LAMP stack

Prerequisites

Before you launch the LAMP Stack AMI, make sure you have the following in place.

AWS account: You need an active AWS account with permissions to launch EC2 instances and manage security groups.

EC2 key pair: Create or select an existing EC2 key pair in the region where you plan to launch the instance. SSH authentication requires this key pair.

Security group configuration: Your security group must allow inbound traffic on the following ports:

Protocol Type Port Description

SSH TCP 22 SSH connectivity for remote administration

Custom TCP TCP 80 Apache HTTP web server

Custom TCP TCP 3306 MySQL database listener for remote access

Restrict SSH access to your own IP address or a trusted CIDR range. Open port 3306 only if you need remote database connections. For most deployments, local access from the server itself is sufficient.

Minimum system requirements:

Minimum CPU Minimum RAM Required Disk Space

1 vCPU 1 GB 20 GB

Any EC2 instance type that meets these minimums will work. For production workloads, consider a t3.medium or larger for consistent performance under load.

Step by Step Setup

Step 1: Launch the Instance

• Open the AWS Marketplace listing for LAMP Stack by SecureAnyCloud.
• Click Continue to Subscribe, then Continue to Configuration.
• Select your preferred AWS Region and instance type.
• On the launch page, choose your VPC and subnet, and assign the security group you prepared above.
• Select your EC2 key pair and launch the instance.

Step 2: Wait for Status Checks

Wait until the EC2 instance shows 2/2 status checks passed before you connect. The instance runs an initial boot update script that applies the latest operating system patches, so the first boot may take a few minutes longer than usual.

If you connect before both status checks have passed, you may see errors such as:

Permission denied (publickey,gssapi-keyex,gssapi-with-mic). ec2-user@your-instance-ip's password:

This is expected behaviour during early boot. Wait for the status checks to complete, then try again.

Step 3: Connect via SSH

Connect to the instance with your private key:

ssh -i /path/to/your-key.pem ec2-user@<PUBLIC_IP>

Replace <PUBLIC_IP> with the public IP address or public DNS name shown in the EC2 console.

Step 4: Switch to the Root User

Once connected as ec2-user, switch to the root user:

sudo su -

All administrative tasks described in this guide should be performed as root.

Step 5: Retrieve the MySQL Root Password

The MySQL root password is randomly generated at build time and stored in a log file on the server. Read it with:

cat /stage/scripts/mysql_root_password.log

Note this password. You need it to log in to the MySQL command-line client.

Step 6: Verify Apache Is Running

Open a web browser and navigate to:

http://<PUBLIC_IP>:80

The AlmaLinux Test Page confirms that the Apache HTTP Server is operational.

Step 7: Verify PHP Is Running

Navigate to the PHP info page:

http://<PUBLIC_IP>/info.php

The PHP information page shows the installed version and loaded modules. For security, remove this file or restrict access to it before you go into production.

Step 8: Connect to MySQL

From the root shell on the instance, connect to MySQL:

mysql -u root -p

When prompted, enter the password that you retrieved from /stage/scripts/mysql_root_password.log. The root database user is configured for local login only, which is best practice for production environments.

Server Components

The LAMP Stack AMI includes the following preconfigured components. Versions may be updated on first boot when the initial update script runs.

Component Configuration File Description

MySQL /etc/my.cnf Relational database server for dynamic data storage

Apache HTTP /etc/httpd or /etc/apache2 Web server handling HTTP requests on port 80

PHP /etc/php.ini Server side scripting language for dynamic content

MySQL is the database backend. It starts automatically on boot and listens on port 3306. For security, the root user is restricted to local connections only.

Apache HTTP Server handles all incoming web requests. The document root is /var/www/html, where you place your website files, virtual host configurations and static assets.

PHP is integrated with Apache through the PHP module. Its configuration is in /etc/php.ini, and additional module configuration files are in /etc/php.d/.

Filesystem Layout

The AMI uses dedicated mount points to separate system files, database data and web content, for better performance and manageability.

Mount Point Description

/ Root filesystem containing the operating system

/boot Operating system kernel files

/var/lib/mysql MySQL data directory on a dedicated volume

/var/www/html Apache document root on a dedicated volume

Key directories and their purposes:

Path Purpose

/var/www/html Place your website files, PHP scripts, and static assets here

/var/lib/mysql All MySQL databases and table data are stored here

/etc/httpd Apache configuration files including virtual hosts

/etc/php.ini Main PHP configuration file

/etc/php.d/ Additional PHP module configuration files

/stage/scripts SecureAnyCloud provisioning scripts and log files

Because /var/lib/mysql and /var/www/html are on their own volumes, you can resize storage for the database or the web content independently, without affecting the root filesystem.

Managing Services

You manage all services on the LAMP Stack AMI with standard Linux service commands. Each service starts automatically on boot.

MySQL Service

# Check the MySQL service status service mysqld status
# Stop the MySQL service service mysqld stop
# Start the MySQL service service mysqld start
# Restart the MySQL service service mysqld restart

Apache HTTP Service

On Red Hat-based systems, including this AlmaLinux AMI, the service is named httpd:

# Check the Apache service status systemctl status httpd
# Stop the Apache service systemctl stop httpd
# Start the Apache service systemctl start httpd
# Restart the Apache service systemctl restart httpd

PHP

PHP runs as a module within Apache, so there is no separate PHP service to manage. Restarting Apache reloads any changes to the PHP configuration.

# Check the installed PHP version php -v
# Test PHP configuration for syntax errors php -i

After making changes to /etc/php.ini, restart Apache to apply them:

systemctl restart httpd

Scripts and Log Files

The AMI includes several scripts and log files that SecureAnyCloud created to streamline first-boot provisioning and administration.

Script or Log Path Description

initial_boot_update.sh /stage/scripts Updates the operating system with the latest available patches on first boot

initial_boot_update.log /stage/scripts Output log from the initial boot update script

mysql_root_password.log /stage/scripts Contains the randomly generated MySQL root password

Disabling the Initial Boot Update Script

The OS update script runs automatically on every reboot through crontab. If you prefer to manage updates manually, disable it:

rm -f /stage/scripts/initial_boot_update.sh crontab -e
# DELETE THE BELOW LINE, SAVE AND EXIT THE FILE: @reboot /stage/scripts/initial_boot_update.sh

This stops the automatic update from running on later reboots and keeps the log files for reference.

Deploying Your Application

Uploading Website Files

Place your PHP application files in the Apache document root:

# Copy files from your local machine scp -i /path/to/your-key.pem -r ./my-app/* ec2-user@<PUBLIC_IP>:/tmp/
# Then on the server, move them into place
sudo cp -r /tmp/my-app/* /var/www/html/
sudo chown -R apache:apache /var/www/html/

Creating a MySQL Database

Connect to MySQL as root and create a database for your application:

mysql -u root -p CREATE DATABASE myapp; CREATE USER 'myappuser'@'localhost' IDENTIFIED BY 'your_secure_password'; GRANT ALL PRIVILEGES ON myapp.* TO 'myappuser'@'localhost'; FLUSH PRIVILEGES; EXIT;

Configuring Virtual Hosts

To host multiple websites, create virtual host configuration files:

vi /etc/httpd/conf.d/mysite.conf

Add a configuration block like the following:

<VirtualHost *:80> ServerName www.example.com DocumentRoot /var/www/html/mysite <Directory /var/www/html/mysite> AllowOverride All Require all granted </Directory> ErrorLog /var/log/httpd/mysite-error.log CustomLog /var/log/httpd/mysite-access.log combined </VirtualHost>

Restart Apache to apply the new virtual host:

systemctl restart httpd

Troubleshooting

Cannot connect via SSH

• Confirm that the instance has reached 2/2 status checks in the EC2 console.
• Verify that your security group allows inbound TCP traffic on port 22 from your IP address.
• Make sure you are using the correct key pair and connecting as ec2-user.
• Check that the key file permissions are set correctly: chmod 400 /path/to/your-key.pem.

Apache is not serving pages

• Check the Apache service status: systemctl status httpd.
• Review the error log: cat /var/log/httpd/error_log.
• Confirm that your security group allows inbound traffic on port 80.
• Verify that files exist in /var/www/html and have the correct ownership (apache:apache).

Cannot connect to MySQL

• Check the MySQL service status: service mysqld status.
• Verify that you are using the correct password from /stage/scripts/mysql_root_password.log.
• If you connect remotely, make sure port 3306 is open in your security group and MySQL accepts remote connections in /etc/my.cnf.

PHP pages display as plain text

• Make sure the PHP module is loaded in Apache: httpd -M | grep php.
• Verify that the file has a .php extension.
• Restart Apache after any configuration change: systemctl restart httpd.

Initial boot update is taking a long time

• The first boot runs a full OS update. It can take several minutes, depending on the instance type and available bandwidth.
• Monitor progress by tailing the update log: tail -f /stage/scripts/initial_boot_update.log.

Security Recommendations

Remove the PHP Info Page

The info.php file exposes detailed server configuration. Remove it once you have verified that PHP works:

rm -f /var/www/html/info.php

Restrict MySQL Remote Access

By default, the MySQL root user is configured for local access only. Keep it that way in production. If your application runs on the same server, use localhost as the database host.

Enable HTTPS with TLS

For production deployments, configure Apache with a TLS certificate. You can use Let's Encrypt with Certbot:

yum install -y certbot python3-certbot-apache certbot --apache -d yourdomain.com

Apply Security Updates Regularly

Keep the operating system and all packages up to date:

yum update -y

Restrict Security Group Rules

• Limit SSH (port 22) to specific trusted IP addresses.
• Open port 3306 only if you need remote database access.
• Consider a bastion host or AWS Systems Manager Session Manager for SSH access, instead of exposing port 22 to the internet.

Configure a Firewall

In addition to AWS security groups, consider enabling the local firewall:

firewall-cmd --permanent --add-service=http firewall-cmd --permanent --add-service=ssh firewall-cmd --reload

Back Up Your Data

Back up the MySQL data directory and the web content regularly. Use AWS EBS snapshots for volume-level backups, or mysqldump for logical database backups:

mysqldump -u root -p --all-databases > /tmp/all-databases-backup.sql

Support

If you run into an issue that this guide does not cover, or need further help, the SecureAnyCloud support team is available 24/7.

Email: sales@secureanycloud.com Phone: (+44) 02045382725 Website: secureanycloud.com Address: 3rd Floor, 86 90 Paul Street, London, EC2A 4NE

When you contact support, include your EC2 instance ID, the AWS region, a description of the issue and any relevant log output.

Deploy on AWS

Launch LAMP Stack with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS

Launch LAMP Stack with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

• An Azure subscription with permission to create virtual machines
• An SSH key pair. You upload the public key during VM creation.
• curl or a web browser to exercise the running stack

Step 1 - Deploy from the Azure Portal

• Find LAMP Stack on Ubuntu 24.04 LTS by SecureAnyCloud in the Azure Marketplace and click Create.
• On the Basics tab, select or create a resource group, choose East US as the region, and set the VM size to Standard_D2s_v3 (2 vCPU / 8 GB RAM). Larger sizes are fine for higher traffic.
• Under Administrator account, choose SSH public key and paste your public key.
• On the Networking tab, open inbound ports 80 (HTTP) and 443 (HTTPS) in addition to 22 (SSH).
• Click Review + create, then Create.

Step 2 - Deploy with the Azure CLI

# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:lamp-stack-ubuntu-24-04:standard:latest
az vm create \
  --resource-group <your-resource-group> \
  --name lamp-stack \
  --image sac1647283583153:lamp-stack-ubuntu-24-04:standard:latest \
  --size Standard_D2s_v3 \
  --admin-username azureuser \
  --ssh-key-values ~/.ssh/id_rsa.pub \
  --public-ip-sku Standard

From your local workstation, open the HTTP and HTTPS ports. Replace <your-resource-group> with your resource group name:

az vm open-port --port 80 --priority 1001 --resource-group <your-resource-group> --name lamp-stack
az vm open-port --port 443 --priority 1002 --resource-group <your-resource-group> --name lamp-stack

Step 3 - Connect via SSH

ssh azureuser@<vm-ip>

On first boot, lamp-firstboot.service initialises the MySQL data directory, rotates the root password, creates the default application database and user, and starts Apache and MySQL. Allow up to 60 seconds for the service to complete.

Check that first boot has finished:

sudo test -f /var/lib/sac/data/lamp-firstboot.done && echo "firstboot done"

Step 4 - Retrieve your MySQL credentials

sudo cat /stage/scripts/lamp-credentials.log

The file is owned root:root (mode 0600) and contains the MySQL root password, the default application database name, the application user name, and the application password.

Example content:

mysql_root_password=<generated> app_db=sac_app app_db_user=sac_app app_db_password=<generated>

Extract the passwords into shell variables for the rest of this guide:

MYSQL_ROOT_PASS=$(sudo awk -F= '/^mysql_root_password=/ {print $2}' /stage/scripts/lamp-credentials.log)
APP_DB_PASS=$(sudo awk -F= '/^app_db_password=/ {print $2}' /stage/scripts/lamp-credentials.log)
echo "root password length: ${#MYSQL_ROOT_PASS}"
echo "app password length: ${#APP_DB_PASS}"

Step 5 - Verify Apache and MySQL are running

sudo systemctl is-active apache2.service
sudo systemctl is-active mysql.service ss -tln | grep -E ':(80|3306)\b'

The output shows active twice and both ports listening.

Step 6 - Exercise the sample PHP page

curl -s -o /tmp/index.html -w "HTTP %{http_code}\n" http://127.0.0.1/ grep -q "LAMP Stack" /tmp/index.html && echo "sac welcome page served"

Open http://<vm-ip>/ in a browser to see the same page, with a live MySQL connection test and the runtime details of your server.

The green CONNECTED badge is the sample page's self-test. The page reads the app user password from /stage/scripts/lamp-credentials.log (readable by www-data at mode 0640 root:www-data) and opens a PDO connection to MySQL on 127.0.0.1:3306. It then prints the server version returned by SELECT VERSION().

If the page shows the first-boot-not-complete fallback instead, wait another minute and refresh.

Step 7 - MySQL round trip as the app user

APP_DB_PASS=$(sudo awk -F= '/^app_db_password=/ {print $2}' /stage/scripts/lamp-credentials.log) MYSQL_PWD="$APP_DB_PASS" mysql -u sac_app --host=127.0.0.1 sac_app <<'SQL' CREATE TABLE IF NOT EXISTS demo (id INT PRIMARY KEY, label VARCHAR(64)); INSERT INTO demo (id, label) VALUES (1, 'hello') ON DUPLICATE KEY UPDATE label='hello'; SELECT * FROM demo; SQL

The output contains the row 1 | hello.

Step 8 - Replace the sample page with your application

The document root is /var/www/html. Put your PHP application there:

sudo rm /var/www/html/index.php
sudo tee /var/www/html/index.php >/dev/null <<'PHP' <?php echo "Hello from my LAMP app!"; PHP curl -s http://127.0.0.1/

For a real application, upload over SCP or SFTP, or run git clone into /var/www/html (or a subdirectory). Make sure the ownership is www-data:www-data and that Apache can read the files.

Step 9 - Serve a custom domain

Point your DNS A record at the VM's public IP, then create an Apache virtual host:

sudo tee /etc/apache2/sites-available/example.com.conf >/dev/null <<'CONF' <VirtualHost *:80> ServerName example.com ServerAlias www.example.com DocumentRoot /var/www/html ErrorLog /var/log/apache2/example.com-error.log CustomLog /var/log/apache2/example.com-access.log combined </VirtualHost> CONF
sudo a2ensite example.com.conf
sudo apache2ctl configtest
sudo systemctl reload apache2

Step 10 - Add HTTPS with Let's Encrypt

Install certbot and obtain a certificate:

sudo DEBIAN_FRONTEND=noninteractive apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d example.com -d www.example.com --non-interactive --agree-tos -m you@example.com

Certbot configures a second virtual host on port 443, installs the certificate and adds a systemd timer that renews it automatically every 60 days.

Step 11 - Common admin tasks

Restart either service after a configuration change:

sudo systemctl reload apache2.service
sudo systemctl restart mysql.service

Tail the logs. Use -F for continuous output in an interactive session, or -n for a one-shot look:

sudo tail -n 20 /var/log/apache2/error.log /var/log/mysql/error.log 2>/dev/null || true

To administer MySQL as root, authenticate through the Unix socket with the rotated password from /stage/scripts/lamp-credentials.log. Use sudo env so that the password variable survives sudo's default env_reset. This example lists the existing users:

MYSQL_ROOT_PASS=$(sudo awk -F= '/^mysql_root_password=/ {print $2}' /stage/scripts/lamp-credentials.log)
sudo env MYSQL_PWD="$MYSQL_ROOT_PASS" mysql -u root --socket=/var/run/mysqld/mysqld.sock \
  -e "SELECT user, host FROM mysql.user ORDER BY user, host;"

To change the root password, replace new-strong-password with your own value and run the ALTER statement against the same socket:

sudo env MYSQL_PWD="$MYSQL_ROOT_PASS" mysql -u root --socket=/var/run/mysqld/mysqld.sock \
  -e "ALTER USER 'root'@'localhost' IDENTIFIED BY 'new-strong-password';"

To add another MySQL database and user, pick a unique name and a strong password:

MYSQL_ROOT_PASS=$(sudo awk -F= '/^mysql_root_password=/ {print $2}' /stage/scripts/lamp-credentials.log)
sudo env MYSQL_PWD="$MYSQL_ROOT_PASS" mysql -u root --socket=/var/run/mysqld/mysqld.sock <<'SQL' CREATE DATABASE reports CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci; CREATE USER 'reports_app'@'localhost' IDENTIFIED BY 'choose-a-strong-password'; GRANT ALL PRIVILEGES ON reports.* TO 'reports_app'@'localhost'; FLUSH PRIVILEGES; SQL

Step 12 - Security hardening checklist

• Put MySQL behind a firewall. In production, ss -tln should show :3306 bound only to 127.0.0.1.
• Rotate the root password on a schedule and store it in a secret manager.
• Run sudo apt-get update && sudo apt-get -y upgrade regularly.
• Use fail2ban if SSH is reachable from the public internet.

Support

SecureAnyCloud provides 24/7/365 expert technical support, with a guaranteed response within 24 hours and a one-hour average for critical issues. Contact sales@secureanycloud.com.

Visit secureanycloud.com/products for our full catalogue.

Deploy on Azure

Launch lamp-stack with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

What is in the image

Component Version Role

Apache HTTP Server 2.4 Web server, serving on port 80

MariaDB 10.11 Database engine (MySQL drop-in replacement), localhost socket only

PHP 8.3 (FPM) PHP runtime, proxied by Apache through mod_proxy_fcgi

phpMyAdmin 5.2.1 Browser-based MariaDB administration at /phpmyadmin

The image is built on Ubuntu 24.04 LTS. The database tier and the application tier each live on their own EBS volume: /var/lib/mysql for MariaDB and /var/www for the Apache document root. You can resize each tier independently of the OS disk.

Connecting to your instance

OS variant SSH user

Ubuntu 24.04 ubuntu

ssh -i your-key.pem ubuntu@<instance-public-ip>

First-boot credential rotation

On the first boot of your instance, lamp-firstboot.service runs once and:

• Rotates the MariaDB root password to a fresh per-instance value
• Rotates the phpMyAdmin pma user password to a fresh per-instance value
• Writes both passwords (and connection URLs) to /root/lamp-credentials.txt, mode 0600, root-only

The build-time MariaDB datadir is wiped during AMI capture, so no shared, default or build-time database credentials ship in the image. The default OS maintenance database user is removed at build time.

Retrieve the rotated credentials over SSH:

sudo cat /root/lamp-credentials.txt

Sample output:

# sac LAMP Stack — generated on first boot by lamp-firstboot.service
# These credentials are unique to this VM. Store them somewhere safe. lamp.url=http://10.0.0.5/ phpmyadmin.url=http://10.0.0.5/phpmyadmin/ mariadb.host=localhost mariadb.root.user=root mariadb.root.pass=<rotated-mariadb-root-password> phpmyadmin.pma.user=pma phpmyadmin.pma.pass=<rotated-phpmyadmin-pma-password>

Verifying the welcome page

In a browser, open http://<instance-public-ip>/. The SecureAnyCloud LAMP Stack welcome page confirms that Apache is serving the document root with PHP enabled.

The welcome page links to the phpinfo helper and to phpMyAdmin.

Confirming the PHP runtime

Browse to http://<instance-public-ip>/phpinfo.php. PHP returns its runtime configuration: version, loaded extensions, FPM runtime, ini paths and the environment.

This page also confirms that Apache proxies PHP requests to PHP-FPM over the UNIX socket. Remove phpinfo.php from the document root once you have verified the runtime, because it exposes configuration that you may not want public:

sudo rm /var/www/html/phpinfo.php

Administering MariaDB through phpMyAdmin

Browse to http://<instance-public-ip>/phpmyadmin/. Sign in as root with the value of mariadb.root.pass from /root/lamp-credentials.txt, or as pma with phpmyadmin.pma.pass. Both users have full privileges on the local MariaDB instance.

Once signed in, you can create databases, manage users, run SQL, import dumps and export backups in the phpMyAdmin interface.

Verifying the database from the shell

You can also connect to MariaDB directly from the instance shell with the rotated root password:

PASS=$(sudo grep '^mariadb.root.pass=' /root/lamp-credentials.txt | cut -d= -f2-)
mariadb -u root -p"$PASS" -e 'SELECT VERSION();'

The query returns the running MariaDB version, confirming the rotated password is correct.

Hosting your own PHP application

You have two ways to host your application:

• Use the default document root. Replace the contents of /var/www/html with your application files. Apache's default vhost serves anything in this directory at /.
• Add a virtual host. Create a new conf file in /etc/apache2/sites-available/ and put your application code under /var/www/<app>. Enable the site with sudo a2ensite <app>, then run sudo systemctl reload apache2.

PHP-FPM picks up new code automatically, so a plain code drop needs no separate restart. If you change php.ini or add a new PHP extension, run sudo systemctl restart php8.3-fpm.

File locations and service names

Item Path / name

Apache document root /var/www/html

Apache vhost directory /etc/apache2/sites-available/

PHP-FPM pool config /etc/php/8.3/fpm/pool.d/www.conf

PHP ini drop-ins (SecureAnyCloud) /etc/php/8.3/{fpm,cli}/conf.d/99-lamp.ini

MariaDB datadir /var/lib/mysql (dedicated EBS volume)

phpMyAdmin /usr/share/phpmyadmin

phpMyAdmin Apache conf /etc/apache2/conf-available/phpmyadmin.conf

Credentials file /root/lamp-credentials.txt (0600 root)

Firstboot sentinel /var/lib/sac/data/lamp-firstboot.done

Service names:

sudo systemctl status apache2
sudo systemctl status mariadb
sudo systemctl status php8.3-fpm

Enabling HTTPS with Let's Encrypt

The image opens port 443 in its security group but ships no TLS certificate, because there is no DNS name to bind to at build time. Once you have a DNS A record that points at your instance, install certbot and request a certificate:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-apache
sudo certbot --apache -d your-domain.example.com

Certbot rewrites the Apache vhost to listen on :443, installs an automatic renewal timer and reloads Apache.

Where to go from here

• Put a PHP web application into /var/www/html or add a new vhost
• Use phpMyAdmin at /phpmyadmin to create application databases and users
• Take regular EBS snapshots of the /var/lib/mysql volume for backup
• Tune PHP in /etc/php/8.3/fpm/conf.d/99-lamp.ini and reload php8.3-fpm
• Enable HTTPS with the certbot section above once you have a DNS name

Screenshots

The SecureAnyCloud LAMP Stack welcome page served by Apache on port 80 with no manual setup.

The phpinfo helper page confirming PHP 8.3, loaded extensions and the FPM runtime.

The phpMyAdmin sign-in page at /phpmyadmin for browser-based MariaDB administration.

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com