apt-get install mysql-server

apt-get install nginx

apt-get install php5-fpm

安装php相应的支持库

apt-get install php5-fpm php5-cli php5-curl php5-gd mcrypt php5-mcrypt php5-mysql

#下面的只是记录一下

apt-get php5-mysql php5-curl php5-gd php5-intl php-pear php5-imagick php5-imap php5-mcrypt php5-memcache php5-ming php5-ps php5-pspell php5-recode php5-snmp php5-sqlite php5-tidy php5-xmlrpc php5-xsl


nginx的配置的多中版本：

其一：

server {

listen 80 default_server;

listen [::]:80 default_server ipv6only=on;


root /usr/share/nginx/html;

index index.php index.html index.htm;


# Make site accessible from http://localhost/

server_name localhost;


location / {

try_files $uri $uri/ /index.php;

}


location /doc/ {

alias /usr/share/doc/;

autoindex on;

allow 127.0.0.1;

allow ::1;

deny all;

}


#

error_page 500 502 503 504 /50x.html;

location = /50x.html {

root /usr/share/nginx/html;

}


location ~ \.php$ {

# With php5-fpm:

        try_files $uri =404;

fastcgi_pass unix:/var/run/php5-fpm.sock;

fastcgi_index index.php;

include fastcgi_params;

}


# deny access to .htaccess files, if Apache's document root

# concurs with nginx's one

#

location ~ /\.ht {

deny all;

}

}



nginx配置其二：

server {

        listen 80;

        listen [::]:80 default_server ipv6only=on;


        root /usr/share/nginx/html;

        index index.php index.html index.htm;


        # Make site accessible from http://localhost/

        server_name _;


        location / {

                # First attempt to serve request as file, then

                # as directory, then fall back to displaying a 404.

                try_files $uri $uri/ /index.html;

                # Uncomment to enable naxsi on this location

                # include /etc/nginx/naxsi.rules

        }


        location /doc/ {

                alias /usr/share/doc/;

                autoindex on;

                allow 127.0.0.1;

                allow ::1;

                deny all;

        }


        # Only for nginx-naxsi used with nginx-naxsi-ui : process denied requests

        #location /RequestDenied {

        #       proxy_pass http://127.0.0.1:8080;

        #}


        #error_page 404 /404.html;


        # redirect server error pages to the static page /50x.html

        #

        error_page 500 502 503 504 /50x.html;

        location = /50x.html {

                root /usr/share/nginx/html;

        }


        # pass the PHP scripts to FastCGI server listening on 127.0.0.1:9000

        #

        location ~ .php$ {

                try_files $uri =404;

                fastcgi_split_path_info ^(.+.php)(/.+)$;

                # NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini


                # With php5-cgi alone:

                #fastcgi_pass 127.0.0.1:9000;

                # With php5-fpm:

                fastcgi_pass unix:/var/run/php5-fpm.sock;

                fastcgi_index index.php;

                include fastcgi_params;

        }


        # deny access to .htaccess files, if Apache's document root

        # concurs with nginx's one

        #

        location ~ /.ht {

                deny all;

        }

}



nginx配置其三：

server {

listen 80;


server_name example.com;

root /var/www/example.com;


index index.html index.htm index.php;


access_log /var/log/nginx/example.com.access.log;

error_log /var/log/nginx/example.com.error.log;


location = /favicon.ico { log_not_found off; access_log off; }

location = /robots.txt  { log_not_found off; access_log off; }


location ~* .(ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|css|rss|atom|js|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav|bmp|rtf)$ {

expires max; log_not_found off; access_log off;

}


location ~ \.php?$ {

include /etc/nginx/fastcgi_params;

fastcgi_pass php;

}

}


nginx配置其四：

location ~ .php$ {

try_files $uri =404; #增加

fastcgi_split_path_info ^(.+.php)(/.+)$; #反注释

## NOTE: You should have "cgi.fix_pathinfo = 0;" in php.ini

#

## With php5-cgi alone:

# fastcgi_pass 127.0.0.1:9000;

## With php5-fpm:

fastcgi_pass unix:/var/run/php5-fpm.sock; #反注释

fastcgi_index index.php; #反注释

include fastcgi_params; #反注释

}


nginx配置其五：

 location / {

        try_files $uri $uri/ =404;

    }


    error_page 404 /404.html;

    error_page 500 502 503 504 /50x.html;

    location = /50x.html {

        root /usr/share/nginx/html;

    }


    location ~ \.php$ {

        try_files $uri =404;

        fastcgi_split_path_info ^(.+\.php)(/.+)$;

        fastcgi_pass unix:/var/run/php5-fpm.sock;

        fastcgi_index index.php;

        include fastcgi_params;

    }

}


nginx配置其六：

server {

    listen 80 default_server;

    listen [::]:80 default_server ipv6only=on;


    root /usr/share/nginx/html;

    index index.php index.html index.htm;


    server_name server_domain_name_or_IP;


    location / {

        try_files $uri $uri/ =404;

    }


    error_page 404 /404.html;

    error_page 500 502 503 504 /50x.html;

    location = /50x.html {

        root /usr/share/nginx/html;

    }


    location ~ \.php$ {

        try_files $uri =404;

        fastcgi_split_path_info ^(.+\.php)(/.+)$;

        fastcgi_pass unix:/var/run/php5-fpm.sock;

        fastcgi_index index.php;

        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

        include fastcgi_params;

    }

}





以上内容适合老版本的ubuntu，ubuntu16.04以后的版本如下：

更新系统、安装软件包：


apt update

apt install nginx mysql-server mysql-client php-fpm php-mysql php7.0-mbstring

加强mysql安全性

mysql_secure_installation


PHP fix_pathinfo 潜在安全漏洞修复

打开 /etc/php/7.0/fpm/php.ini，找到

;cgi.fix_pathinfo=1

修改为

cgi.fix_pathinfo=0

加强安全性。

完成后，重启 php 使设置生效：

systemctl restart php7.0-fpm



server {

    listen 80;

    listen [::]:80;

 

    # listen [::]:443 ssl http2;

    # listen 443 ssl http2;

 

    # include ssl.conf;

    # ssl_certificate /path/to/crt;

    # ssl_certificate_key /path/to/key;

 

    root /var/www/html;

    index index.html index.htm index.php;

 

    server_name server_domain_or_IP;

 

    location ~ /\. { return 404; }

  

    location / {

        try_files $uri $uri/ =404;

    }

 

    location ~ \.php$ {

        include snippets/fastcgi-php.conf;

        fastcgi_pass unix:/run/php/php7.0-fpm.sock;

    }

 

    location ~ /\.ht {

        deny all;

    }

}




ssl.conf配置文件内容


ssl_session_cache        shared:SSL:10m;

ssl_session_timeout      10m;

 

ssl_session_tickets      on;

 

ssl_stapling             on;

ssl_stapling_verify      on;

#ssl_trusted_certificate /path/to/pem;

 

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

ssl_ciphers EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:ECDHE-RSA-AES128-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA128:DHE-RSA-AES128-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-GCM-SHA128:ECDHE-RSA-AES128-SHA384:ECDHE-RSA-AES128-SHA128:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA128:DHE-RSA-AES128-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA384:AES128-GCM-SHA128:AES128-SHA128:AES128-SHA128:AES128-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4;

ssl_prefer_server_ciphers on;