Install XAMPP on Fedora 45 / 44: Fixes and Hardening

XAMPP for Linux has not had a release since November 2023, and on a current Fedora you will notice. The installer finishes without complaint, then lampp start tells you XAMPP is “only availably as 32 bit application”.

Original content from computingforgeeks.com - post 21561

Ignore that message, because it is wrong. The real cause is two legacy libraries Fedora no longer installs by default, and once they are in place XAMPP runs fine.

We installed XAMPP 8.2.12 on Fedora 45 and Fedora 44 in October 2026 with SELinux enforcing, hit every error below, and locked the stack down before calling it done.

What XAMPP for Linux ships

Three editions are still offered on the Apache Friends download page: 8.0.30, 8.1.25 and 8.2.12. Each bundles its own Apache, MariaDB, PHP and Perl under /opt/lampp, with no dependence on Fedora’s packages.

Component	XAMPP 8.2.12	Fedora 45 package (October 2026)
PHP	8.2.12	8.5.11
Apache	2.4.58	2.4.68
MariaDB	10.4.32	12.3.2
phpMyAdmin	5.2.1	5.2.3
OpenSSL (Apache)	1.1.1w	system OpenSSL

Every bundled component is behind what Fedora ships, and none of it is updated by dnf.

If you only need a quick local sandbox for testing a PHP app, XAMPP is fine. For anything other people can reach, use the native LAMP stack on Fedora instead, or PHP on Fedora with Remi if you need an older PHP branch.

Install the two legacy libraries

Install these first, before the installer runs.

sudo dnf install -y libxcrypt-compat libnsl

On our first Fedora 45 attempt we skipped them, and each missing library produced a different misleading failure.

lampp decides whether your system is “32 bit” by running its bundled PHP. That PHP needs libcrypt.so.1, which only libxcrypt-compat provides, so the check fails and blames the architecture.

XAMPP is currently only availably as 32 bit application. Please use a 32 bit compatibility library for your system.

If you run that PHP directly, you see the real error, and dnf provides names the package.

With libxcrypt-compat alone, MariaDB starts but Apache does not. XAMPP loads mod_perl, which is linked against libnsl.so.1.

httpd: Syntax error on line 522 of /opt/lampp/etc/httpd.conf: Syntax error on line 6 of /opt/lampp/etc/extra/httpd-xampp.conf: Cannot load modules/mod_perl.so into server: libnsl.so.1: cannot open shared object file: No such file or directory

Both packages are in the standard Fedora 45 and Fedora 44 repositories. On Fedora 44 the pair was installed as two packages with nothing else pulled in.

Download and verify the installer

Rather than hardcode a version, read the newest Linux installer name from the download page. The file itself is hosted on SourceForge.

XAMPP_RUN=$(curl -sL https://www.apachefriends.org/download.html | grep -oE "xampp-linux-x64-[0-9.]+-[0-9]+-installer\.run" | sort -V | tail -n 1)
XAMPP_VER=$(echo "$XAMPP_RUN" | cut -d- -f4)
echo "$XAMPP_RUN $XAMPP_VER"
curl -sL -o /tmp/xampp.run "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/${XAMPP_VER}/${XAMPP_RUN}/download"

Our echo printed xampp-linux-x64-8.2.12-0-installer.run 8.2.12.

The download page does not publish checksums, but the SourceForge folder listing does, so you can compare the two values.

sha1sum /tmp/xampp.run
curl -sL "https://sourceforge.net/projects/xampp/files/XAMPP%20Linux/${XAMPP_VER}/" | grep -oE "\"name\": ?\"${XAMPP_RUN}\"[^}]*\"sha1\": ?\"[a-f0-9]{40}\"" | grep -oE "[a-f0-9]{40}"

Both printed 75d5fe779d3495e5af6c877d48e6115d604c32b8 for the 8.2.12 installer, a 160 MB file.

Free ports 80 and 3306 first

If Fedora’s own Apache or MariaDB is running, XAMPP fails in an unhelpful way, and the installer hits it straight away because it starts Apache itself.

Our Fedora 45 VM still had the system httpd and mariadb active. Apache refused with Another web server is already running, which is clear enough.

MySQL was worse. lampp printed Starting MySQL...ok., and lampp status then reported MySQL is not running, because port 3306 was held by the system mariadbd the whole time.

Stop and disable whichever of the two is installed before you run the installer. List only the units you have, because systemctl disable errors on a unit that doesn’t exist.

sudo systemctl disable --now httpd mariadb

Run the installer unattended

The .run file takes --mode unattended, which skips every prompt and installs to the default path.

chmod +x /tmp/xampp.run
sudo /tmp/xampp.run --mode unattended

It took about three minutes on our VM and printed nothing. Everything lands in /opt/lampp, which came to 984M.

If the libraries are already installed, the installer starts Apache itself. A lampp start straight afterwards reports already running for Apache and starts MySQL.

sudo /opt/lampp/lampp start
sudo /opt/lampp/lampp status

On both VMs, lampp status then showed Apache, MySQL and ProFTPD running, and http://localhost/dashboard/ returned 200.

Every lampp command also prints egrep: warning: egrep is obsolescent, because its scripts still call egrep. You can ignore it.

Open the dashboard and phpMyAdmin

Browse to http://localhost/dashboard/ on the machine itself to see the welcome page.

Our VM allowed http in firewalld, so from another host the dashboard answered 200 but /phpmyadmin/ returned 403. XAMPP’s httpd-xampp.conf limits phpMyAdmin to Require local.

To reach it from your workstation, open an SSH tunnel such as ssh -N -L 18090:localhost:80 [email protected], then browse to http://localhost:18090/phpmyadmin/.

Do not count on SELinux here. lampp prints Making XAMPP fit SELinux... on start, but the processes it launches run unconfined: unconfined_t when started from a shell and unconfined_service_t under the systemd unit below. That means the policy that protects Fedora’s own httpd does not apply to XAMPP.

Lock down MariaDB, phpMyAdmin and FTP

A fresh XAMPP is wide open on purpose.

MariaDB listens on *:3306, every root account has an empty password, and an anonymous user can log in. phpMyAdmin logs you in as root automatically, and ProFTPD listens on port 21 with the password xampp.

XAMPP has sudo /opt/lampp/lampp security for this, but we wouldn’t rely on it. On Fedora 45 it turned off networking and set the passwords, yet the anonymous user still worked.

Its FTP step then wrote the source of its PHP helper, starting with function make_seed(), into proftpd.conf where a password hash belongs, and ProFTPD refused to start again with unknown configuration directive 'function'. Scripted answers also drifted out of step on Fedora 44 and left root without the password we fed it.

The explicit steps below did the same job on Fedora 44, and you can check each one.

Stop FTP and switch off MariaDB networking. A reloadmysql does not apply skip-networking, so stop and start MySQL.

sudo /opt/lampp/lampp stopftp
sudo sed -i "s/^#skip-networking/skip-networking/" /opt/lampp/etc/my.cnf
sudo /opt/lampp/lampp stopmysql
sudo /opt/lampp/lampp startmysql

Next, give root a password and remove the accounts you don’t need. With networking off, the 127.0.0.1 and ::1 root entries serve no purpose.

Keep the password to letters and digits, since it is used inside quoted SQL here and inside a sed later.

read -rsp 'XAMPP MySQL root password: ' XAMPP_PW; echo
read -rsp 'phpMyAdmin control user password: ' PMA_CTRL; echo
/opt/lampp/bin/mysql -u root -e "ALTER USER 'root'@'localhost' IDENTIFIED BY '$XAMPP_PW'; DROP USER 'root'@'127.0.0.1', 'root'@'::1', ''@'localhost';"
/opt/lampp/bin/mysql -u root -p"$XAMPP_PW" -e "ALTER USER 'pma'@'localhost' IDENTIFIED BY '$PMA_CTRL';"

Then switch phpMyAdmin from automatic login to a login form. The same pass sets the control user password and replaces the default xampp cookie secret.

sudo sed -i "s/\['auth_type'\] = 'config'/['auth_type'] = 'cookie'/" /opt/lampp/phpmyadmin/config.inc.php
sudo sed -i "s/\['controlpass'\] = ''/['controlpass'] = '$PMA_CTRL'/" /opt/lampp/phpmyadmin/config.inc.php
sudo sed -i "s/\['blowfish_secret'\] = '[^']*'/['blowfish_secret'] = '$(openssl rand -hex 16)'/" /opt/lampp/phpmyadmin/config.inc.php

Without the last line, phpMyAdmin warns that the configuration file needs a valid key for cookie encryption. Our account checks afterwards came back clean.

Log in to phpMyAdmin as root with the new password. On the home page you can confirm the bundled versions, along with a notice that phpMyAdmin 5.2.3 is available.

Start XAMPP at boot with systemd

XAMPP has no unit file, so write a small one that starts only Apache and MariaDB and leaves FTP off.

printf '[Unit]\nDescription=XAMPP (Apache and MariaDB)\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nRemainAfterExit=yes\nExecStart=/opt/lampp/lampp startapache\nExecStart=/opt/lampp/lampp startmysql\nExecStop=/opt/lampp/lampp stopapache\nExecStop=/opt/lampp/lampp stopmysql\n\n[Install]\nWantedBy=multi-user.target\n' | sudo tee /etc/systemd/system/xampp.service

Stop the manually started copy first, then let systemd take over.

sudo /opt/lampp/lampp stop
sudo systemctl daemon-reload
sudo systemctl enable --now xampp

From now on, start and stop the stack with systemctl so one tool owns it. We rebooted the Fedora 45 VM to prove it. Three minutes after boot, systemctl is-active xampp said active, Apache and MySQL were running, ProFTPD stayed off, and the dashboard returned 200.

Uninstall XAMPP

XAMPP ships its own uninstaller, but it leaves a stub directory behind.

sudo systemctl disable --now xampp
sudo rm -f /etc/systemd/system/xampp.service
sudo /opt/lampp/uninstall --mode unattended
sudo rm -rf /opt/lampp

On our Fedora 44 VM the uninstaller exited 0 and still left 20K in /opt/lampp, hence the final rm.

If you disabled Fedora’s httpd and mariadb earlier, enable them again with sudo systemctl enable --now httpd mariadb. phpMyAdmin on Fedora then gives you the same web UI on maintained packages.