects, and how little kinks can turn a simple project into a mess. Also, look into hosting solutions. Most come with SQL and many of your PHP apps come with fairly idiot-proof installers.

Ubuntu 10.04 (LTS), Centos6 or Scientific Linux6

[wolgamot]

I agree Virtualmin GPL or Virtualmin Pro.
Fantastic community support as well as professional support from the Developers.
I started on Webmin years ago. It was so helpful I finally bought Virtualmin Pro 50 server license.

I use the latest Ubuntu 11.04 as my daily system however on a server I use Centos because of it's Long Term Support (LTS).

Ubuntu 10.04 (LTS) is a rock solid server as well.

I just prefer Centos and Scientific Linux because they are based on Redhat Enterprise binaries and I grew up on Redhat so it is just easier for me.

INSTALL a Linux DESKTOP install.
Don't do the server install because the Virtualmin install.sh script downloads, installs and configures everything using the Virtualmin repositories.

You can do it with a minimal install that gives you only a shell to start but I like to start with a minimal Desktop install for convenience.

Go to http://www.webmin.com/vinstall.html [webmin.com] and download the install.sh script.
bring up the shell terminal and execute the 2 commands they give on the above page
I just tested it yesterday on the new Centos6 and it did the setup flawlessly.

After it completes the install you'll be able to examine how they setup everything in the server.

You may want to test it on Scientific Linux as it is based on Redhat Enterprise.
http://www.scientificlinux.org/ [scientificlinux.org]

I use ubuntu 11.04 on my desktop but I use Centos5.3 on my servers and am now in the process of upgrading to Scientific Linux6 which in essence is Centos6 or Redhat Enterprise6

There is a debate about Centos kind of dragging their feet and many are switching to Scientific Linux since it is looking to be aggressively maintained.

Read this post.
http://www.virtualmin.com/node/17463#comment-80722 [virtualmin.com]
For some reason the post link in the drupal forums would not link to the one I wanted however if you search the above link thread for Posted: Wed, 2011-05-04 14:51
and read from there, it may cause you to try scientific Linux.

You have to be root for the script to install the system. Centos already has the Root user enabled.

In Ubuntu, you'll need to temporarily enable the root user, then disable it after Virtualmin installs.

I suggest Centos6 for your first test because I know the install.sh script worked OK on it. I'll assume it will work in Scientific Linux since the binaries are the same as Centos or Redhat Enterprise.

I think, Joe at Virtualmin mentioned they are going to switch from Centos to Scientific Linux for their servers.

http://www.virtualmin.com/os-support [virtualmin.com]

Virtualmin GPL Supported Systems
The automated installation script supports the following operating systems:

CentOS 5 and 6 on i386 and x86_64
RHEL 5 and 6 on i386 and x86_64
Scientific Linux 6 on i386 and x86_64
Debian 5.0 and 6.0 on i386 and amd64
Ubuntu 8.04 LTS and 10.04 LTS on i386 and amd64

All Virtualmin GPL supported systems are considered "Grade A" and provide an excellent platform for virtual hosting

* * * *

Here is a little background to try and convince you to give Virtualmin a try.

You're in for a wild ride being new to LAMP servers. Running a Linux server is an addictive experience. A blessing and a curse ;-)

In 2002 on Redhat 7.3. I hired a friend, Lee Bertagnolli, to help me get my first server going. He setup the server manually.

I couldn't follow all he did at the time. I was an ultra Linux noob

turnkey linux

[cpgeek]

I would strongly suggest turnkeylinux as a great preconfigured LAMP server that is based upon the current LTS version of ubuntu. it's easy to set up and use, features webmin for general administration which is pretty nice, and it's super easy to roll out... I often use this for virtual machine or vps web hosting accounts due to it's easy setup and preconfigured LAMP environment... there's not a whole lot to go wrong, and it's really easy to use.

reading ...

[reiisi]

I guess I've read his comments differenty than you.

The way I see it, he wants a quick startup now, and he wants to study the real stuff, explicitly including the cli, later. That's why I made the comments about openbsd -- as something to do later. And you can't deny that openbsd is a good way to learn who to work things from the cli.

Yeah, there are differences between the several BSDs and the several Linux distros, but the differences are instructive. (BTW, I don't recall having suggested openbsd for security purposes in this article. I do remember having mentioned it in connection with learning the cli.)

Hobby project? 2500 users, whether that's 2500 users who will be using it every day or 2500 users that may use it once a month or less, is not a hobby project. 2500 may not be 25000, but it's still enough users to attract attention from people interested in using the server for their own purposes.

Ten users is a hobby project. That's also a good number to target while he's bringing up the system prototype, which he should do on one box, before he brings up the production system on another.

I'm not talking paranoia. If I were talking paranoia, I'd be suggesting openbsd on custom firewalls and separate servers for each function, at minimum.

But with 2500 users, he does need a dev function and a backup function, and he does need to put a security plan in place, and webmin is not a security plan.

Once he has experience, maybe he can wing it, but not while he's trying to find his way around.

Your anecdotes? Maybe you've been lucky. Maybe you only think you have been lucky. I have no way to know which from here.

Maybe you've been using webmin long enough to get away with what you are bragging about. The current version of webmin may be securable if you know what you are doing. But if you don't realize you are bragging, that's a problem, too.

Uhm, using your own certs can cover some problems, but it doesn't address the primary issues.

I don't want to be too obnoxious, but you do have a schedule to go back and check all those servers you have deployed periodically, right? Some sort of canary or tripwire in place, checksums of some sort on the executables exposed to the web, etc.?