Red Hat System Administration III - Unit 13 - Web Server Additional Configuration

• HTTP security context is httpd_content_t

• To create a new folder for httpd, you will need to ensure the httpd_sys_content_t directive has been setup on the directory

  > semanage fcontext -a -t httpd_sys_content_t '/wwwx(/.*)?
  > cat /etc/selinux/targeted/contexts/files/file_contexts.local 
  # This file is auto-generated by libsemanage
  # Do not edit directly.
  
  brah/    system_u:object_r:httpd_sys_content_t:s0
  /wwwx    system_u:object_r:httpd_sys_content_t:s0
  /wwwx(/.*)?    system_u:object_r:httpd_sys_content_t:s0
  > restorecon -vvFR /wwwx
  

• Main config file: /etc/httpd/conf/httpd.conf

  • NameVirtualHost
    • use name-based virtual hosting

      NameVirtualHost 192.168.0.102:80
      <VirtualHost *:80>
          ServerAdmin john@site.com
          DocumentRoot /var/www/html
          ServerAlias demo        d
          ServerName site.com
      </VirtualHost>
      

Stage a CGI executable

• Add ScriptAlias directive.

  > vi /etc/httpd/conf.d/wwwX.conf 
  <VirtualHost *:80>
      ServerAdmin blah@blah
      DocumentRoot /www2/html/
      ServerAlias www2
      **ScriptAlias /cgi-bin /www2/cgi-bin**
      ServerName www2.example.com
  </VirtualHost>
  

• Put script in bash with cgi extension

• Make sure apache owns it. Give it r-x perms.
• Set SELinux security context:

  > semanage fcontent -a -t http_sys_script_exec_t 'www(/.*)?'
  > restorecon -vr /www2/cgi-bin
  

Configure User-Based Authentication

Apache Flat-file Authentication

• Flat-file user authentication can be configured with the .htpasswd file

  > htpasswd -m /etc/httpd/.htpasswd lex
  New password:
  Re-type password:
  > htpasswd -m /etc/httpd.htpasswd john
  New password:
  Re-type password:
  

• Add line to VirtualHost block

  <Directory /var/www/blah>
      AuthName "Secret Shit"
      AuthType basic
      AuthUserField /etc/httpd/.htpasswd
      Require valid-user
  </Directory>
  

Auth LDAP User Auth

• Download LDAP cert
• Add cert to /etc/httpd/conf/httpd.conf

  > vi /etc/httpd/conf/httpd.conf
  LDAPTrustedGlobalCert   CA_BASE64 /etc/httpd/path/to/cert.cer
  
  <Directory /var/www/html/private>
      AuthName "Private stuff"
      AuthType basic
      AuthBasicProvider ldap
      AuthLDAPUrl "ldap://fqdn/prefix" TLS
      Require valid-user
  </Directory>
  

Troubleshooting Apache SELinux Issues

• List current port SELinux contexts

  > semanage port -l | grep http
  

  • Change Apache to non-standard port, use something like:

    > semanage port -a -t http_port_t -p tcp 777
    

• Use setroubleshoot to get more info from audit.log