web-server centos6

Open httpd.conf file again

In last practice we have restricted all hosts except one

Before we do this exercise lets allow all hosts to access the web server.

In < directory > section add following and save the file

AuthType Basic AuthName “Password Restricted Area” AuthUserFile /etc/httpd/userauthfile Require user rhceuser01

Use htpasswd command to create a userauthfile, that will be holds user accounts.

# htpasswd -cm /etc/httpd/userauthfile rhceuser01

-c Create new file and populates it with first user and password.

-m Passwords will be encrypted in MD5 before saving

Do not use -c options for creating subsequent users, otherwise it will completely override the file. Use -c option only first time for first user, from second users do not use -c option.

Restart the web server

Try again to access same sites from client, this time it will ask for user name and password

If you cancel or use wrong user name and password, access would be denied

Use correct user name and password

Upon successful authentication access would be granted

Secure web server with .htaccess file

In previous exercise we have secured entire sites. However in real life you want to allow certain parts of site publicly accessible, while other by only authenticated users. For this we will use .htaccess file.

Open /etc/httpd/conf/httpd.conf file again

Change AllowOverride directive value to authconfig

In previous example we did user base authentication

Remove that and save the file

Make a directory and file under mysite1

mkdir /var/www/html/mysite1/salary

Suppose that salary folder contains the salary sheet of employees and we want to allow only hr group to access it.

Create a .htaccess file in the salary folder

#vi /var/www/html/mysite1/salary/.htaccess

Add followings and save the file

AuthType Basic AuthName “Password Restricted Area” AuthGroupFile /etc/httpd/rhcegroupfile Require group hr

Now only users from hr group, defined in /etc/httpd/rhcegroupfile can assess this.

Create few more accounts

Create rhcegroupfile, this file will hold entry for groups

Add user accounts in hr group and save file

Update the SELinux context of .htaccess file

Restart the web server

Try again to access site for client, access to other parts of site are allowed except salary

To access salary folder you need to provide user name and password

Upon successful authentication access would be granted

Configure public_html folder in user home directory

httpd.conf file includes a commented directive UserDir public_html just under the default UserDir disable , when it's enabled, it allows users to browse and access the public_html directory within their home folder.

Open /etc/httpd/conf/httpd.conf file

Comment the default directive

Uncomment the UserDir public_html directive and save the file

Now anyone will have access to web pages that a user puts in his ~/public_html directory. This option can be useful if you want each user to share files over the Web. For this option you need to make users home directory executable for world. You also need to make public_html readable and executable. By default this option is disable because this requires a bit of security compromise. So unless you need to be able to share content out of a users home directory, do not enable this option. If you have to enable it in real world, take all caution in setting up this option.

Create a new normal user

Make public_html folder under his home folder and create a test file in public_html folder

Change file permission

Enable SELinux Boolean associated with home directory

Restart the web server

Access it from client system by typing 192.168.1.1/~rh_user1/index.htm

How to create virtual hosts

Virtual host feature of Apache allows you to define multiple web sites on single IP address. For Virtual hosts configuration following options are required

Suppose that we want to host a new website example.com in virtual host.

Make new directory which will hold our new site

Make a sample file in new site

Update SELinux context

Open main configuration file again

By default NameVirtualHost directive is disabled

Enable it

At the end of file in virtual host section add following lines and save the file

<VirtualHost *:80> ServerAdmin webmaster@example.com DocumentRoot /webdata/example.com ServerName example.com ErrorLog logs/example.com-error_log CustomLog logs/example.com-access_log common </VirtualHost>

If you have DNS server configured update the zone files, otherwise update the hosts files . On server open the /etc/hosts file

Add entry for new virtual host site and save the file

Restart the httpd service

On linuxclient system you also need to update the hosts file before testing. Open hosts file

Add entry for new virtual host site and save the file

Now use elinks command to browse new site

Test page confirms that we have successfully configured virtual host.

How to deploy a basic CGI application

In this section we will deploy a basic CGI application. RHCE exam objective "Deploy a basic CGI application", does not test your programming skills, so you need not to worry about programming language. You only need to know the method.

Create a directory to hold your web application:

# mkdir /var/www/webapp

Make a new sample perl file

Add following in file and save the file. [This will make a sample perl script to print hello, world. Based on Apache manual]

#!/usr/bin/perl print "Content-type: text/html\n\n"; print "Hello, World!";

Update file permission and SELinux context

Open configuration file

At end of file add following and save the file

ScriptAlias /webapp "/var/www/webapp" <Directory "/var/www/webapp/"> Options ExecCGI FollowSymLinks Order allow,deny Allow from all </Directory>

Restart the web server

On client now you can access this CGI application.

Configure secure virtual host

In this last section of tutorial we will configure a secure virtual host with self signed certificate. Make a directory to host our secure site

Make a sample index.htm file in it

Change file permission and Update SELinux context

Open main configuration file /etc/httpd/conf.d/ssl.conf

Make sure Listen Directive remain on

Add new Directive NameVirtualHost *:443 just above the <VirtualHost _default_:443> and replace _default_ with * in <VirtualHost _default_:443> tag.Uncomment the DocumentRoot and ServerName directives.

Change the value of directives and save the file

Move in certificate holder directory /etc/pki/tls/certs and use genkey command to generate new certificate and private key for secure site

Select Next and press enter on Keypair generation window

During the exam always choose minimum available key size. Even smaller key size can take up to several minutes and in exam every minute is precious. Select 512 and move to Next tab and press enter

Wait while key generates

Select No and press enter on Generate CSR window

Keep default details and select Next and press Enter

We have sucessfully created the certificate ,now we to update the hosts file on server

Restart the httpd service

On client updated the hosts file

To test secure site open the web browser and type https://host1.example.com/index.htm in URL

You will see Untrusted connection screen Unless you purchase an actual certificate from a certificate authority (CA) such as VeriSign and Thawte. For RHCE exam we do not need third party certificate, as we have self signed certificate. Click on I Understand the Risks and Click on Add Exception

Click on confirm security exception

Test page confirms that we have successfully configured the secure virtual host

To test secure sites form elinks test based browser we need to comment two standard directives

open /etc/elinks.conf file

You need to comment these directives

Comment them and save the file

Now you can access secure sites form elinks as well

Test page confirms our secure web hosting

When you restarts the httpd service, restart process actually stop the service from running before starting it again. This process hardly take few seconds that is ok for exam purpose but in real life where thousands of people are hitting your site, you can't afford any outage even its in seconds. In that situation you can use reload option which allows the main configuration to reread without the actually bringing service down.

#service httpd reload

One more important option which should know for real world is graceful

#service httpd graceful

This option reread the new configuration file without disconnecting any currently connected users. Only drawback of this option is that the currently active connections use the old configuration file until they terminate their connection and reconnect.

One more cool options is configtest, when used , service parses the main config file for any errors and reports back if something is found. It's your helping hand during the exam to detect any syntax errors in configuration file.

# service httpd configtest Syntax OK

If this command detect any syntax related error it return with that, otherwise it return with Syntax ok.

That's all for this article I hope you have enjoyed this. You can check more RHCE 6 related articles here .

RHCE 6 Study Guide Network administration

More Related Articles For You

• IP address

• How to assign IP address in Linux

• Networking tools

• Network Configuration Files

• Network setup in RHCE6

• How to configure Telnet Server in RHEL6

• How to configure SSH Server in RHEL 6

• How to configure FTP server in RHEL6

• How to configure YUM Server in RHEL6

• How to configure Samba on RHEL 6

• How to configure NFS Server in RHEL 6

• How to configure apache server in linux