Installation and Configuration of httpd

Basic Info

First off, to install httpd, the group "Basic Web Server" needs to be installed. This group, apart from httpd itself, also includes other important software: mod_ssl, crypto-utils.

Another important package that one should consider installing is httpd-manual. It deploys httpd with the manual to it available on "/manual" endpoint of your server.

It allows one to quickly look up all the important configuration information. For example, how a standard VirtualHost section should look like one can find by opening the manual and following these links: Virtual Hosts -> Configuration Directives -> <VirtualHost>.

When configuring a VirtualHost it is important not to forget about Listen directive and, when using non-standard ports, selinux. To see the list of current selinux policy on ports, this command should be used: semanage port -l. Consult the man page for semanage-port for the information on how to allow a service use a port (section 8).

The command semanage can be found in policycoreutils-python package. Of course, this is not something one should remember, as for this purpose there is always yum provides at your service.

If you did configure something incorrectly, selinux complaints can be found in its log: /var/log/audit/audit.log. Search for the avc keyword. avc stands for Access Vector Cache. [1]

In order to use TLS, you would want to have these two packages: mod_ssl and crypto-utils. The latter contains the needed utility for the generation of a certificate and a private key needed to encrypt the data transfered between your web-server and its client.

Again, this information can be found in httpd-manual. But here are the most important information on creating a secure VirtualHost:

Specify paths to the generated key and certificate (SSLCertificateFile, SSLCertificateKeyFile) in the file /etc/httpd/conf.d/ssl.conf.
Add a VirtualHost *:443 statement, which format can be found in httpd-manual at the following location: "SSL/TLS Encryption" -> "mod_ssl Configuration How-To".

Below I provided an excerpt from the said page:

LoadModule ssl_module modules/mod_ssl.so

Listen 443
<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on
    SSLCertificateFile "/path/to/www.example.com.cert"
    SSLCertificateKeyFile "/path/to/www.example.com.key"
</VirtualHost>

When you have finished configuring your web site, validate your configuration with these commands:

httpd -t or apachectl configtest
httpd -D DUMP_VHOSTS

Then check selinux context on the certificate and private key, in case, if they were moved from another directory with inappropriate context:

restorecon -Rv /etc/pki/tls/certs/www.example.com.crt
restorecon -Rv /etc/pki/tls/private/www.example.com.key

The last thing to take care of is firewall. For httpd, there are pre-defined firewalld services found in /usr/lib/firewalld/services/ — see http.xml and https.xml.

firewall-cmd --add-service=https
firewall-cmd --reload

…or…

firewall-cmd --add-service=https --permanent
firewall-cmd --add-service=https

Whichever you prefer.

And a bit on services. firewalld supports the notion of services, which are described in XML. They contain such information as what port to open, protocol, name and description. Standard services are located in:

/usr/lib/firewalld/services/

For example:

https.xml
http.xml
ssh.xml
tftp-client.xml
tftp.xml

And another example listing of the contents of the https.xml file:

<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Secure WWW (HTTPS)</short>
  <description>...</description>
  <port protocol="tcp" port="443"/>
</service>

In case you want to add a service of your own, put it in the /etc/firewalld/services/ directory and reload firewalld configuration with:

firewall-cmd --reload

Immediately after, you will be able to see them in the list of all available services:

firewall-cmd --get-service

Read more about firewall in CentOS/RHEL 7 in my artcile about firewall. [2]

Authorization and Authentication

Start with the normal configuration of a virtual host, but then add another section:

<Directory "/var/www/html/secret">
    AuthType Basic
    AuthName "secret files"
    AuthUserFile /etc/httpd/htpasswd
    Require valid-user (или Require user laura)
</Directory>

And this /etc/httpd/htpasswd file should be created with:

htpasswd -c /etc/httpd/htpasswd samhyde

Naturally, samhyde is the user name of the first user to be added in the file. When adding all the following users, the -c flag is not needed — it is only for when you create the file for the first time.

Apart from requiring a specific user, you can require a specific host to access sensitive location:

…
Require host httpd.example.com
…

In the famous httpd-manual, this can be found at Authentication and Authorization -> Getting it working and at the bottom of the page is what you are looking for.

CGI

cgi scripts should have appropriate selinux context and, if you want to put your script in a place different from /var/www/cgi-bin, simply check the context of the said path and assign it to your new path. Hint: ls -lZ. Another hint: httpd_sys_script_exec_t.

Installation and Configuration of httpd

Basic Info

Authorization and Authentication

CGI

Resources