Step-by-Step Ubuntu Server Setup for Production OJS Publishing

When spinning up a fresh VPS or dedicated physical server for Open Journal Systems, security begins at the base operating system level. Log in as root and immediately update package indices:

apt update && apt upgrade -y

Create a dedicated system administrator user with sudo privileges and immediately disable direct root SSH logins:

adduser ojsadmin

usermod -aG sudo ojsadmin

Edit /etc/ssh/sshd_config to set PermitRootLogin no and PasswordAuthentication no, requiring cryptographic SSH key pairs for all future terminal connections. Restart the SSH daemon:

systemctl restart ssh

Lock down all unneeded server ports using the Uncomplicated Firewall (UFW). Only SSH, HTTP, and HTTPS should be accessible from the public internet:

ufw default deny incoming

ufw default allow outgoing

ufw allow OpenSSH

ufw allow 'Nginx Full'

ufw enable

Install the Nginx web server alongside PHP-FPM and required extensions:

apt install -y nginx software-properties-common

add-apt-repository ppa:ondrej/php -y

apt update

apt install -y php8.1-fpm php8.1-cli php8.1-mysql php8.1-xml php8.1-mbstring php8.1-curl php8.1-gd php8.1-intl php8.1-zip php8.1-bcmath

Configure the PHP-FPM pool in /etc/php/8.1/fpm/pool.d/www.conf. Adjust pm = dynamic, pm.max_children = 50, pm.start_servers = 10, pm.min_spare_servers = 5, and pm.max_spare_servers = 20 based on available server RAM. Restart PHP-FPM:

systemctl restart php8.1-fpm

Install MariaDB Server:

apt install -y mariadb-server

mysql_secure_installation

Create the OJS database and dedicated database user with strict UTF-8 Unicode character support:

mysql -u root -p

CREATE DATABASE ojs_database CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci;

CREATE USER 'ojs_user'@'localhost' IDENTIFIED BY 'StrongGeneratedPasswordHere';

GRANT ALL PRIVILEGES ON ojs_database.* TO 'ojs_user'@'localhost';

FLUSH PRIVILEGES;

EXIT;

Create two primary directory trees: the web application root and the secure manuscript files repository:

mkdir -p /var/www/ojs

mkdir -p /var/ojs_files

Download the verified OJS release tarball from the Public Knowledge Project and extract it into /var/www/ojs. Set proper Linux ownership and security permissions:

chown -R www-data:www-data /var/www/ojs

chown -R www-data:www-data /var/ojs_files

chmod -R 755 /var/www/ojs

chmod -R 750 /var/ojs_files

OJS requires scheduled tasks to send reminder emails to overdue peer reviewers, process Crossref deposits, and execute acron triggers. Add a system cron entry under the web user:

crontab -u www-data -e

Add the line:

0 * * * * php /var/www/ojs/tools/runScheduledTasks.php > /dev/null 2>&1