Amazon AWS – Debian 11 PHP8.2 NGINX

cd /
find . -name php.ini -print

./etc/php/8.2/fpm/php.ini
./etc/php/8.2/cli/php.ini


cd /etc/php/8.2/fpm

[Use your own timezone, and modify values ti your own preference. If uploading .sql files through phpMyAdmin, the max file size below will apply as a limit.]
[As a note, if using Nginx as compared to apache, nginx error logs will show where values are duplicated via a warning message.]

cp -p php.ini php.ini.bak
vi php.ini

date.timezone = Australia/Brisbane
max_execution_time = 300
max_input_time = 600
max_input_vars = 2500
memory_limit = 256M
post_max_size = 50M
upload_max_filesize = 50M


cd /
find . -name www.conf -print

./etc/php/8.2/fpm/pool.d/www.conf

cd /etc/php/8.2/fpm/pool.d
cp -p www.conf www.conf.bak

vi www.conf

[These values will already be correct:]
user = nginx
group = nginx
listen = /run/php/php8.2-fpm.sock

listen.owner = nginx
listen.group = nginx
;listen.mode = 0660     [----> please uncomment this line]

listen.mode = 0660

; pm = dynamic
pm = ondemand

pm.max_children = 75
pm.start_servers = 10
pm.min_spare_servers = 5
pm.max_spare_servers = 35
pm.process_idle_timeout = 10s;
pm.max_requests = 500

[Then at the bottom of the file:]

php_admin_value[error_log] = /var/log/fpm-php.www.log
php_admin_flag[log_errors] = on
php_admin_value[disable_functions] = exec,passthru,system
php_admin_flag[allow_url_fopen] = off
php_admin_value[memory_limit] = 256M

[save and exit. Two of the lines in the above stanza will nt be in the original.]

cd ..

cp -p php-fpm.conf php-fpm.conf.bak
vi php-fpm.conf

emergency_restart_threshold = 10
emergency_restart_interval = 1m
process_control_timeout = 60s

[save and exit. You can place these lines anywhere near the commented lines for "emergency". This helps prevent memory leaks, and ability to gracefully use systemctl reload php8.2-fpm on crontab once a night.]

If we installed opcache, we need to configure this as well…

cd /etc/php/8.2/mods-available
cp -p opcache.ini opcache.ini.bak

vi opcache.ini
zend_extension=opcache.so
opcache.enable=1
opcache.enable_cli=1
opcache.memory_consumption=128
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=4000

[save and exit]

At this stage, please check your apt updates and do a full operating system reboot (stop, start) from the EC2 console, or at a minimum, use the commands:

sync;sync;reboot

[When you log back in as root, after a few moments when the system is back up, check the php.ini changes are all ok:
Note: due to limitations of this web browser's syntax highlighter, I have had to use a few extra commands with the echo command below.]

echo " < ?phpZphpinfo(); ? > "|sed 's/ //g'|sed 's/Z/ /g' > info.php

[Note: /var/www/html needs to be chown nginx, chgrp nginx, chmod 2775]
cd /var/www/html
chown nginx info.php
chgrp nginx info.php
chmod 664 info.php

https://snotbat.com/info.php

[Then rename the file so would be hackers do not see it:]

cd /var/www/html
mv info.php info.php.o

You can check things like max_input_vars have changed their values, and verify opcache and php-fpm are happily running.

We now need to add phpMyAdmin to manage the database.

cd /usr/share
wget https://www.phpmyadmin.net/downloads/phpMyAdmin-latest-all-languages.tar.gz
ls
tar xvf .....  
[where ..... is the downloaded file. Then delete the tar.gz file, then use the Unix command to move the directory to phpMyAdmin, e.g.: mv yourfile phpMyAdmin]
cd phpMyAdmin
mkdir tmp
chmod 777 tmp
cp -p config.sample.inc.php config.inc.php
vi config.inc.php
[
Search for the blowfish line. Do a Google search on blowfish phpmyadmin generator.
I use: https://phpsolved.com/phpmyadmin-blowfish-secret-generator/?g=[insert_php]echo%20$code;[/insert_php] from https://phpsolved.com.
Paste the generated value into the blowfish value.
Then after SaveDir as shown below, add TempDir...
]
$cfg['SaveDir'] = '';
$cfg['TempDir'] = '/tmp';

[save and exit]

cd /var/www/html
ln -s /usr/share/phpMyAdmin phpMyAdmin
https://snotbat.com/phpMyAdmin

[User: root, and your password as created with mariadb installation]

[At this stage, we will not go into phpMyAdmin database and user creation, but you will see an error message at the bottom of the page asking how to fix it. Follow those instructions and let phpMyAdmin create the necessary dataabse. It is best these days to create databases with utf8mb4_general_ci]

You can use your own port for phpMyAdmin with an entry like this:

$cfg['Servers'][$i]['port'] = '3307';

Then in your EC2 security group, add that inbound port number against your own static IP address, so no one else can access phpMyAdmin.

You may also configure phpMyAdmin access for anyone like this:

cd /etc/apache2/conf-available
vi phpMyAdmin.conf

Alias /phpMyAdmin /usr/share/phpMyAdmin
Alias /phpmyadmin /usr/share/phpMyAdmin

   AddDefaultCharset UTF-8
   Require local
   Require all granted


   Require local
   Require all granted


    Order Deny,Allow
    Deny from All
    Allow from None


[save and exit]

systemctl restart nginx

[You can see other articles from my website on how to add only your IP address to the configuration file. If you want anyone accessing it, you'd need to leave the port number config to the default, with any IP4 address able to access it. Basically you can play around with permissions you;d like via Amaxons security group and/or the above file.]