A Flarum Installation Guide For Dummies And The Truly Clueless

ron_jeremy

I wanted to try Flarum for the longest time but simply did not have the skills to install it. Time and time again I would try but I would get stuck at various points and just give up out of pure frustration.

Yesterday, I finally got Flarum installed and I was over the moon with excitement and a sense of accomplishment! After playing in the admin panel for the better part of the last 2 days, I thought I'd share my install method so others that have been wanting to try Flarum can finally get to do so.

This guide is for installing Flarum on a DigitalOcean LAMP Server on Ubuntu 14.04

DISCLAIMERS:

A: I am a total newbie, and have written this how-to article simply to help other newbies having difficulty installing Flarum. This guide will take you through the installation process that (finally) worked for me.

B: There might be some bad info here. I am not a security expert, so I take no responsibility if anything ‘bad’ happens to your Flarum installation.

C: This installation guide assumes you are using Flarum in a test environment.

D: I am hoping some experienced members can look through this and offer any suggestions or correct any errors or bad advice I might have given.

Ok, let’s get cracking!

SETTING UP YOUR DIGITALOCEAN DROPLET

Create an account on DigitalOcean. Login in with your username and password and create a new Droplet.

Click on One-click Apps and select LAMP on 14.04. I chose the $10/month option since I don’t know if the $5 setup will suffice or not. Select the geographical area that best suits your community (I use San Francisco). At the bottom where it says ‘Select Additional Options’ I normally select the first three (3) checkboxes.

CONNECTING TO YOUR DROPLET VIA SSH

Check your email for the DigitalOcean account info that was sent to you and copy the password.
Open up your terminal app (if you’re on a Mac) or download and install Putty (for Windows users) and connect to your server. On a Mac type the following into the terminal:

ssh root@your.servers.ip.address

Type

yes

Hit Command+V (or CTRL+V for Windows) to paste the password you copied earlier
Hit Command+V again (or CTRL+V for Windows)
Type your new root password
Type your new root password again

NOTE: You will see your server’s MOTD (message of the day). Write down the MySQL password as you will need it later. If you lose it you can always logout and login again to see the MOTD and password.

CREATE A NEW USER

adduser flarum

(this will create a new user called flarum; change it to your liking if you want to use a different name).

You will be asked to enter and confirm a password for this user (just hit Enter for the rest of the questions).

Now we must give our new user sudo privileges:

visudo

Search for the following line:

root ALL=(ALL:ALL) ALL

Enter your new user directly below so it looks like this (here, I will do it for my newly created ‘flarum’ user)

root ALL=(ALL:ALL) ALL
flarum ALL=(ALL:ALL) ALL

Type Ctrl+X to exit and then type Y (to save the changes) then hit Enter once more to exit the Vi editor.

Now, your new user is able to execute commands with administrative privileges. Let's logout of the root account:

logout

ssh flarum@your.servers.ip.address

(if you chose different name for your newly created user then use it instead of flarum)

UPDATING UBUNTU

sudo apt-get update && sudo apt-get upgrade

(you might be asked to enter the password you set for this new user)

SETTING A SWAPFILE & TWEAKS

The DigitalOcean Droplet we create will not come with a swapfile by default, so we will add one and make a couple other adjustments.

Let’s create the file first. Here, we will be creating a 2GB file:

sudo fallocate -l 2G /swapfile

Now we enable the file:

sudo chmod 600 /swapfile

sudo mkswap /swapfile

sudo swapon /swapfile

Now we make the swapfile permanent:

sudo nano /etc/fstab

At the bottom of the file add the following line:

/swapfile   none    swap    sw    0   0

Type CTRL+X to exit the editor, then hit Y to save the changes, and hit Enter again to exit.

We can also make a couple tweaks:

sudo sysctl vm.swappiness=10

sudo sysctl vm.vfs_cache_pressure=50

Now we make the above 2 tweaks permanent:

sudo nano /etc/sysctl.conf

At the bottom of the file add the following 2 lines:

vm.swappiness=10
vm.vfs_cache_pressure=50

Hit CTRL+X to exit, then hit Y to save and hit Enter again to exit.

ENABLE APACHE MOD REWRITE

sudo a2enmod rewrite

(you might have to enter your user password)

Now we must restart Apache:

sudo service apache2 restart

Now we edit the default VirtualHost to use mod_rewrite from within .htaccess files:

sudo nano /etc/apache2/sites-available/000-default.conf

Search for “DocumentRoot /var/www/html” and add the following lines directly below it:

<Directory "/var/www/html">
    AllowOverride All
</Directory>

Hit CTRL+X to exit, then Y to save, and Enter to close the editor. Now we must restart Apache:

sudo service apache2 restart

INSTALLING COMPOSER (GLOBALLY)

sudo curl -sS https://getcomposer.org/installer | php

sudo mv composer.phar /usr/local/bin/composer

INSTALLING FLARUM

I am hoping for some input from experienced members on this part because I don’t know if I’m doing this right or not, but it seems to get the job done.

Navigate to your web directory:

cd /var/www/html

You will notice there are two (2) files in this folder, index.html and info.php. For reasons unknown to me, Flarum will not install into a folder that is not empty, so I delete these 2 files. However, before I delete them I first connect to my server via FTP and download the files to my computer just in case I need them in the future.

sudo rm index.html

sudo rm info.php

Now let’s install Flarum:

sudo composer create-project flarum/flarum . --stability=beta

You will notice the Flarum installer has paused and is waiting for your Token.

Notice the web address at the bottom of the terminal window? Well, you need to go to that address in your browser, however, if you don’t have a GitHub account you will need to create one first. Once you have your GitHub account, paste the address into your browser. Do not change any settings, just click the 'Generate Token" at the bottom of the screen and copy/paste it into the terminal and hit enter to finish with the Flarum installer.

Note: you should copy/paste the token into a text file for future safe keeping.

Now you can access your Flarum installation by typing your.servers.ip.address in your browser:

Uh oh, we have problems! Looks like we have issues with directory permissions.

Don’t panic, you’re almost home!

DIRECTORY PERMISSIONS

We still need to make a couple more changes before we can successfully access the Flarum admin panel.

First, we need to give ownership of the following folders to Apache (known as the www-data user to the Operating System):

sudo chgrp www-data /var/www/html

sudo chgrp -R www-data /var/www/html/assets

sudo chgrp -R www-data /var/www/html/extensions

sudo chgrp -R www-data /var/www/html/storage

sudo chmod 775 /var/www/html

sudo chmod -R 775 /var/www/html/assets

sudo chmod -R 775 /var/www/html/extensions

sudo chmod -R 775 /var/www/html/storage

FLARUM SETUP

Now refresh the page in your web browser and you will see the directory issues have been solved.

Woohoo, you did it!

MYSQL SETUP

Not so fast, you still have a couple steps to go! You will notice that MySQL info is required. We will need to access the MySQL shell to create a database. First, we secure MySQL:

mysql_secure_installation

Type your root password when prompted. Now you will see: "You already have a root password set, so you can safely answer 'n'."

Enter n to not change the MySQL root password
Enter Y for the next question(s)

Now we access the MySQL shell:

mysql -u root -p

You are asked for your MySQL root password (this is NOT the root user password). Remember the password you wrote down way back at the end of Section 2? Now enter that password and hit Enter. If you didn’t write it down simply logout of your server and login again to see the MOTD (message of the day) along with your MySQL password. There is likely a faster way to show the MOTD but I am unaware of it.

Let’s see the databases already installed:

SHOW DATABASES;

You will see the following three (3) default databases. I have no idea whether they should be removed or not so I just leave them alone.

information_schema
mysql
performance_schema

Let’s create our database. I’m going to call mine ‘flarum’:

CREATE DATABASE flarum;

If you list the databases again you will see your new database:

SHOW DATABASES;

information_schema
flarum
mysql
performance_schema

Ok, let’s exit the MySQL shell:

CTRL+C

Now go back to Section 10 and complete the setup:

Forum Title: Enter the name of your new forum.

MySQL Host: Leave this as the default (localhost)
MySQL Database: Enter your database name (in my example above I used flarum)
MySQL Username: root
MySQL Password: Enter the password you copied from your server’s MOTD at the end of Section 2
Table Prefix: I just use some descriptive identifier like myforum01_

Admin Username: admin (or whatever you like to use)
Admin Email: email for your admin account
Admin Password: the admin password you want to use

Voila!

webeindustry

ron_jeremy sudo chgrp www-data /var/www/html
sudo chgrp -R www-data /var/www/html/assets
sudo chgrp -R www-data /var/www/html/extensions
sudo chgrp -R www-data /var/www/html/storage

This is redundant. You only need to

 chown www-data: /var/www/html -R

Another note, directories should be 755, weberver files should be 644 for better security.

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;

luceos

ron_jeremy Click on One-click Apps and select LAMP on 14.04.

TorchPE

I suggest using LAMP on 16.04 now.

Aesahaettr

Oh my god, this needs to be simplified. I remember I installed beta 1 and it was super easy. As in pretty much "upload and unzip this file" easy.

ron_jeremy

Aesahaettr Yeah, it's long. I wrote it from a ELI5 point of view.

[deleted]

Aesahaettr unfortunately you can no longer just upload and unzip

Aesahaettr

ron_jeremy Which is perfect for people like me! My comment was just in regard to Flarum needing to go back to the old method asap.

ron_jeremy

Aesahaettr now that I've done it a couple times it's not so bad.

jordanjay29

It might be easier to read if you encapsulate the command strings inside [code][/code] tags. Nice work, though, this should be helpful for new folks.

Kulga

nice! step by step command involving all the components takes awhile

I didn't read through it completely but one thing
- To make it more readable you can use code tags for commands and output and such

CREATE DATABASE flarum;

If you list the databases again you will see your new database:

SHOW DATABASES;

information_schema
flarum
mysql
performance_schema

edit: oops, slow on the post

Kulga

Looking through - some thoughts

Creating a new user is done to separate privileges from admin level to normal level. A fail-safe if that user has software running (like flarum) that is exploited and gains shell access, cannot delete or modify critical system files. the separated user should not need root access. Root level commands should be done through root itself or a account that isn't serving stuff accessible by the web.
A separate user for network accessible files is a fundamental part of linux security so +1.

UPDATING UBUNTU
sudo apt-get update

This command only synces changes. It does not update programs. From man page of apt-get

update is used to resynchronize the package index files from their sources.

To both update and then upgrade a system you can use this common command which combines the syncing and actual upgrade. If curious, the && stands for "If the preceding command exited successfully, do this command":

sudo apt-get update && sudo apt-get upgrade

A big +1 for using appropriate permissions and usage of groups rather then saying "do chmod -R 777"

Another +1 for using terminal mysql commands to create the database. However, newbies may be more comfortable using phpmyadmin. It does however involve additional steps of setting that up.

I would suggest modifying the thread title to include digitalocean and apache as these seem to be integral to your guide.

I am a total newbie

I'd rank you higher then that. You clearly have spent time learning a lot about the terminal

webeindustry

Kulga Creating a new user is done to separate privileges from admin level to normal level. A fail-safe if that user has software running (like flarum) that is exploited and gains shell access, cannot delete or modify critical system files. the separated user should not need root access. Root level commands should be done through root itself or a account that isn't serving stuff accessible by the web.
A separate user for network accessible files is a fundamental part of linux security so +1.

Okay, so if this were the case it would make good sense to me, but how does that actually work? Also, isn't that what the www-data, and apache user are? When I think of an "admin user" I think of the root account. Perhaps I am a bit naive.

So I am a hacker and am looking through code inside of flarum, this code will in some way leak information which gives me shell access? I don't get this one. All of my servers disable root login by any means, and disable password login. You can only access the shell with an ssh key by my personal user which I then use inside to elevate to root access. Creating additional users and groups always seemed like a "best practice" that only applied to mission-critical, enterprise-level projects, but was more assumed to be best in every instance than truly necessary. If I had other people logging into my server it would make sense, as a semi-loner it seems to make little sense.

To reiterate, the default webserver user has no shell access, no acct login, and seems the best default for web apps. Assigning a unique group/user for a web app seems necessary only when there is other players logging into the webserver itself. I wonder why you think it's possible for someone to gain access to critical system files by way of the www-user acct? If this is the case, please explain and I'll update my security measures accordingly.

Thanks.

ron_jeremy

Thanks for the suggestions @jordanjay29 and @Kulga . I added the 'code' tags and it does look much more readable!

luceos

Adding a user to sudo can be done using:

sudo adduser flarum sudo

Which adds user flarum to the sudo group 🙂

ron_jeremy

luceos Does it do exactly the same thing? If so, I will amend my post with your suggestion.

Kulga

ron_jeremy

In visudo

 # Allow members of group sudo to execute any command
%sudo ALL=(ALL:ALL) ALL

When you make a user part of the sudo group, you authorize that user for those privelges. So it does not do the same thing, but will give that user identical permissions as your guide illustrates above.
Different approach, same result.

Kulga

or for existing users to add on groups

gpasswd -a user group
usermod -aG group user

adding accounts with a "lower-level" tool

useradd -G group user

Cat skinning 😉

Franz

webeindustry This is redundant. You only need to

chown www-data: /var/www/html -R

Nope? When you do that, all Flarum subdirectories (including the source code) will be writable by the web server. Which we do not want, in case there is some kind of security issue.

Kulga

webeindustry Another note, directories should be 755, weberver files should be 644 ~~for better security.~~

You are generally correct, in most cases permissions of 755 and 644 (for directories and files) is a good security practice. It is also applicable in web servers which many guides frequently direct exactly what you wrote

chown www-data: /var/www/html -R

As the method of setting up permissions and ownership.

Let's cover better security - permissions are only half the battle. File ownership and what group it belongs to complement the permissions. In the guide above, you may notice that the commands given do not change the owner of the file, rather the group of the file. Then the subsequent command gives permissions of 775 to assets, extensions and storage.

This does two things and permits one

Causes the webserver user (www-data commonly) to have write access only to the directories it requires write access. If the entire directory belongs to the webserver user group, other directories can be *5* and files are *4* (the first and last are irrelevant in this case), and read access would be granted as well.
The files are completely owned by the system user (flarum)
If the user is part of the webusers users group, elevated privileges are not required - which permits this level of security in most hosting environments.

Technically, the directories permissions could exclude the world ones, leaving 750 (and 770) - which can be very useful.

Franz When you do that, all Flarum subdirectories (including the source code) will be writable by the web server.

By using groups and owners, you can more selectively fine grain write access. Less write access is always better, whether protecting against the program itself or hackers. ?

webeindustry

Kulga

www-data: changes both ownership and group. It's the same as www-data:www-data

Franz

webeindustry To reiterate, the default webserver user has no shell access, no acct login, and seems the best default for web apps. Assigning a unique group/user for a web app seems necessary only when there is other players logging into the webserver itself. I wonder why you think it's possible for someone to gain access to critical system files by way of the www-user acct? If this is the case, please explain and I'll update my security measures accordingly.

I think the issue is that - especially with your setup - the web application (i.e. Flarum) is still your server's biggest surface to the outside world, and therefore also the biggest attack surface. So, if through any security issue in Flarum's code, attackers are able to execute PHP code (or even shell commands) on the server, you want them to be limited in what they can do as much as possible.

Kulga

webeindustry To reiterate, the default webserver user has no shell access, no acct login

Franz So, if through any security issue in Flarum's code, attackers are able to execute PHP code (or even shell commands) on the server

Should through flarum (or any php software), they be able to execute a command like /bin/bash (or another shell), they would have shell access to your server.
However, this will be through the webserver user (www-data). More precisely, the user used for php execution. By default, these system users are unprivileged - intended to be a scapegoat during a compromise.
Franz put it much more concise then me ?