LiteSpeed Fundamentals

If you are new to Linux, it's important that you complete this section of the course. The Essential Skills section will teach you the beginner Linux skills you need to complete this course and start self hosting your WordPress site successfully.

This lecture looks at Linux distributions and how they relate to this course.

You are going to be using "terminal" to configure your server, so it's important that you understand what a terminal emulator is and more importantly, how it is used to administer a server.

In this lecture you are going to start using terminal, its important that you familiarize yourself with the terminal window layout.

Understanding the Linux file system lays the groundwork for later aspects of the course. Equally important is the skill to navigate the file system.

Understanding what is meant by users and groups in Linux and how they relate to ownership and permissions is very important.

Ensuring that the correct ownership and permissions are set correctly on files and directories is the first step in hardening your server and your web application. In the course we will set the ownership and permissions based on the WordPress codex and the principle of least privilege.

We are going to be using the built in editor Nano to edit various configuration files, so it's important for you to be able to use Nano correctly. We are also going to look at configuration file layout in this lecture.

This lecture deals with how you install software on your server. You make use of the Package Manager to install packages - software - from the official Ubuntu repository on your server.  Using the package manager is almost like using a mobile app store.

In this lecture we will look at the Server Fingerprint, which ensures you don't fall victim to a "Man in the Middle" attack. We'll also look at ssh key authentication, which allows for "passwordless" server logins.

In this lecture we look at automating commands using bash scripts. We also look at the built in scheduler, CRON. CRON will be used to automatically renew our SSL certificates.

This lecture also concludes the Essential Skills Section of the course.

Your journey to self hosting WordPress sites starts here. You are going to create a server instance and start the process of configuring your server.  No support from your host is required, the course covers everything you need to know.

Initially, you will login to your server as the ROOT or Administrative user and start the process of configuring your server. Working as the root user can be "dangerous", so after completing a few configuration steps, we will create a new user and login as the new user. We will also block the root user from logging in.

You will continue configuring the server, as a non root user.

You will not login using a password, but rather using ssh key authentication. In this lecture you will configure ssh key authentication and login using ssh key authentication.

A config file allows you to login to a server by typing the command an an alias, no complicated commands to remember. Quick and easy server login using a "config" file.

From a security aspect, it's important that the packages - software - installed on your server is kept up to date. This lecture looks at the update process.

The firewall is the most important step in server hardening. We will use the following policy: lock everything down and only open what's needed for the server to function without issue. We will look at enabling a firewall policy on the server and also enable a "cloud" firewall that will stop attacks before they even reach your server.

Brute force attacks are an everyday occurrence when administering your own servers. Fail2Ban stops brute force attacks by banning the offending IP address.  This requires no interaction on your part, setup Fail2Ban and it will "protect" your server from brute force attacks.

In this section we are going to further harden the server as well as start to optimize the operating system to help us squeeze every bit of performance we can get out of the server. You cannot tune LiteSpeed for performance and security without first tuning the server operating system for performance and security

As the /run/shm space can be exploited we need to secure this space in shared memory

: The TCP/IP stack default configuration needs to be hardened.

We'll set the timezone to your local time

The TCP/IP stack default configuration needs to be optimized.

We are going to install Tuned. Tuned is a profile-based system tuning tool that enables both static and dynamic tuning of system settings.

For a performance boost, we are going to disable the filesystem from keeping track of the last time a file was accessed or read

In the event of your server running out of memory, it can make use a ssd space as virtual memory. SWAP is to help prevent your server crashing in the event you run out of memory.

By default, the maximum number of open files allowed per process is set very low. Since sockets are considered files on a Linux system, this limits the number of concurrent connections as well. We need tom increase the maximum number of open files allowed per process.

In this section we are going to install the LiteSpeed stack. The stack consists of:

• LiteSpeed Web Server - that's the web server we are going to be using

• MariaDB - the database management system

• LSPHP80 - LiteSpeed PHP is an optimized compilation of PHP built to work with LiteSpeed products through the LiteSpeed Server Application Programming Interface.

We'll start off by ensuring that the server packages are updated and that there are no pending reboots due to the updates.

You also need to open port 7080 to access the web admin console. This adds a huge brute force attack target. Your web admin console will constantly be attacked by bots. What we are going to do, is open the port but only to your IP address.

As LiteSpeed is a commercial product the installation process is a little different to installing a package from a repository.

You need to purchase the ALWAYS FREE license. Your license details will be sent to the email address you provided when purchasing the license. Then you download LiteSpeed to your server and install. The process is straight forward and should present no issues.

To configure LiteSpeed you'll use the LiteSpeed Web console. It's much easier using the web console than editing configuration files using nano.

We are going to install MariaDB from the official repositories. After installing MariaDB, we need to harden the default settings, by running the built in MySQL secure installation script.

Further optimization will follow...

We are going to install LiteSpeed PHP. LiteSpeed PHP is an optimized compilation of PHP built to work with LiteSpeed products through the LiteSpeed Server Application Programming Interface (LSAPI)

We need to configure LiteSpeed to process php. Unlike Apache, which has php processing embedded into the application, LiteSpeed is like nginx, where php processing is handed off to an API for processing.

The php.ini file is optimized for the LSWS. As such, very little needs to be changed by us, all we need to do is tweak the settings to help ensure the php environment is better suited to hosting WP sites.

To complete the course, you'll need a domain name. You'll also need to create two DNS records and then point those records to your server.

Configuring a mail server with postfix or sendmail requires a large number of steps to be performed and a careful configuration, due to all the services that need to be configured. Some of the steps include DKIM, SPF, DMARC, Reverse DNS, etc. Mail server administration is a complex, time consuming task and way beyond the scope of this course. Using postfix or sendmail for transactional mail is also not needed.

An easy solution is to make use of MSMTP and a third party mail provider for your mail from the server.

Virtual Hosts are used to host multiple web sites using a single IP address. What that means is you can host multiple web sites on a single server. We are going to create three virtual hosts.

Virtual Hosts are used to host multiple web sites using a single IP address. What that means is you can host multiple web sites on a single server. We are going to create three virtual hosts.

Virtual Hosts are used to host multiple web sites using a single IP address. What that means is you can host multiple web sites on a single server. We are going to create three virtual hosts.

Before installing our WP site, we need to create the database. We will be using a MySQL fork, MariaDB, as our Database Management System.

We won't be installing phpmyadmin for advanced database administration as it's a target for attack. Rather than using phpMyAdmin, I recommend you use a MariaDB client, that is installed locally and not on the server. We'll look into this aspect shortly.

You need to create the database, then, you need to add a database user, give that user a password and give the user privileges on the database. By giving a user privileges, you are giving that database user the right to execute a particular sql statement.

To install a WordPress site, we are going to take the following steps.

Download WordPress  and extract the WP files from the gz file.

You then need to configure .htaccess and wp-config.php, after which you move the files to your virtual hosts root directory.

The last step is the famous 5-minute WordPress install

We are going to install a sub domain WordPress site.

In this section of the course you are going to:

• install free Lets Encrypt SSL certificates for all of your sites

• configure LiteSpeed to obtain an A+ rating for your certificate configuration

• setup automatic renewal of the ssl certificates

• secure the http headers to ensure a safer browsing experience for visitors.

In this section of the course you are going to:

• install free Lets Encrypt SSL certificates for all of your sites

• configure LiteSpeed to obtain an A+ rating for your certificate configuration

• setup automatic renewal of the ssl certificates

• secure the http headers to ensure a safer browsing experience for visitors.

In this section of the course you are going to:

• install free Lets Encrypt SSL certificates for all of your sites

• configure LiteSpeed to obtain an A+ rating for your certificate configuration

• setup automatic renewal of the ssl certificates

• secure the http headers to ensure a safer browsing experience for visitors.