I'm quite new to Ubuntu Server (14.04) and I need to make sure Nginx/php-fpm/MySQL start up automatically on boot. Where do I need to check to make sure they are set to start on boot and how to set them up to boot if needed?
Also which is the best way to perform a security audit on the server? Is there some software which will do this and produce a report?
The simple test is rebooting but you can inspect how things are linked in quite easily.
Nginx uses an old-fashioned init script at /etc/init.d/nginx which is symlinked into various /etc/rc.n directories (which the system executes at boot). You can confirm:
$ find /etc/rc?.d -iname '*nginx*' -exec file {} +
/etc/rc0.d/K20nginx: symbolic link to `../init.d/nginx'
/etc/rc1.d/K20nginx: symbolic link to `../init.d/nginx'
/etc/rc2.d/S20nginx: symbolic link to `../init.d/nginx'
/etc/rc3.d/S20nginx: symbolic link to `../init.d/nginx'
/etc/rc4.d/S20nginx: symbolic link to `../init.d/nginx'
/etc/rc5.d/S20nginx: symbolic link to `../init.d/nginx'
/etc/rc6.d/K20nginx: symbolic link to `../init.d/nginx'
The other two use Upstart scripts at /etc/init/php5-fpm.conf and /etc/init/mysql.conf. Upstart is the main init engine in 14.04 so unless these have been edited, they should stay up.
The security audit is really dependant on what store and what you need. If you need simple PCI-DSS compliance, it's often easiest to farm it out to a third party which will scan your machine.
But that doesn't mean it's secure. Server security starts with SSH security but extends well through where you keep your data, what logs you retain, etc etc. There isn't an off-the-shelf answer for that; it's a manual slog through everything in the server.
If you don't know what you're doing in that respect, hire a pro. It's cheaper than the alternative.
