Installing Drupal 9 On CentOS Stream

by Netslovers updated November 8, 2022, 8:03 am 2.1k Views

We will try to install Drupal 9 on a CentOS Stream 9 VPS/Server, and we will walk through all necessary steps to build and deploy our Drupal 9 application.

Web Technology To Use

As described in the next figure, we will use:

Nginx as a reverse proxy (Port 443, 80)
Apache as a web-server (Port 81)
Drupal 9 CMS Our PHP Web Application
MariaDB Database Server

We will consider an example domain name: drupalize.com, with server IP-Address: 69.164.208.30

But while you apply this tutorial for your project, do not forget to replace your domain name and IP-Address values with yours.

Configure The CentOS Stream Server

We will:

Update our server.
Install required packages ( i.e. MariaDB, Nginx, Apache, and PHP )
Firewalls for all ports except HTTP(S) and SSH.
Install fail2bab to harden SSH access.
Installing Drupal

Step1: Update CentOS Stream Server

Update Our System

To update our Centos stream we just need to run the command.

# dnf update

Disable SELinux

We need to disable SELinux, by editing the file /etc/selinux/config and setting SELINUX=disabled

# vim /etc/selinux/config
~~~~~
~~~~~
# To revert back to SELinux enabled:
#
# grubby --update-kernel ALL --remove-args selinux
#
SELINUX=disabled
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
~~~~
~~~~

Then restart your device…

Step2: Install And Configure Nginx As A Reverse Proxy

Install And Configure Nginx

To Install And Enable Nginx, simply run the command

# dnf install nginx
# systemctl enable nginx

Configure Nginx

And to configure Nginx As A Reverse Proxy for your web server, create a new config file for your website domain in the Nginx configuration directory /etc/nginx/conf.d with the name of your domain as drupalize.com.conf .

Edit your website domain config file /etc/nginx/conf.d/drupalize.com.conf and append the following settings into it.

PS: don’t forget to replace your server name with your domain name, also listen IP-Address to your server’s public IP-Address. (colored with green bold).

# Define Your Server To Listen To Your Plubic IP ADDRESS && HTTP Port 80
# Then Redirect To HTTPS Port 443
server {
  listen      69.164.208.30:80;
  server_name drupalize.com;
  access_log off;
  return 301 https://drupalize.com$request_uri;
}
# If you want to redirect www to non-www domain, uncomment the next server block.
#server {
#  listen      69.164.208.30:80;
#  server_name www.drupalize.com;
#  access_log off;
#  return 301 https://drupalize.com$request_uri;
#}
server {
  listen      69.164.208.30:443 ssl default;
  server_name drupalize.com;

  # We capture the logs
  access_log /var/log/nginx/drupalize.com.log;

  # Insert a full path of your Self-Signed certificate Or a Validation Signed one.
  # In the next step we will learn how to create our Self-Signed certificate or you can read this tutorial 
  # To make your Self-Signd Certificate in 3 Steps, and read this for Validation Signed one.
  ssl_certificate      /opt/cert/drupalize.com.cert.pem;
  ssl_certificate_key  /opt/cert/drupalize.com.key.pem;
  ssl_dhparam          /opt/cert/dhparam.pem;
  # Restrict to secure protocols, depending on whether you have visitors
  # from older browsers
  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;

  # Restrict ciphers to known secure ones
  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256;

  ssl_prefer_server_ciphers on;
  ssl_ecdh_curve secp384r1;
  # Disable Certificate Stapling and Verification if its a self-signed one.
  ssl_stapling off;
  ssl_stapling_verify off;

  # Caching SSL.
  ssl_session_cache shared:SSL:20m;
  ssl_session_timeout 180m;
  ssl_session_tickets on;
  
  # Adjustment Headers
  # Uncomment the next header if  you are using Validation Certification To Force using it and setting up ssl cache age. 
  #add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
  add_header X-Frame-Options SAMEORIGIN;
  add_header X-Content-Type-Options nosniff;
  add_header Access-Control-Allow-Origin *;
  add_header Access-Control-Allow-Credentials true;

  #Enable and configure GZIP
  gzip on;
  gzip_static on;
  gzip_comp_level    9;
  gzip_min_length    256;
  gzip_proxied       any;
  gzip_vary          on;
  gzip_buffers           16 8k;
  gzip_http_version  1.1;
  proxy_http_version 1.1;
  gzip_types
    application/atom+xml
    application/javascript
    application/x-javascript
    application/json
    application/ld+json
    application/manifest+json
    application/rss+xml
    application/vnd.geo+json
    application/vnd.ms-fontobject
    application/x-font-ttf
    application/ttf
    application/x-ttf
    application/font-woff
    application/x-font-opentype
    application/x-web-app-manifest+json
    application/xhtml+xml
    application/xml
    font/opentype
    font/ttf
    font/x-woff
    image/bmp
    image/svg+xml
    image/x-icon
    text/cache-manifest
    text/css
    text/javascript
    text/plain
    text/vcard
    text/vnd.rim.location.xloc
    text/vtt
    text/x-component
    text/x-cross-domain-policy;
    # text/html is always compressed by gzip module

  # To allow POST on static pages
  error_page 405 =200 $uri$is_args$args;
  location / {
    # Pass Every request to Apache at the Port 81
    proxy_pass                         http://127.0.0.1:81;
    # Adjustement reverse proxy headers.
    proxy_read_timeout                 640;
    proxy_connect_timeout              640;
    proxy_redirect                     off;
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto https;
    proxy_set_header X-Forwarded-Port  443;
    proxy_buffers                      16 32k;
    proxy_buffer_size                  64k;
    proxy_request_buffering off;
    proxy_buffering off;
  }
# Enable Caching Static files...
  location ~*  \.(jpg|jpeg|png|gif|ico|css|js|pdf|ttf|woff|eot|bz2|gz|woff2|svg|bmp)$ {

                proxy_pass                         http://127.0.0.1:81;
                proxy_read_timeout                 640;
                proxy_connect_timeout              640;
                proxy_redirect                     off;

                proxy_set_header Host              $host;
                proxy_set_header X-Real-IP         $remote_addr;
                proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
                proxy_set_header X-Forwarded-Proto https;
                proxy_set_header X-Forwarded-Port  443;
                proxy_buffers                      32 64k;
                proxy_buffer_size                  128k;
                proxy_request_buffering off;
                proxy_buffering off;
                access_log off;
                log_not_found on;
                # Extend Browsers Caching Time for static file 
                expires 60d;
    }


}

Of course, we can ignore using SSL, and using HTTP Port 80 Only, so you will use the configuration as is shown in the github config file link, its the same example configuration, and so Ignore the next step (Step3).

Step3: Create Your SSL Self-Signed Or Validation Certificate

To create your self-signed SSL, go to the SSL store directory ie /opt/cert and start running the command

# mkdir /opt/cert
# cd /opt/cert
# openssl req -newkey rsa:2048 -new -nodes -x509 -days 13650 -keyout drupalize.com.key.pem -out drupalize.com.cert.pem

Generating a RSA private key
......+++++
.+++++
writing new private key to 'drupalize.com.key.pem'
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:US
State or Province Name (full name) [Some-State]:Wyoming
Locality Name (eg, city) []:Sheridan
Organization Name (eg, company) [Internet Widgits Pty Ltd]:CompanyName
Organizational Unit Name (eg, section) []:IT
Common Name (e.g. server FQDN or YOUR name) []:yourdomainname.com
Email Address []:info@yourdomainname.com

And for hardening this SSL Certificate we will generate Diffie-Hellman group dhparam.pem file

# openssl dhparam -out dhparam.pem 4096

PS: Creating dhparam.pem file may require several minutes to get finished.

Now we get the listed 3 certificate files in the certificate directory /opt/cert

drupalize.com.cert.pem
drupalize.com.key.pem
dhparam.pem

Then make sure to enter the correct path of the certificate files, into the Nginx config file that we created in the previous step /etc/nginx/sites-available/drupalize.com.conf.

To have a validate signed certificate for your domain, you can follow the How to create your validated signed SSL by a trusted CA For Linux guide, and you can get your free one too from Let’s Encrypt

Step4: Install Apache Web Server And Configure Our Virtual Host

Install And Configure Apache

To install the Apache web server, and then enable it for systemd, we will need to run the commands

# dnf install httpd httpd-tools
# systemctl enable httpd

After installing Apache, go to the main Apache configuration file at /etc/httpd/conf/httpd.conf to set it to listen to port 81 at localhost 127.0.0.1 IP-Address.

So we edit the configuration file using vim editor and look for the Listen 80 line to change it to Listen 127.0.0.1:81 as the following

# vim /etc/httpd/conf/httpd.conf
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

# Change this to Listen on a specific IP address, but note that if
# httpd.service is enabled to run at boot time, the address may not be
# available when the service starts.  See the httpd.service(8) man
# page for more information.
#
#Listen 12.34.56.78:80
Listen 127.0.0.1:81

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Create Our VirtualHost

To create our Virtual Host, we will go to the Apache config directory /etc/httpd/conf.d/, create a drupalize.com.conf file, then add the below virtual host settings then save the file.

<VirtualHost *:81>
      DocumentRoot /home/drupalize/public_html
      ServerAdmin info@drupalize.com
      ServerName  drupalize.com
      ServerAlias *.drupalize.com
<Directory "/home/drupalize/public_html">
    Options Indexes FollowSymLinks MultiViews
    AllowOverride All
    Require all granted
</Directory>
</VirtualHost>

Step5: Install MariaDB The Database Server

Install MariaDB

To install, enable, and run the MariaDB we will run the commands

# dnf install mariadb mariadb-server
# systemctl enable mariadb
# systemctl start mariadb

MariaDB Basic Secure

After installation is complete, we need to apply the basic security configuration step.

We need to run the command mysql_secure_installation and Interact with outputs as the following:

Enter current password for root (enter for none): [Press Enter With Empty Value]
Switch to unix_socket authentication [Y/n] [Answer n]
Change the root password? [Y/n] [Answer Y & Enter your database root password]
Remove anonymous users? [Y/n] [Answer Y]
Disallow root login remotely? [Y/n] [Answer Y]
Remove test database and access to it? [Y/n] [Answer Y]
Reload privilege tables now? [Y/n] [Answer Y]

# mysql_secure_installation

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
      SERVERS IN PRODUCTION USE!  PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
haven't set the root password yet, you should just press enter here.

Enter current password for root (enter for none):
OK, successfully used password, moving on...

Setting the root password or using the unix_socket ensures that nobody
can log into the MariaDB root user without the proper authorisation.

You already have your root account protected, so you can safely answer 'n'.

Switch to unix_socket authentication [Y/n] n
 ... skipping.

You already have your root account protected, so you can safely answer 'n'.

Change the root password? [Y/n] y
New password:
Re-enter new password:
Password updated successfully!
Reloading privilege tables..
 ... Success!


By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them.  This is intended only for testing, and to make the installation
go a bit smoother.  You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] y
 ... Success!

Normally, root should only be allowed to connect from 'localhost'.  This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] y
 ... Success!

By default, MariaDB comes with a database named 'test' that anyone can
access.  This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] y
 - Dropping test database...
 ... Success!
 - Removing privileges on test database...
 ... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] y
 ... Success!

Cleaning up...

All done!  If you've completed all of the above steps, your MariaDB
installation should now be secure.

Thanks for using MariaDB!

Create A Database User for our Drupal Website

Log in to the database server as root (we set a database root password in the previous step), as below, and replace PassWord with yours.

We will create a new database named drupal, and a new database user named drupal_db_user with drupal_db_password.

You can replace the values with yours, and then flush MariaDB privileges as the following.

# mysql -uroot -pPassWord
Welcome to the MariaDB monitor.  Commands end with ; or \g.
Your MariaDB connection id is 11
Server version: 10.5.13-MariaDB MariaDB Server

Copyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

MariaDB [(none)]> create database drupal;
Query OK, 1 row affected (0.001 sec)

MariaDB [(none)]> GRANT ALL PRIVILEGES ON drupal.* TO 'drupal_db_user'@'localhost' IDENTIFIED BY 'drupal_db_password';
Query OK, 0 rows affected (0.002 sec)

MariaDB [(none)]> FLUSH PRIVILEGES;
Query OK, 0 rows affected (0.002 sec)

MariaDB [(none)]> exit;
Bye

Step6: Install PHP

Install PHP and Drupal required extensions using the command

# dnf install php php-mysqlnd php-json php-gd php-xml php-openssl php-curl php-mbstring php-zip

Step7: Add New User To The System

We will need to add a new user to the system which usually has a username as the domain name, then we will set a password for the domain user.

After that, we will create the public web directory public_html, which must be exactly as we add in the above apache virtual host configuration.

Then append the domain user to the Apache System User Group

# adduser drupalize
# passwd drupalize
Changing password for user drupalize.
New password:[Enter your password here]
Retype new password:[Re-Eneter your password]
passwd: all authentication tokens updated successfully.

# chmod 755 /home/drupalize/
# cd /home/drupalize
# mkdir public_html
# usermod -a -G apache domain

Step8: Firewall And Fail2ban

Firewall Setting

Firewall all ports and keep the HTTP 80, HTTPS 443, and SSH 22 Open, by running

# firewall-cmd --add-service=http --permanent
# firewall-cmd --add-service=https --permanent
# firewall-cmd --add-service=ssh --permanent
# firewall-cmd --reload

Install And Run Fail2Ban

To Secure SSH from Brute Force attacks, we will install and run Fail2ban using EPEL repository as the following

# dnf install epel-release
# dnf update
# dnf install fail2ban
# systemctl enable fail2ban
# systemctl start fail2ban

Downloading And Installing Drupal 9

Step9: Download Drupal

Install Composer and tar packages using the command

# dnf install composer tar

Go to the public_html web directory /home/domain/public_html, and run the download and extract command to get the latest Drupal package as the following.

# curl -sSL https://www.drupal.org/download-latest/tar.gz | tar -xz --strip-components=1

Step10: Start The Installation Process

Now we can start our Web services as the following

# systemctl start nginx
# systemctl start httpd

Set Drupal Files and Permissions

Go to the /home/drupalize domain directory, and apply the following permission to the public_html and contents

# cd /home/drupalize
# mkdir public_html/sites/default/files
# cp public_html/sites/default/default.settings.php public_html/sites/default/settings.php
# chown -R drupalize.apache public_html
# chmod -R 2750 public_html
# chmod -R 2770 public_html/sites/default/files

The following permission is temporary until you complete the installation process, and you must set the settings.php to 2640 after finishing.

# chmod -R 2770 public_html/sites/default/settings.php

Drupal Installation Wizard

We will use the classic Web GUI installation wizard method, by firing the domain URL into the web browser.

For the first run, and if you are using a self-signed certificate, you will get this SSL validation error message, and will need to choose to proceed to domain unsafe

Start Your Installation Wizard Steps, and Choose your language, then press Save and Continue

The Next Step will be to choose your installation profile, as we will select the standard profile

The next step will be a verification process, then set up the Drupal database using the database information which we created in the step5

Database name: drupal
Database username: drupal_db_user
Database password: drupal_db_password

After entering the database information, the install site progress will start, and you will need to make the final step, with set up the site configuration

Entering your site configuration and finish the installation wizard.

Then return the settings.php file to set its permission to 2640, to keep drupal safe.

# chmod 2640 public_html/sites/default/settings.php

Now all done, and the installation mission is completed.

What do you think?

16 Points

Upvote Downvote