Red Hat System Administration II

Bookmark this page
P123456789101112131415
PreviousNext

Guided Exercise: Practice: Limiting Network Communication

In this lab, you will configure a basic firewall.

Resources
Machines: serverX and desktopX

Outcomes:

After completion of this exercise, your serverX machine should have a running web server, listening on both the cleartext port 80/TCP and the SSL encapsulated port 443/TCP. The firewall configuration on serverX should only allow connections to the SSL encapsulated port.

The firewall should allow access to sshd and vnc from all hosts.

  • Reset your serverX system.

  1. On your serverX system, make sure that both the httpd and mod_ssl packages are installed. These packages provide the Apache web server you will protect with a firewall, and the necessary extensions for the web server to serve content over SSL. 

    1. [student@serverX ~]$ sudo yum -y
            install httpd mod_ssl

  2. On your serverX system, create a new file called /var/www/html/index.html, with the following contents: 

    I am alive
    1. [student@serverX ~]$ sudo bash -c "echo 'I am alive' > /var/www/html/index.html"

  3. Start and enable the httpd service on your serverX system. 

    1. [student@serverX ~]$ sudo systemctl start httpd
    2. [student@serverX ~]$ sudo systemctl enable httpd

  4. On your serverX system, make sure that both the iptables and ip6tables services are masked, and that the firewalld service is enabled and running. 

    1. [student@serverX ~]$ sudo systemctl mask iptables
[student@serverX ~]$ sudo systemctl mask ip6tables
[student@serverX ~]$ sudo systemctl status firewalld

  5. On your serverX system, start the firewall-config application. When prompted for the student password, enter student. 

    1. [student@serverX ~]$ firewall-config

      or

      Select Applications → Sundry → Firewall from the system menu.

  6. From the Configuration dropdown menu, select Permanent to switch to editing the permanent configuration.

  7. Add the https service to the list of services allowed in the public zone.

    1. In the Zone list, select public. Since this zone is also the default zone, it is highlighted in bold.

    2. In the Services tab, add a checkmark in front of the https service.

    3. Important: Also add a checkmark in front of the vnc-server service. Failing to do so will lock out your graphical interface when you activate the firewall. If you do accidentally lock yourself out, recover by using ssh -X serverX firewall-config from your desktopX machine.

  8. Activate your firewall configuration by selecting Options → Reload Firewalld from the menu.

  9. Verify your work by attempting to view your web server contents from desktopX.

    1. This command should fail: 

      [student@desktopX ~]$ curl -k http://serverX.example.com

    2. This command should succeed: 

      [student@desktopX ~]$ curl -k https://serverX.example.com

    Note

    If you use firefox to connect to the web server, it will prompt for verification of the host certificate if it successfully gets past the firewall.

PreviousNext
Revision: rh134-7-63a207e