Apache can publish web content hosted in users' home directories, but SELinux prevents this by default. In this exercise, you will identify and change the SELinux Boolean that will permit Apache to access user home directories.
| Resources | |
|---|---|
| Files: | /etc/httpd/conf.d/userdir.conf |
| Machines: | serverX |
Outcomes:
You will have a web server that publishes web content from users' home directories.
The Apache web server should already be installed and running on serverX.example.com.
Log in as root on serverX. Enable
the Apache feature that permits users to publish
web content from their home directories. Edit the
/etc/httpd/conf.d/userdir.conf
configuration file and change two distinct lines with the
UserDir directive to read as follows:
#UserDir disabled UserDir public_html
[root@serverX ~]#vi /etc/httpd/conf.d/userdir.conf[root@serverX ~]#grep '#UserDir' /etc/httpd/conf.d/userdir.conf#UserDir disabled[root@serverX ~]#grep '^ *UserDir' /etc/httpd/conf.d/userdir.confUserDir public_html
Restart the Apache web service to make the changes take effect.
[root@serverX ~]#systemctl restart httpd
Create some web content that is published from a user's home directory.
Log in as student in another window and create
a public_html directory.
[student@serverX ~]$mkdir ~/public_html
Create some content in a index.html
file.
[student@serverX ~]$echo 'This is student content on serverX.' > ~/public_html/index.html
Change the permissions on student's
home directory so Apache can access the
public_html subdirectory.
[student@serverX ~]$chmod 711 ~
Open a web browser on serverX and try to view the
following URL: http://localhost/~student/index.html.
You will get an error message that says you do not have
permission to access the file.
In your root window, use the getsebool
command to see if there are any Booleans that restrict access
to home directories.
[root@serverX ~]#getsebool -a | grep home[... Output omitted ...] httpd_enable_homedirs --> off [... Output omitted ...]
Use setsebool to enable home directory access persistently.
[root@serverX ~]#setsebool -P httpd_enable_homedirs on
Try to view http://localhost/~student/index.html
again. You should see the message “This is student
content on serverX.”