Red Hat System Administration II

Instructions

1. Log in to the servera machine as the student user and switch to the root user.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]#

2. Install the httpd and mod_ssl packages. These packages provide the Apache web server and the necessary extensions for the web server to serve content over SSL.

   [root@servera ~]# dnf install httpd mod_ssl
   ...output omitted...
   Is this ok [y/N]: y
   ...output omitted...
   Complete!

3. Create the /var/www/html/index.html file. Add one line of text that reads: I am servera.

   [root@servera ~]# echo 'I am servera.' > /var/www/html/index.html

4. Start and enable the httpd service.

   [root@servera ~]# systemctl enable --now httpd
   Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service → /usr/lib/systemd/system/httpd.service.

5. Return to the workstation machine as the student user.

   [root@servera ~]# exit
   logout
   [student@servera ~]$ exit
   logout
   Connection to servera closed.
   [student@workstation ~]$

6. From workstation, try to access the web server on servera by using both the 80/TCP clear-text port and the 443/TCP SSL encapsulated port. Both attempts should fail.

   1. The curl command should fail.

      [student@workstation ~]$ curl http://servera.lab.example.com
      curl: (7) Failed to connect to servera.lab.example.com port 80: No route to host

   2. The curl command with the -k option for insecure connections should also fail.

      [student@workstation ~]$ curl -k https://servera.lab.example.com
      curl: (7) Failed to connect to servera.lab.example.com port 443: No route to host

7. Verify that the firewalld service on servera is enabled and running.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]# systemctl status firewalld
   ● firewalld.service - firewalld - dynamic firewall daemon
        Loaded: loaded (/usr/lib/systemd/system/firewalld.service; enabled; vendor preset: enabled)
        Active: active (running) since Wed 2022-04-13 11:22:50 EDT; 7min ago
          Docs: man:firewalld(1)
      Main PID: 768 (firewalld)
         Tasks: 2 (limit: 10798)
        Memory: 39.9M
           CPU: 584ms
        CGroup: /system.slice/firewalld.service
                └─768 /usr/bin/python3 -s /usr/sbin/firewalld --nofork --nopid
   
   Apr 13 11:22:49 servera.lab.example.com systemd[1]: Starting firewalld - dynamic firewall daemon...
   Apr 13 11:22:50 servera.lab.example.com systemd[1]: Started firewalld - dynamic firewall daemon.

8. Add the https service to the public firewall zone.

   1. Verify that the default firewall zone is set to the public zone.

      [root@servera ~]# firewall-cmd --get-default-zone
      public

   2. If the earlier step does not return public as the default zone, then correct it with the following command:

      [root@servera ~]# firewall-cmd --set-default-zone public

   3. Add the https service to the permanent configuration for the public network zone. Confirm your configuration.

      [root@servera ~]# firewall-cmd --permanent --add-service=https
      success
      [root@servera ~]# firewall-cmd --reload
      success
      [root@servera ~]# firewall-cmd --permanent --zone=public --list-all
      public
        target: default
        icmp-block-inversion: no
        interfaces:
        sources:
        services: cockpit dhcpv6-client https ssh
        ports:
        protocols:
        forward: yes
        masquerade: no
        forward-ports:
        source-ports:
        icmp-blocks:
        rich rules:

9. From workstation, open Firefox and log in to the web console that is running on servera to verify the https service to the public firewall zone.

   1. Open Firefox and navigate to https://servera.lab.example.com:9090 to access the web console. Click Advanced and Accept the Risk and Continue to accept the self-signed certificate.

   2. Log in as the student user with student as the password.

   3. Click Turn on administrative access and enter the student password again.

   4. Click Networking in the left navigation bar.

   5. Click Edit rules and zones in the Firewall section of the Networking page.

   6. Verify that the https service is listed in the Service column.

10. Return to a terminal on workstation, and verify your work by attempting to access the servera web server.

    1. Return to the workstation machine as the student user.

       [root@servera ~]# exit
       logout
       [student@servera ~]$ exit
       logout
       Connection to servera closed.
       [student@workstation ~]$

    2. Verify the access to the http://servera.lab.example.com web server.

       [student@workstation ~]$ curl http://servera.lab.example.com
       curl: (7) Failed to connect to servera.lab.example.com port 80: No route to host

    3. Verify the access to the http://servera.lab.example.com web server through the port 443 for insecure connection.

       [student@workstation ~]$ curl -k https://servera.lab.example.com
       I am servera.