DEV Community: M. K. Tanjin Sarker

Laravel Permission Hardening Script

M. K. Tanjin Sarker — Wed, 11 Mar 2026 10:24:30 +0000

Laravel File Permission Hardening for Multi-Developer Production Server

When multiple developers work on the same Laravel project on a production server, improper file permissions can cause several issues:

Git permission errors
Laravel 419 Page Expired errors
Storage write failures
Cache permission issues
Security risks from overly permissive access

This guide shows a safe and production-ready Laravel permission hardening setup using a Bash script.

Project Structure

Example Laravel project path:

/var/www/html/laravel_application

Developers:

tanjin
rasel

Developer group:

webdev

Web server runtime user:

www-data

Permission Strategy

We will follow these security rules:

Component	Owner	Permission
Project directory	tanjin:webdev	2775
Application files	tanjin:webdev	664
Directories	tanjin:webdev	2775
storage	www-data:webdev	775
bootstrap/cache	www-data:webdev	775
.env	tanjin:webdev	640
public	tanjin:webdev	755

This setup ensures:

Developers can modify project files
Laravel runtime can write to storage and cache
Sensitive environment variables remain protected

Why Use `2775` Permissions?

Breakdown:

Value	Meaning
2	setgid (new files inherit group)
7	owner rwx
7	group rwx
5	others r-x

Result:

drwxrwsr-x

This ensures all new files inherit the webdev group, enabling safe multi-developer collaboration.

Laravel Permission Hardening Script

Below is the complete Bash script to configure Laravel permissions safely.

#!/bin/bash

PROJECT=/var/www/html/laravel_application
MAINUSER=tanjin
GROUP=webdev
OTHERSUSER="rasel"

# create group if not exists
sudo groupadd -f $GROUP

# add other developers to group
for USER in $OTHERSUSER
do
    sudo usermod -aG $GROUP $USER
done

# set project ownership
sudo chown -R $MAINUSER:$GROUP $PROJECT

# directory permissions
sudo find $PROJECT -type d -exec chmod 2775 {} \;

# file permissions
sudo find $PROJECT -type f -exec chmod 664 {} \;

# laravel writable directories
sudo chown -R www-data:$GROUP $PROJECT/storage
sudo chown -R www-data:$GROUP $PROJECT/bootstrap/cache

sudo chmod -R 775 $PROJECT/storage
sudo chmod -R 775 $PROJECT/bootstrap/cache

# protect env file
sudo chown $MAINUSER:$GROUP $PROJECT/.env
sudo chmod 640 $PROJECT/.env

# secure public directory
sudo chmod -R 755 $PROJECT/public

echo "Laravel permission hardening completed."

How to Use the Script

Create the script file:

nano laravel_permission_fix.sh

Paste the script and save.

Make it executable:

chmod +x laravel_permission_fix.sh

Run it:

./laravel_permission_fix.sh

Important Git Rule

Never run Git commands with sudo.

Incorrect:

sudo git pull

Correct:

git pull

Running Git with sudo can cause repository ownership issues.

Laravel Writable Directories

Laravel requires write access to:

storage
bootstrap/cache

Without proper permissions, you may encounter:

419 Page Expired errors
Failed cache writes
Session storage errors

The script configures these directories for www-data runtime access.

Security Notes

Never commit .env to Git
Always protect .env with restricted permissions
Use group-based developer access instead of giving full ownership
Avoid 777 permissions on any Laravel directory

Final Recommended Structure

/var/www/html/laravel_application
│
├── app
├── bootstrap
│   └── cache (www-data:webdev)
│
├── config
├── database
├── public (755)
│
├── resources
├── routes
├── storage (www-data:webdev)
│
├── vendor
├── artisan
├── composer.json
└── .env (640)

Result

After running the script:

Multiple developers can safely work on the project
Laravel runtime can write to storage and cache
Sensitive configuration files remain protected
Git permission errors are avoided

Conclusion

Correct Laravel file permissions are essential for both security and stability in production environments.

Using a group-based permission model with proper directory ownership ensures:

secure collaboration
predictable deployments
fewer runtime errors

If you found this guide useful, feel free to adapt the script to your own Laravel infrastructure.

Ubuntu 24.04 Setup Script: Nginx/Apache, PHP-FPM, MySQL/MariaDB, Docker, UFW

M. K. Tanjin Sarker — Wed, 21 Jan 2026 08:25:16 +0000

✅ Ubuntu 24.04 Full Server Setup Script (Apache/Nginx + PHP-FPM Multi Version + MySQL/MariaDB + Docker + UFW + OpenSSH + Git + Composer)

This post shares an All-in-One Bash Script to quickly set up a production-ready environment on Ubuntu 24.04.

✅ Web Server: Apache2 or Nginx (choose one)

✅ Database: MySQL or MariaDB (choose one)

✅ PHP-FPM: Default PHP + Multi PHP (7.4–8.3 optional)

✅ Apache (conf-available): Creates all PHP version .conf files automatically, but enables only the DEFAULT_PHP_VERSION

✅ Docker + Docker Compose (Official Repo)

✅ UFW Firewall (Optional)

✅ OpenSSH Server (Optional)

✅ Git (Optional)

✅ Composer (Optional)

✅ Features

✅ Web Server (Choose One)

INSTALL_APACHE2="yes/no"
INSTALL_NGINX="yes/no"

⚠️ If both are yes, the script will stop (port 80/443 conflict).

✅ Database (Choose One)

INSTALL_MYSQL="yes/no"
INSTALL_MARIADB="yes/no"

⚠️ If both are yes, the script will stop to avoid conflicts.

✅ OpenSSH (Optional)

INSTALL_OPENSSH="yes/no"

Installs and enables openssh-server (useful for fresh VPS setups).

✅ Git (Optional)

INSTALL_GIT="yes/no"

Installs git.

✅ Composer (Optional)

INSTALL_COMPOSER="yes/no"

Installs Composer globally as /usr/local/bin/composer.

✅ Composer requires PHP CLI to be available.

If you disable both Apache and Nginx, PHP might not be installed and Composer installation will be skipped.

✅ PHP-FPM Multi-Version Support

DEFAULT_PHP_VERSION="8.4"
ENABLE_MULTI_PHP_FPM="yes/no"

✅ For Apache, the script auto-creates configs inside:

/etc/apache2/conf-available/php7.4-fpm.conf
/etc/apache2/conf-available/php8.0-fpm.conf
/etc/apache2/conf-available/php8.1-fpm.conf
/etc/apache2/conf-available/php8.2-fpm.conf
/etc/apache2/conf-available/php8.3-fpm.conf
/etc/apache2/conf-available/php8.4-fpm.conf

✅ But enables only:

a2enconf php8.4-fpm (or your selected default)

✅ Recommended Default Setup (Example)

✅ Nginx + MariaDB + Docker + OpenSSH + Git + Composer

INSTALL_APACHE2="yes"
INSTALL_NGINX="no"

INSTALL_MYSQL="yes"
INSTALL_MARIADB="no"

INSTALL_DOCKER="yes"
INSTALL_OPENSSH="yes"
INSTALL_GIT="yes"
INSTALL_COMPOSER="yes"
ENABLE_UFW="yes"

⚠️ Security Note (Important)

This script creates /var/www/html/info.php for testing phpinfo().

✅ After testing, delete it immediately:

sudo rm /var/www/html/info.php

✅ The Full Script (Copy & Run)

✅ Save as: full_setup_ubuntu24.sh

✅ Run:

sudo bash full_setup_ubuntu24.sh

#!/bin/bash
set -euo pipefail

# -----------------------------
# CONFIG (EDIT THESE)
# -----------------------------
DEFAULT_PHP_VERSION="8.4"            # Default PHP-FPM version for Web Server
MYSQL_ROOT_PASSWORD="12345"          # Change this

ENABLE_MULTI_PHP_FPM="yes"           # yes/no (install & enable multiple FPM versions)
INSTALL_PHPMYADMIN="no"              # yes/no
ENABLE_UFW="yes"                     # yes/no

INSTALL_OPENSSH="yes"                # yes/no
INSTALL_GIT="yes"                    # yes/no
INSTALL_COMPOSER="yes"               # yes/no

INSTALL_APACHE2="yes"                 # yes/no
INSTALL_NGINX="no"                  # yes/no

INSTALL_MYSQL="yes"                   # yes/no
INSTALL_MARIADB="no"                # yes/no
INSTALL_DOCKER="yes"                 # yes/no
# -----------------------------

echo "==========================================="
echo " Ubuntu 24.04 Full Setup Script"
echo " OpenSSH Install: ${INSTALL_OPENSSH}"
echo " Git Install:     ${INSTALL_GIT}"
echo " Composer Install:${INSTALL_COMPOSER}"
echo " Apache Install:  ${INSTALL_APACHE2}"
echo " Nginx Install:   ${INSTALL_NGINX}"
echo " MySQL Install:   ${INSTALL_MYSQL}"
echo " MariaDB Install: ${INSTALL_MARIADB}"
echo " Docker Install:  ${INSTALL_DOCKER}"
echo " Default PHP:     PHP ${DEFAULT_PHP_VERSION}"
echo "==========================================="

# Check root
if [ "$EUID" -ne 0 ]; then
  echo "❌ Please run as root: sudo bash full_setup_ubuntu24.sh"
  exit 1
fi

# Conflict checks
if [ "${INSTALL_MYSQL}" = "yes" ] && [ "${INSTALL_MARIADB}" = "yes" ]; then
  echo "❌ ERROR: You cannot install both MySQL and MariaDB together."
  echo "   Set either INSTALL_MYSQL=yes OR INSTALL_MARIADB=yes"
  exit 1
fi

if [ "${INSTALL_APACHE2}" = "yes" ] && [ "${INSTALL_NGINX}" = "yes" ]; then
  echo "❌ ERROR: You cannot enable both Apache and Nginx together (port 80/443 conflict)."
  echo "   Set either INSTALL_APACHE2=yes OR INSTALL_NGINX=yes"
  exit 1
fi

echo "✅ Updating system..."
apt update && apt upgrade -y

echo "✅ Installing basic tools..."
apt install -y software-properties-common curl ca-certificates gnupg lsb-release unzip

# -----------------------------
# OpenSSH Install (Optional)
# -----------------------------
if [ "${INSTALL_OPENSSH}" = "yes" ]; then
  echo "✅ Installing OpenSSH Server..."
  apt install -y openssh-server
  systemctl enable --now ssh
else
  echo "⏭️ Skipping OpenSSH installation..."
fi

# -----------------------------
# Git Install (Optional)
# -----------------------------
if [ "${INSTALL_GIT}" = "yes" ]; then
  echo "✅ Installing Git..."
  apt install -y git
else
  echo "⏭️ Skipping Git installation..."
fi

# -----------------------------
# Apache2 Install (Optional)
# -----------------------------
if [ "${INSTALL_APACHE2}" = "yes" ]; then
  echo "✅ Installing Apache2..."
  apt install -y apache2
  systemctl enable --now apache2

  echo "✅ Enabling Apache modules for PHP-FPM..."
  apt install -y libapache2-mod-fcgid
  a2enmod proxy_fcgi setenvif
  systemctl restart apache2
else
  echo "⏭️ Skipping Apache2 installation..."
fi

# -----------------------------
# Nginx Install (Optional)
# -----------------------------
if [ "${INSTALL_NGINX}" = "yes" ]; then
  echo "✅ Installing Nginx..."
  apt install -y nginx
  systemctl enable --now nginx
else
  echo "⏭️ Skipping Nginx installation..."
fi

# -----------------------------
# MySQL Install (Optional)
# -----------------------------
if [ "${INSTALL_MYSQL}" = "yes" ]; then
  echo "✅ Installing MySQL Server..."
  apt install -y mysql-server
  systemctl enable --now mysql

  echo "✅ Setting MySQL root password + mysql_native_password..."
  mysql -u root <<MYSQL_SCRIPT
ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY '${MYSQL_ROOT_PASSWORD}';
FLUSH PRIVILEGES;
MYSQL_SCRIPT

  echo "✅ Testing MySQL root login..."
  mysql -u root -p"${MYSQL_ROOT_PASSWORD}" -e "SELECT 1;" >/dev/null
else
  echo "⏭️ Skipping MySQL installation..."
fi

# -----------------------------
# MariaDB Install (Optional)
# -----------------------------
if [ "${INSTALL_MARIADB}" = "yes" ]; then
  echo "✅ Installing MariaDB Server..."
  apt install -y mariadb-server
  systemctl enable --now mariadb

  echo "✅ Setting MariaDB root password..."
  mariadb -u root <<MARIADB_SCRIPT
ALTER USER 'root'@'localhost' IDENTIFIED BY '${MYSQL_ROOT_PASSWORD}';
FLUSH PRIVILEGES;
MARIADB_SCRIPT

  echo "✅ Testing MariaDB root login..."
  mariadb -u root -p"${MYSQL_ROOT_PASSWORD}" -e "SELECT 1;" >/dev/null
else
  echo "⏭️ Skipping MariaDB installation..."
fi

# -----------------------------
# PHP Install (Ondrej PPA)
# Only if Apache or Nginx is installed
# -----------------------------
PHP_INSTALLED="no"
if [ "${INSTALL_APACHE2}" = "yes" ] || [ "${INSTALL_NGINX}" = "yes" ]; then
  PHP_INSTALLED="yes"

  echo "✅ Adding PHP PPA (ondrej/php)..."
  add-apt-repository ppa:ondrej/php -y
  apt update -y

  echo "✅ Installing Default PHP ${DEFAULT_PHP_VERSION} (FPM + extensions + opcache)..."
  apt install -y \
  php${DEFAULT_PHP_VERSION} \
  php${DEFAULT_PHP_VERSION}-fpm \
  php${DEFAULT_PHP_VERSION}-cli \
  php${DEFAULT_PHP_VERSION}-common \
  php${DEFAULT_PHP_VERSION}-mysql \
  php${DEFAULT_PHP_VERSION}-curl \
  php${DEFAULT_PHP_VERSION}-mbstring \
  php${DEFAULT_PHP_VERSION}-xml \
  php${DEFAULT_PHP_VERSION}-zip \
  php${DEFAULT_PHP_VERSION}-gd \
  php${DEFAULT_PHP_VERSION}-intl \
  php${DEFAULT_PHP_VERSION}-bcmath \
  php${DEFAULT_PHP_VERSION}-opcache

  echo "✅ Enabling PHP-FPM service for ${DEFAULT_PHP_VERSION}..."
  systemctl enable --now php${DEFAULT_PHP_VERSION}-fpm

  # Optional: Multi PHP-FPM
  if [ "${ENABLE_MULTI_PHP_FPM}" = "yes" ]; then
    echo "✅ Installing multiple PHP-FPM versions..."
    for v in 7.4 8.0 8.1 8.2 8.3; do
      echo "➡️ Installing PHP ${v} FPM..."
      apt install -y \
      php${v} \
      php${v}-fpm \
      php${v}-cli \
      php${v}-common \
      php${v}-mysql \
      php${v}-curl \
      php${v}-mbstring \
      php${v}-xml \
      php${v}-zip \
      php${v}-gd \
      php${v}-intl \
      php${v}-bcmath \
      php${v}-opcache || true

      systemctl enable --now php${v}-fpm || true
    done
  fi

  # Set CLI default PHP
  echo "✅ Setting CLI default PHP to ${DEFAULT_PHP_VERSION}..."
  update-alternatives --set php /usr/bin/php${DEFAULT_PHP_VERSION} || true
  update-alternatives --set phar /usr/bin/phar${DEFAULT_PHP_VERSION} || true
  update-alternatives --set phar.phar /usr/bin/phar.phar${DEFAULT_PHP_VERSION} || true
  update-alternatives --set phpize /usr/bin/phpize${DEFAULT_PHP_VERSION} || true
  update-alternatives --set php-config /usr/bin/php-config${DEFAULT_PHP_VERSION} || true
else
  echo "⏭️ Skipping PHP installation because both Apache & Nginx are disabled..."
fi

# -----------------------------
# Composer Install (Optional)
# Requires PHP CLI
# -----------------------------
if [ "${INSTALL_COMPOSER}" = "yes" ]; then
  if command -v php >/dev/null 2>&1; then
    echo "✅ Installing Composer..."

    EXPECTED_CHECKSUM="$(php -r 'copy("https://composer.github.io/installer.sig", "php://stdout");')"
    php -r "copy('https://getcomposer.org/installer', 'composer-setup.php');"

    ACTUAL_CHECKSUM="$(php -r "echo hash_file('sha384', 'composer-setup.php');")"

    if [ "$EXPECTED_CHECKSUM" != "$ACTUAL_CHECKSUM" ]; then
      echo "❌ ERROR: Invalid Composer installer checksum"
      rm -f composer-setup.php
      exit 1
    fi

    php composer-setup.php --quiet --install-dir=/usr/local/bin --filename=composer
    rm -f composer-setup.php

    echo "✅ Composer installed: $(composer --version)"
  else
    echo "⚠️ Composer requested but PHP is not installed. Skipping Composer..."
  fi
else
  echo "⏭️ Skipping Composer installation..."
fi

# -----------------------------
# Apache PHP-FPM conf setup
# conf-available create all versions, enable only default
# -----------------------------
if [ "${INSTALL_APACHE2}" = "yes" ]; then
  echo "✅ Creating Apache PHP-FPM conf files in conf-available..."

  PHP_VERSIONS=()
  PHP_VERSIONS+=("${DEFAULT_PHP_VERSION}")

  if [ "${ENABLE_MULTI_PHP_FPM}" = "yes" ]; then
    PHP_VERSIONS+=(7.4 8.0 8.1 8.2 8.3)
  fi

  PHP_VERSIONS=($(printf "%s\n" "${PHP_VERSIONS[@]}" | sort -u))

  for v in "${PHP_VERSIONS[@]}"; do
    PHP_CONF="/etc/apache2/conf-available/php${v}-fpm.conf"
    echo "➡️ Creating: $PHP_CONF"

    cat > "$PHP_CONF" <<EOF
# Auto-generated PHP-FPM config: PHP ${v}
<IfModule proxy_fcgi_module>
    <FilesMatch \\.php$>
        SetHandler "proxy:unix:/run/php/php${v}-fpm.sock|fcgi://localhost/"
    </FilesMatch>
</IfModule>
EOF
  done

  echo "✅ Disabling other PHP-FPM confs (avoid conflict)..."
  for v in "${PHP_VERSIONS[@]}"; do
    if [ "$v" != "${DEFAULT_PHP_VERSION}" ]; then
      a2disconf "php${v}-fpm" >/dev/null 2>&1 || true
    fi
  done

  echo "✅ Enabling only default PHP-FPM conf: php${DEFAULT_PHP_VERSION}-fpm"
  a2enconf "php${DEFAULT_PHP_VERSION}-fpm"

  systemctl reload apache2
fi

# -----------------------------
# Nginx PHP-FPM config setup
# -----------------------------
if [ "${INSTALL_NGINX}" = "yes" ]; then
  echo "✅ Configuring Nginx for PHP-FPM (default PHP ${DEFAULT_PHP_VERSION})..."

  rm -f /etc/nginx/sites-enabled/default

  NGINX_SITE="/etc/nginx/sites-available/default-php-fpm"

  cat > "$NGINX_SITE" <<EOF
server {
    listen 80 default_server;
    listen [::]:80 default_server;

    root /var/www/html;
    index index.php index.html index.htm;

    server_name _;

    location / {
        try_files \$uri \$uri/ =404;
    }

    location ~ \\.php\$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php${DEFAULT_PHP_VERSION}-fpm.sock;
    }

    location ~ /\\.ht {
        deny all;
    }
}
EOF

  ln -sf "$NGINX_SITE" /etc/nginx/sites-enabled/default-php-fpm

  nginx -t
  systemctl reload nginx
fi

# -----------------------------
# PHP Info test file
# -----------------------------
if [ "${INSTALL_APACHE2}" = "yes" ] || [ "${INSTALL_NGINX}" = "yes" ]; then
  echo "✅ Creating PHP test file: /var/www/html/info.php"
  cat > /var/www/html/info.php <<EOF
<?php
phpinfo();
?>
EOF
fi

# -----------------------------
# Optional: phpMyAdmin
# -----------------------------
if [ "${INSTALL_PHPMYADMIN}" = "yes" ]; then
  echo "✅ Installing phpMyAdmin..."
  apt install -y phpmyadmin || true

  if [ "${INSTALL_APACHE2}" = "yes" ]; then
    systemctl reload apache2
  fi

  if [ "${INSTALL_NGINX}" = "yes" ]; then
    systemctl reload nginx
  fi
fi

# -----------------------------
# Docker Install (Optional)
# -----------------------------
if [ "${INSTALL_DOCKER}" = "yes" ]; then
  echo "✅ Installing Docker + Docker Compose (official)..."

  install -m 0755 -d /etc/apt/keyrings
  rm -f /etc/apt/keyrings/docker.gpg

  curl -fsSL https://download.docker.com/linux/ubuntu/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg
  chmod a+r /etc/apt/keyrings/docker.gpg

  echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
  https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "$VERSION_CODENAME") stable" \
  > /etc/apt/sources.list.d/docker.list

  apt update -y
  apt install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
  systemctl enable --now docker

  if [ -n "${SUDO_USER:-}" ]; then
    echo "✅ Adding user '$SUDO_USER' to docker group..."
    usermod -aG docker "$SUDO_USER"
  fi
else
  echo "⏭️ Skipping Docker installation..."
fi

# -----------------------------
# UFW Firewall (Optional)
# -----------------------------
if [ "${ENABLE_UFW}" = "yes" ]; then
  echo "✅ Setting up UFW firewall..."
  apt install -y ufw

  # Only allow SSH if OpenSSH install enabled
  if [ "${INSTALL_OPENSSH}" = "yes" ]; then
    ufw allow OpenSSH
  fi

  ufw allow 80/tcp
  ufw allow 443/tcp

  ufw --force enable
  ufw status verbose
fi

# -----------------------------
# Finished Summary
# -----------------------------
echo "==========================================="
echo "✅ INSTALLATION COMPLETE!"
echo "==========================================="
echo "OpenSSH Installed: ${INSTALL_OPENSSH}"
echo "Git Installed:     ${INSTALL_GIT}"
echo "Composer Installed:${INSTALL_COMPOSER}"
echo "Apache Installed:  ${INSTALL_APACHE2}"
echo "Nginx Installed:   ${INSTALL_NGINX}"
echo "MySQL Installed:   ${INSTALL_MYSQL}"
echo "MariaDB Installed: ${INSTALL_MARIADB}"
echo "Docker Installed:  ${INSTALL_DOCKER}"
echo ""
echo "OpenSSH:    systemctl status ssh"
echo "Apache:     systemctl status apache2"
echo "Nginx:      systemctl status nginx"
echo "MySQL:      systemctl status mysql"
echo "MariaDB:    systemctl status mariadb"
echo "PHP (CLI):  php -v | head -n 1"
echo "Git:        git --version"
echo "Composer:   composer --version"
echo "Docker:     docker --version"
echo "Compose:    docker compose version"
echo ""
echo "🔑 DB root password set to:"
echo "   ${MYSQL_ROOT_PASSWORD}"
echo ""
echo "✅ PHP test page (if web server installed):"
echo "   http://YOUR_SERVER_IP/info.php"
echo ""
echo "⚠️ IMPORTANT: Delete info.php after testing:"
echo "   sudo rm /var/www/html/info.php"
echo ""
echo "✅ If Docker group added, logout/login required for it to work without sudo."
echo "==========================================="

✅ Quick Troubleshooting

✅ Check services

systemctl status ssh
systemctl status nginx
systemctl status apache2
systemctl status mariadb
systemctl status mysql
systemctl status php8.4-fpm

✅ Check open ports

ss -tulpn | grep -E '(:22|:80|:443|:3306)'

✅ Done ✅

If you want, I can add these in the next version:

✅ INSTALL_SSL_CERTBOT="yes/no" (Let’s Encrypt auto SSL)

✅ INSTALL_REDIS="yes/no"

✅ INSTALL_FAIL2BAN="yes/no"

✅ per-site multi PHP config templates

Happy Hosting 🚀

Complete Step-by-Step Jenkins CI/CD Deployment on Ubuntu with GitLab

M. K. Tanjin Sarker — Thu, 25 Sep 2025 10:12:33 +0000

Step 1: Update Ubuntu & Install Dependencies

Install Java 17 (required by Jenkins), curl, and other dependencies:

sudo apt update
sudo apt install -y openjdk-17-jdk curl gnupg2 apt-transport-https software-properties-common

Step 2: Add Jenkins Repository

Add the Jenkins GPG key and repository:

curl -fsSL https://pkg.jenkins.io/debian/jenkins.io-2023.key | sudo tee \
    /usr/share/keyrings/jenkins-keyring.asc > /dev/null

echo deb [signed-by=/usr/share/keyrings/jenkins-keyring.asc] https://pkg.jenkins.io/debian binary/ | \
    sudo tee /etc/apt/sources.list.d/jenkins.list > /dev/null

Step 3: Install Jenkins

sudo apt update
sudo apt install -y jenkins

Step 4: Start & Enable Jenkins

sudo systemctl start jenkins
sudo systemctl enable jenkins
sudo systemctl status jenkins

Default Jenkins runs on port 8080.
To change the port:

sudo nano /etc/default/jenkins
# Change HTTP_PORT=8080 to HTTP_PORT=8008

sudo nano /lib/systemd/system/jenkins.service
# Add Environment="JENKINS_PORT=8008"

sudo systemctl daemon-reload
sudo systemctl restart jenkins

Verify port:

ss -tulnp | grep jenkins

Allow firewall access:

sudo ufw allow 8080

Open Jenkins in your browser: http://<jenkins-server-ip>:8080

Step 5: Unlock Jenkins

Get the initial admin password:

sudo cat /var/lib/jenkins/secrets/initialAdminPassword

Use this password to login via the browser.

Step 6: Install Recommended Plugins

Choose Install suggested plugins.
Create the first admin user and continue.

Step 7: Install Essential Plugins

Go to Manage Jenkins → Plugins → Available and install:

GitLab
SSH Agent
GitLab API

Restart Jenkins after installation.

Step 8: Setup SSH Access for Deployment

Generate SSH key for Jenkins user:

ssh-keygen -t rsa -b 4096 -C "jenkins@jenkins-server"

Copy the public key to your application server:

ssh-copy-id user@application-server-ip

Test password-less login:

ssh user@application-server-ip "ls -la"

Step 9: Add SSH Key to Jenkins Credentials

Go to Manage Jenkins → Credentials → Global → Add Credentials
Configure as:
- Kind: SSH Username with private key
- Scope: Global
- ID: deploy-private-key
- Username: root (or your server user)
- Private Key: Enter directly (paste your ~/.ssh/id_rsa)

Step 10: Add GitLab Access Token

In GitLab → Settings → Personal Access Tokens, create a token:
- Token Name: jenkins-server
- Expiration Date: As desired
- Scopes: Check API
Copy the generated token.
In Jenkins, add it as a credential:
- Kind: GitLab API token
- API Token: Paste the token
- ID: gitlab-access-token
Configure GitLab connection in Jenkins:
- Connection Name: gitlab.com
- GitLab Host URL: https://gitlab.com
- Credential: gitlab-access-token
- Apply/Save

Step 11: Add Application Server SSH Key to GitLab

On your application server:

ssh-keygen -t rsa -b 4096 -C "server.application"
cat ~/.ssh/id_rsa.pub

Add this public key in GitLab: Preferences → SSH Keys → Add new key

Step 12: Create Jenkins Pipeline Job

Go to New Item → Pipeline
Configure GitLab connection:
- Triggers: Check Build when a change is pushed to GitLab
Pipeline script example:

pipeline {
    agent any

    stages {
        stage('Deploy main') {
            steps {
                sshagent(['deploy-private-key']) {
                    sh "ssh -o StrictHostKeyChecking=no -p 22 user@application_server_ip 'cd /var/www/html/application && git pull origin main'"
                }
            }
        }
    }
}

Adjust the SSH port and paths as needed.

Step 13: Build & Deploy

Now, whenever you push to GitLab, Jenkins will:

Pull the latest code from the repository
Deploy it automatically to your application server

Check the Build History in Jenkins to verify successful deployments.

✅ Your CI/CD pipeline is now fully functional, secure, and automated!

How to Install and Manage Multiple PHP Versions (7.4 - 8.4) on Ubuntu with Apache.

M. K. Tanjin Sarker — Thu, 18 Sep 2025 12:27:14 +0000

🚀 PHP Multiple Versions (7.4 → 8.4) with Apache on Ubuntu

1️⃣ Add PHP PPA

sudo apt update
sudo apt install -y software-properties-common ca-certificates lsb-release apt-transport-https
sudo add-apt-repository -y ppa:ondrej/php
sudo apt update

2️⃣ Install PHP Versions

# PHP 7.4
sudo apt install -y php7.4 php7.4-cli php7.4-fpm

# PHP 8.0
sudo apt install -y php8.0 php8.0-cli php8.0-fpm

# PHP 8.1
sudo apt install -y php8.1 php8.1-cli php8.1-fpm

# PHP 8.2
sudo apt install -y php8.2 php8.2-cli php8.2-fpm

# PHP 8.3
sudo apt install -y php8.3 php8.3-cli php8.3-fpm

# PHP 8.4
sudo apt install -y php8.4 php8.4-cli php8.4-fpm

3️⃣ Install Important Extensions

# Replace X.X with version (7.4, 8.0, 8.1, 8.2, 8.3, 8.4)
sudo apt install -y phpX.X-cli phpX.X-fpm phpX.X-mysql phpX.X-xml phpX.X-curl phpX.X-mbstring phpX.X-zip phpX.X-bcmath phpX.X-gd phpX.X-intl phpX.X-readline phpX.X-soap phpX.X-opcache phpX.X-dev phpX.X-imagick phpX.X-pgsql phpX.X-sqlite3

👉 Covers Laravel, Symfony, WordPress, Drupal, Magento, APIs, image processing, DB drivers, and performance.

4️⃣ Check Installed Versions

php -v                              # Current CLI version
update-alternatives --list php      # All installed CLI versions
systemctl list-units | grep php     # Running PHP-FPM services
php -m                              # Installed extensions

5️⃣ Switch PHP (CLI)

Interactive:

sudo update-alternatives --config php

Direct:

sudo update-alternatives --set php /usr/bin/php8.3

Verify:

php -v

6️⃣ Switch PHP (Apache FPM)

Enable/disable PHP-FPM

sudo systemctl stop php7.4-fpm
sudo systemctl enable --now php8.3-fpm

Enable Apache modules/config

sudo a2enmod proxy_fcgi setenvif
sudo a2enconf php8.3-fpm
sudo a2disconf php7.4-fpm
sudo systemctl reload apache2

VirtualHost Example

    <FilesMatch \.php$>
        SetHandler "proxy:unix:/run/php/php8.3-fpm.sock|fcgi://localhost/"
    </FilesMatch>

Reload Apache:

sudo systemctl restart apache2

7️⃣ Test PHP

Create /var/www/html/info.php:

<?php phpinfo();

Open in browser:

http://localhost/info.php

🔄 Quick Reference

Switch CLI PHP

  sudo update-alternatives --config php

Switch Apache PHP-FPM

  sudo systemctl stop php8.0-fpm
  sudo systemctl start php8.2-fpm
  sudo a2enconf php8.2-fpm
  sudo a2disconf php8.0-fpm
  sudo systemctl reload apache2

✅ With this setup, you can:

Install PHP 7.4 → 8.4
Enable required extensions
Switch between versions for CLI & Apache
Verify with php -v and phpinfo()

Automating MySQL Backups with Bash Script & Cron

M. K. Tanjin Sarker — Mon, 25 Aug 2025 04:19:44 +0000

🚀 Automating MySQL Backups with Bash Script & Cron

Databases are the heart of most applications—and losing them can be a nightmare. Manual backups work for quick fixes, but in production environments, automated MySQL backups are essential.

In this guide, we’ll build a simple Bash script to back up MySQL databases, compress them, keep them for a fixed number of days, and schedule it with cron.

🔑 Why Automate Backups?

✅ Ensures you always have a recent copy of your data
✅ Reduces risk of human error
✅ Saves time compared to manual exports
✅ Easy to restore when disaster strikes

🛠 Prerequisites

A Linux server with MySQL/MariaDB installed
A user with access to all databases you want to back up
Basic knowledge of shell commands

1) Login as Root

sudo -i

2) Create a Backup Folder & Script File

mkdir -p /home/backup
touch /home/backup/backup-mysql.sh
nano /home/backup/backup-mysql.sh

3.1) Add the Backup Script for all Databases.

Paste this inside the file:

#!/bin/bash
#----------------------------------------
# MySQL Backup Script
#----------------------------------------

# 🔧 Configuration
HOST='mysql-localhost'      # MySQL server host
USER='mysql-username'       # Username
PASSWORD='mysql-password'   # Password
DAYS_TO_KEEP=5              # Delete backups older than X days
GZIP=1                      # 1 = gzip compression, 0 = plain .sql
BACKUP_PATH='/home/backup/mysql'   # Location to store backups
#TIMESTAMP=$(date +"%d_%m_%Y_%H_%M_%S")   # Date-time for unique file names
TIMESTAMP=$(date -d "yesterday" +"%d_%m_%Y") #Date-time for previous date file names. reminder here crontab use after 12 am

#----------------------------------------

# 📂 Create backup folder if not exists
if [ ! -d "$BACKUP_PATH" ]; then
  mkdir -p "$BACKUP_PATH"
fi

# 📋 Get database list
databases=$(mysql -h "$HOST" -u "$USER" -p"$PASSWORD" -e "SHOW DATABASES;" | tr -d "|" | grep -v Database)

# 🔄 Loop through databases
for DB in $databases; do
  # Skip system databases
  if [ "$DB" = 'information_schema' ] || [ "$DB" = 'performance_schema' ] || [ "$DB" = 'mysql' ] || [ "$DB" = 'sys' ]; then
    echo "Skipping database: $DB"
    continue
  fi

  # Backup (with or without compression)
  if [ "$GZIP" -eq 0 ]; then
    echo "Backing up database: $DB (no compression)"
    mysqldump -h "$HOST" -u "$USER" -p"$PASSWORD" --databases "$DB" --single-transaction --quick --extended-insert --compact --hex-blob --max-allowed-packet=256M --net-buffer-length=2M > "$BACKUP_PATH/${DB}-${TIMESTAMP}.sql"
  else
    echo "Backing up database: $DB (with compression)"
    mysqldump -h "$HOST" -u "$USER" -p"$PASSWORD" --databases "$DB" --single-transaction --quick --extended-insert --compact --hex-blob --max-allowed-packet=256M --net-buffer-length=2M | gzip -9 -c > "$BACKUP_PATH/${DB}-${TIMESTAMP}.sql.gz"
  fi
done

# 🧹 Delete old backups
if [ "$DAYS_TO_KEEP" -gt 0 ]; then
  echo "Deleting backups older than $DAYS_TO_KEEP days"
  find "$BACKUP_PATH"/* -mtime +"$DAYS_TO_KEEP" -exec rm {} \;
fi

3.2) Add the Backup Script for single Database.

Paste this inside the file:

#!/bin/bash
#----------------------------------------
# MySQL Backup Script
#----------------------------------------

# 🔧 Configuration
HOST='mysql-localhost'      # MySQL server host
USER='mysql-username'       # Username
PASSWORD='mysql-password'   # Password
DB='mysql-database'
DAYS_TO_KEEP=5              # Delete backups older than X days
GZIP=1                      # 1 = gzip compression, 0 = plain .sql
BACKUP_PATH='/home/backup/mysql'   # Location to store backups
#TIMESTAMP=$(date +"%d_%m_%Y_%H_%M_%S")   # Date-time for unique file names
TIMESTAMP=$(date -d "yesterday" +"%d_%m_%Y") #Date-time for previous date file names. reminder here crontab use after 12 am

#----------------------------------------

# Create the backup folder
if [ ! -d $BACKUP_PATH ]; then
  mkdir -p $BACKUP_PATH
fi


  # Backup (with or without compression)
  if [ "$GZIP" -eq 0 ]; then
    echo "Backing up database: $DB (no compression)"
    mysqldump -h "$HOST" -u "$USER" -p"$PASSWORD" --databases "$DB" --single-transaction --quick --extended-insert --compact --hex-blob --max-allowed-packet=256M --net-buffer-length=2M > "$BACKUP_PATH/${DB}-${TIMESTAMP}.sql"
  else
    echo "Backing up database: $DB (with compression)"
    mysqldump -h "$HOST" -u "$USER" -p"$PASSWORD" --databases "$DB" --single-transaction --quick --extended-insert --compact --hex-blob --max-allowed-packet=256M --net-buffer-length=2M | gzip -9 -c > "$BACKUP_PATH/${DB}-${TIMESTAMP}.sql.gz"
  fi


# Delete old backups
if [ "$DAYS_TO_KEEP" -gt 0 ] ; then
  echo "Deleting backups older than $DAYS_TO_KEEP days"
  find $BACKUP_PATH/* -mtime +$DAYS_TO_KEEP -exec rm {} \;
fi

4) Make the Script Executable

chmod +x /home/backup/backup-mysql.sh

5) Test the Script

Run it manually:

/home/backup/backup-mysql.sh

Backups will be stored inside:

/home/backup/mysql/

6) Automate with Cron

Open crontab:

crontab -e

Add this line to run the backup daily at 2:30 AM:

30 2 * * * /home/backup/backup-mysql.sh >/dev/null 2>&1

Restart cron service:

sudo systemctl restart cron

🧠 How It Works (Script Breakdown)

Configuration variables → Define MySQL credentials, backup path, retention days.
Timestamp → Ensures unique filenames (dbname-24_08_2025_02_30_00.sql.gz).
Timestamp → Ensures previous filenames (dbname-24_08_2025.sql.gz).
Database filtering → Skips system databases (information_schema, etc.).
mysqldump with --single-transaction → Ensures consistent snapshot for InnoDB without locking tables.
gzip compression → Saves space.
Retention policy (find -mtime) → Deletes backups older than 5 days.

✅ Conclusion

With just a few lines of Bash and a cron job, you’ve automated MySQL backups.

Backups run every day at 2:30 AM
Old backups older than 5 days are automatically removed
The script is simple to extend for remote storage, logging, or notifications

Automating backups is a small investment that can save you hours—or even your entire project—in case of data loss.

Fail2Ban: The Essential Security Tool for Preventing Attacks on Linux Servers

M. K. Tanjin Sarker — Sun, 24 Aug 2025 17:38:40 +0000

🚀 Fail2Ban Setup with Email Alerts (msmtp + Gmail)

This guide explains how to install, configure, and use Fail2Ban to protect your server from brute-force attacks, block malicious requests, and send email alerts via msmtp + Gmail.

📌 1. Install Fail2Ban

sudo apt update
sudo apt install fail2ban -y

Enable and start the service:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo systemctl status fail2ban

📌 2. Configure Fail2Ban

Copy default configuration:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Or open directly:

sudo nano /etc/fail2ban/jail.local

Example `jail.local` configuration:

[DEFAULT]
# Ban settings
bantime  = 1m
findtime = 10m
maxretry = 2
backend  = auto
banaction = ufw
action = %(action_mwl)s

# Email notification
destemail = tanjinsarker@gmail.com
sender    = tanjinfail2ban@gmail.com
mta       = sendmail

# Ignore trusted IPs
ignoreip = 127.0.0.1/8 ::1

# Logging
loglevel  = INFO
logtarget = /var/log/fail2ban.log


# 🚀 Protect SSH
[sshd]
enabled = true

# 🚀 Block malicious file requests (.php, .asp, .jsp, .exe)
[php-url-ban]
enabled   = true
filter    = php-url
port      = http,https
logpath   = /var/www/html/access.log

📌 3. Create Custom Fail2Ban Filter

Create a new filter for suspicious .php, .asp, .jsp, .exe requests:

sudo nano /etc/fail2ban/filter.d/php-url.conf

Add the following:

[Definition]
failregex = ^<HOST> -.*"(GET|POST).*\.(php|asp|jsp|exe)(\?.*)? HTTP.*"
ignoreregex =

📌 4. Manage Fail2Ban

Check active jails:

sudo fail2ban-client status | grep "Jail list" | cut -d: -f2 | tr ',' '\n' | while read jail; do
  echo "Jail: $jail"
  sudo fail2ban-client status "$jail" | grep "Banned IP list"
done

Ban / Unban IPs manually:

# Ban IP
sudo fail2ban-client set sshd banip 192.168.68.129

# Unban IP
sudo fail2ban-client set sshd unbanip 192.168.68.129

# Check if an IP is banned
sudo fail2ban-client get sshd banip 192.168.68.129

📌 5. Firewall Configuration

Ensure only one firewall backend is active.

Check status:

sudo systemctl is-active ufw
sudo systemctl is-active firewalld
sudo systemctl is-active nftables

Disable unused backends:

# Disable firewalld
sudo systemctl stop firewalld
sudo systemctl disable firewalld
sudo systemctl mask firewalld

# Disable nftables
sudo systemctl stop nftables
sudo systemctl disable nftables
sudo systemctl mask nftables

Re-enable if needed:

sudo systemctl unmask firewalld
sudo systemctl unmask nftables

📌 6. Install msmtp (Email Relay)

sudo apt install msmtp msmtp-mta mailutils

📌 7. Configure msmtp

Edit config:

sudo nano /etc/msmtprc

Example msmtprc:

defaults
auth on
tls on
tls_trust_file /etc/ssl/certs/ca-certificates.crt
logfile ~/.msmtp.log

account gmail
host smtp.gmail.com
port 587
from tanjinfail2ban@gmail.com
user tanjinfail2ban@gmail.com
password *********
account default : gmail

Set permissions:

sudo chown root:root /etc/msmtprc
sudo chmod 600 /etc/msmtprc

If running as non-root user:

sudo chown $USER:$USER ~/.msmtprc
sudo chmod 600 ~/.msmtprc

Or make globally readable:

sudo chmod 644 /etc/msmtprc
sudo systemctl restart fail2ban

Restart Fail2ban:

sudo systemctl restart fail2ban

📌 8. Test Email Sending

echo -e "Subject: test\n\nThis is a test email" | msmtp --debug -a gmail tanjinsarker@gmail.com

Check your inbox to verify delivery.

📌 9. Testing Fail2Ban Functionality

Test SSH protection:

Attempt multiple failed SSH logins from a different IP (up to maxretry).
Check if the IP gets banned:

sudo fail2ban-client status sshd

Verify email notification was sent.

Test Web filter (`php-url-ban`):

Simulate a request to a forbidden URL (e.g., .php, .asp):

curl http://your-server-ip/test.php

Check if the IP appears in the banned list:

sudo fail2ban-client status php-url-ban

Check your email for the ban alert.

Test Filter Regex Manually

Before banning, you can test the filter regex against your access log:

sudo fail2ban-regex /var/www/html/access.log /etc/fail2ban/filter.d/php-url.conf

This will:

Show which lines match the filter.
Confirm your php-url filter works correctly.
Help troubleshoot if IPs are not being banned.

📌 10. SSH Successful Login Email Alerts

This guide explains how to configure your server so that every successful SSH login triggers an email alert. This method uses PAM (Pluggable Authentication Modules), which integrates directly with the SSH login process.

Requirements

A working mail service on your server (e.g., postfix, sendmail, or an SMTP relay)
Root or sudo access

Step 1: Edit PAM SSH Configuration

Open the PAM configuration for SSH:

sudo nano /etc/pam.d/sshd

At the end of the file, add the following line:

session optional pam_exec.so seteuid /usr/local/bin/ssh-login-alert.sh

This tells PAM to run our custom script on every successful SSH login.

Step 2: Create the Alert Script

Create a new script at /usr/local/bin/ssh-login-alert.sh:

sudo nano /usr/local/bin/ssh-login-alert.sh

Paste the following content:

#!/bin/bash

USERNAME=$(whoami)
IP=$(echo $PAM_RHOST)
HOST=$(hostname)
DATE=$(date '+%Y-%m-%d %H:%M:%S')

MESSAGE="SSH Login on $HOST
User: $USERNAME
From: $IP
Date: $DATE"

echo "$MESSAGE" | mail -s "SSH Login Alert on $HOST" you@example.com

🔧 Replace you@example.com with your actual email address.

Step 3: Make Script Executable

Run:

sudo chmod +x /usr/local/bin/ssh-login-alert.sh

Step 4: Restart SSH Service

Apply changes by restarting SSH:

sudo systemctl restart sshd

Step 5: Test

Log out of your server.
Log back in via SSH.
Check your email inbox.

You should receive an alert similar to:

SSH Login on myserver
User: root
From: 192.168.1.100
Date: 2025-08-27 12:34:56

Notes

Ensure your mail system is properly configured; otherwise, emails will not be delivered.
For added reliability, consider also logging alerts to a file.
This method works for all SSH users system-wide.

✅ Done! You now receive an email on every successful SSH login.

✅ Final Notes

Fail2Ban is now protecting SSH and web access logs from malicious requests.
Emails will be sent using msmtp (Gmail SMTP relay).
Always secure your Gmail account with an App Password (never your real Gmail password).

DEV Community: M. K. Tanjin Sarker

Laravel Permission Hardening Script

Laravel File Permission Hardening for Multi-Developer Production Server

Project Structure

Permission Strategy

Why Use 2775 Permissions?

Laravel Permission Hardening Script

How to Use the Script

Important Git Rule

Laravel Writable Directories

Security Notes

Final Recommended Structure

Result

Conclusion

Ubuntu 24.04 Setup Script: Nginx/Apache, PHP-FPM, MySQL/MariaDB, Docker, UFW

✅ Ubuntu 24.04 Full Server Setup Script (Apache/Nginx + PHP-FPM Multi Version + MySQL/MariaDB + Docker + UFW + OpenSSH + Git + Composer)

✅ Features

✅ Web Server (Choose One)

✅ Database (Choose One)

✅ OpenSSH (Optional)

✅ Git (Optional)

✅ Composer (Optional)

✅ PHP-FPM Multi-Version Support

✅ Recommended Default Setup (Example)

✅ Nginx + MariaDB + Docker + OpenSSH + Git + Composer

⚠️ Security Note (Important)

✅ The Full Script (Copy & Run)

✅ Quick Troubleshooting

✅ Check services

✅ Check open ports

✅ Done ✅

Complete Step-by-Step Jenkins CI/CD Deployment on Ubuntu with GitLab

Step 1: Update Ubuntu & Install Dependencies

Step 2: Add Jenkins Repository

Step 3: Install Jenkins

Step 4: Start & Enable Jenkins

Step 5: Unlock Jenkins

Step 6: Install Recommended Plugins

Step 7: Install Essential Plugins

Step 8: Setup SSH Access for Deployment

Step 9: Add SSH Key to Jenkins Credentials

Step 10: Add GitLab Access Token

Step 11: Add Application Server SSH Key to GitLab

Step 12: Create Jenkins Pipeline Job

Step 13: Build & Deploy

How to Install and Manage Multiple PHP Versions (7.4 - 8.4) on Ubuntu with Apache.

🚀 PHP Multiple Versions (7.4 → 8.4) with Apache on Ubuntu

1️⃣ Add PHP PPA

2️⃣ Install PHP Versions

3️⃣ Install Important Extensions

4️⃣ Check Installed Versions

5️⃣ Switch PHP (CLI)

6️⃣ Switch PHP (Apache FPM)

Enable/disable PHP-FPM

Enable Apache modules/config

VirtualHost Example

7️⃣ Test PHP

🔄 Quick Reference

Automating MySQL Backups with Bash Script & Cron

🚀 Automating MySQL Backups with Bash Script & Cron

🔑 Why Automate Backups?

🛠 Prerequisites

1) Login as Root

2) Create a Backup Folder & Script File

3.1) Add the Backup Script for all Databases.

3.2) Add the Backup Script for single Database.

4) Make the Script Executable

5) Test the Script

6) Automate with Cron

🧠 How It Works (Script Breakdown)

✅ Conclusion

Fail2Ban: The Essential Security Tool for Preventing Attacks on Linux Servers

🚀 Fail2Ban Setup with Email Alerts (msmtp + Gmail)

📌 1. Install Fail2Ban

📌 2. Configure Fail2Ban

Copy default configuration:

Example jail.local configuration:

📌 3. Create Custom Fail2Ban Filter

📌 4. Manage Fail2Ban

Check active jails:

Why Use `2775` Permissions?

Example `jail.local` configuration:

Test Web filter (`php-url-ban`):