Red Hat System Administration II

Your organization is deploying a new custom web application. The web application is running on a nonstandard port; in this case, 82/TCP.

One of your junior administrators has already configured the application on your servera. However, the web server content is not accessible.

1. Use the ssh command to log in to servera as the student user. The systems are configured to use SSH keys for authentication, so a password is not required.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$  

2. Use the sudo -i command to switch to the root user. The password for the student user is student.

   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# 

3. Attempt to fix the web content problem by restarting the httpd service.

   1. Use the systemctl command to restart the httpd.service. This command is expected to fail.

      [root@servera ~]# systemctl restart httpd.service
      Job for httpd.service failed because the control process exited with error code.
      See "systemctl status httpd.service" and "journalctl -xe" for details.
      

   2. Use the systemctl status -l command to reveal the status of the httpd service. Note the permission denied error.

      [root@servera ~]# systemctl status -l httpd.service
      ● httpd.service - The Apache HTTP Server
         Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
         Active: failed (Result: exit-code) since Mon 2019-04-08 14:23:29 CEST; 3min 33s ago
          Docs: man:httpd.service(8)
         Process: 28078 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
       Main PID: 28078 (code=exited, status=1/FAILURE)
         Status: "Reading configuration..."
      
      Apr 08 14:23:29 servera.lab.example.com systemd[1]: Starting The Apache HTTP Server...
      Apr 08 14:23:29 servera.lab.example.com httpd[28078]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:82
      Apr 08 14:23:29 servera.lab.example.com httpd[28078]: (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:82
      Apr 08 14:23:29 servera.lab.example.com httpd[28078]: no listening sockets available, shutting down
      Apr 08 14:23:29 servera.lab.example.com httpd[28078]: AH00015: Unable to open logs
      Apr 08 14:23:29 servera.lab.example.com systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE
      Apr 08 14:23:29 servera.lab.example.com systemd[1]: httpd.service: Failed with result 'exit-code'.
      Apr 08 14:23:29 servera.lab.example.com systemd[1]: Failed to start The Apache HTTP Server.

   3. Use the sealert command to check if SELinux is blocking httpd from binding to port 82/TCP.

      [root@servera ~]# sudo sealert -a /var/log/audit/audit.log
      100% done
      found 1 alerts in /var/log/audit/audit.log
      --------------------------------------------------------------------------------
      
      SELinux is preventing /usr/sbin/httpd from name_bind access on the tcp_socket port 82.
      
      *****  Plugin bind_ports (99.5 confidence) suggests   ************************
      
      If you want to allow /usr/sbin/httpd to bind to network port 82
      Then you need to modify the port type.
      Do
      # semanage port -a -t PORT_TYPE -p tcp 82
          where PORT_TYPE is one of the following: http_cache_port_t, http_port_t, jboss_management_port_t, jboss_messaging_port_t, ntop_port_t, puppet_port_t.
      ...output omitted...
      Raw Audit Messages
      type=AVC msg=audit(1554726569.188:852): avc:  denied  { name_bind } for  pid=28393 comm="httpd" src=82 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket permissive=0
      ...output omitted...

4. Configure SELinux to allow httpd to bind to port 82/TCP, then restart the httpd.service service.

   1. Use the semanage command to find an appropriate port type for port 82/TCP.

      [root@servera ~]# semanage port -l | grep http
      http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
      http_cache_port_t              udp      3130
      http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
      pegasus_http_port_t            tcp      5988
      pegasus_https_port_t           tcp      5989

      http_port_t contains the default HTTP ports, 80/TCP and 443/TCP. This is the correct port type for the web server.

   2. Use the semanage command to assign port 82/TCP the http_port_t type.

      [root@servera ~]# semanage port -a -t http_port_t -p tcp 82

   3. Use the systemctl command to restart the httpd.service service. This command should succeed.

      [root@servera ~]# systemctl restart httpd.service

5. Check if you can now access the web server running on port 82/TCP. Use the curl command to access the web service from servera.

   [root@servera ~]# curl http://servera.lab.example.com:82
   Hello

6. In a different terminal window, check whether you can access the new web service from workstation. Use the curl command to access the web service from workstation.

   [student@workstation ~]$ curl http://servera.lab.example.com:82
   curl: (7) Failed to connect to servera.example.com:82; No route to host

   That error means you still can not connect to the web service from workstation.

7. On servera, open up port 82/TCP on the firewall.

   1. Use the firewall-cmd command to open port 82/TCP in the permanent configuration for the default zone on the firewall on servera.

      [root@servera ~]# firewall-cmd --permanent --add-port=82/tcp
      success 

   2. Activate your firewall changes on servera.

      [root@servera ~]# firewall-cmd --reload
      success   

8. Use the curl command to access the web service from workstation.

   [student@workstation ~]$ curl http://servera.lab.example.com:82
   Hello

9. Exit from servera.

   [root@servera ~]# exit
   logout
   [student@servera ~]$ exit
   logout
   Connection to servera closed.
   [student@workstation ~]$