Web Server

Apache

Install Apache 2, use SFTP as it uses SSH, so no need to install pureFTP, or similar.   https://help.ubuntu.com/community/PureFTP

https://www.raspberrypi.org/documentation/remote-access/web-server/apache.md Continue on to install all the requirements for WordPress.  https://www.raspberrypi.org/learning/lamp-web-server-with-wordpress/worksheet/

• https://tools.ietf.org/pdf/rfc7230.pdf
• https://tools.ietf.org/pdf/rfc7231.pdf
• http://s.askapache.com/pdf/Apache_Cookbook_2e_QC1.pdf

sudo apt-get install apache2
sudo chown pi /var/www/html
# enable rewrite mod
sudo a2enmod rewrite

PHP

sudo apt-get install php5 libapache2-mod-php5 -y

MySQL

sudo apt-get install mysql-server
# enter a password for mysql root user
# install ancillary packages 
sudo apt-get install mysql-client php5-mysql
# restart apache2
/etc/init.d/apache2 restart

phpMyAdmin

apt-get install phpmyadmin
# select which http server to configure (apache2)
# configure database with dbconfig-common (select yes)
# provide mysql admin user password to install phpmyadmin
# provide mysql password for phpmyadmin 
# configure apache to work with phpmyadmin
vi /etc/apache2/apache2.conf 
# add the line Include /etc/phpmyadmin/apache.conf
# restart apache
/etc/init.d/apache2 restart

• http://paynedigital.com/articles/2011/09/setting-up-and-securing-a-phpmyadmin-install-on-ubuntu-10-04

Log Files

Apache2 provides an access and an error log in the /var/log/apache2/ directory.  access.log  contains all details of requests processed by the server including the IP address the request originated from, timestamp and user agent.   All messages and errors from the server are stored in error.log.  For example

AH00558: apache2: Could not reliably determine the server's 
fully qualified domain name, using 127.0.1.1. Set the 
'ServerName' directive globally to suppress this message

Virtual Hosts

As soon as you want to host multiple sites from the server, then it is necessary to work with the configuration files.  Apache2 loads configuration data from individual files as an alternative to editing a long configuration file which may introduce errors.

# create a file in /etc/apache2/conf-available/
sudo vi /etc/apache2/conf-available/servername.conf
# this will remove the AH00558 error above

# copy default site file
cd /etc/apache2/sites-available/
cp 000-default.conf test.domain.conf

# edit test.domain.conf, specify ServerName and DocumentRoot
vi test.domain.conf
ServerName test.domain
DocumentRoot /var/www/test/

# create DocumentRoot and adjust permissions
mkdir /var/www/test
chmod -R 755 /var/www/test/
chown -R www-data:www-data /var/www/test 

Domain Name Troubleshooting – https://lookup.mxtoolbox.com/domain/blueshrapnel.co.uk/

• https://www.raspberrypi.org/learning/lamp-web-server-with-wordpress/worksheet/
• http://www.tariqkhan.co.uk/articles/creating-a-raspberry-pi-lamp-server/
• https://www.digitalocean.com/community/tutorials/how-to-set-up-apache-virtual-hosts-on-ubuntu-14-04-lts
• https://www.modmypi.com/blog/tutorial-how-to-give-your-raspberry-pi-a-static-ip-address

SSL

• http://paynedigital.com/articles/2011/09/setting-up-and-securing-a-phpmyadmin-install-on-ubuntu-10-04
• http://www.pratermade.com/2014/08/securing-your-raspberry-pi-with-ssl-and-simple-authentication/
• https://tools.ietf.org/pdf/rfc6101.pdf

Benchmarking

• http://raspberrywebserver.com/raspberrypicluster/comparing-the-performance-of-nginx-and-apache-web-servers.html
• https://www.digitalocean.com/community/tutorials/how-to-use-apachebench-to-do-load-testing-on-an-ubuntu-13-10-vps

fail2ban

• https://www.linode.com/docs/security/using-fail2ban-for-security
• http://www.fail2ban.org/wiki/index.php/MANUAL_0_8
• http://www.the-art-of-web.com/system/fail2ban-log/

Other links

• https://www.pestmeester.nl/ – comprehensive walk through written 2015.
• https://www.linode.com/docs/security/securing-your-server/
• http://automationguy.co.uk/home-lab/home-lab-build-part-13-raspberry-pi-hardening/