Red Hat System Administration II

Instructions

Your organization is deploying a new custom web application. The web application is running on a nonstandard port, in this case, 82/TCP.

A junior administrator already configured the application on your servera host. However, the web server content is not accessible.

1. Log in to servera as the student user and switch to the root user.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...
   [student@servera ~]$
   [student@servera ~]$ sudo -i
   [sudo] password for student: student
   [root@servera ~]#

2. Try to fix the web content problem by restarting the httpd service.

   1. Restart the httpd.service. This command is expected to fail.

      [root@servera ~]# systemctl restart httpd.service
      Job for httpd.service failed because the control process exited with error code.
      See "systemctl status httpd.service" and "journalctl -xe" for details.

   2. View the status of the httpd service. Note the permission denied error.

      [root@servera ~]# systemctl status -l httpd.service
      ● httpd.service - The Apache HTTP Server
         Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor preset: disabled)
         Active: failed (Result: exit-code) since Mon 2019-04-08 14:23:29 CEST; 3min 33s ago
          Docs: man:httpd.service(8)
         Process: 28078 ExecStart=/usr/sbin/httpd $OPTIONS -DFOREGROUND (code=exited, status=1/FAILURE)
       Main PID: 28078 (code=exited, status=1/FAILURE)
         Status: "Reading configuration..."
      
      Apr 08 14:23:29 servera.lab.example.com systemd[1]: Starting The Apache HTTP Server...
      Apr 08 14:23:29 servera.lab.example.com httpd[28078]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:82
      Apr 08 14:23:29 servera.lab.example.com httpd[28078]: (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:82
      Apr 08 14:23:29 servera.lab.example.com httpd[28078]: no listening sockets available, shutting down
      Apr 08 14:23:29 servera.lab.example.com httpd[28078]: AH00015: Unable to open logs
      Apr 08 14:23:29 servera.lab.example.com systemd[1]: httpd.service: Main process exited, code=exited, status=1/FAILURE
      Apr 08 14:23:29 servera.lab.example.com systemd[1]: httpd.service: Failed with result 'exit-code'.
      Apr 08 14:23:29 servera.lab.example.com systemd[1]: Failed to start The Apache HTTP Server.

   3. Verify whether SELinux is blocking httpd from binding to the 82/TCP port.

      [root@servera ~]# sealert -a /var/log/audit/audit.log
      100% done
      found 1 alerts in /var/log/audit/audit.log
      --------------------------------------------------------------------------------
      
      SELinux is preventing /usr/sbin/httpd from name_bind access on the tcp_socket port 82.
      
      *****  Plugin bind_ports (99.5 confidence) suggests   ************************
      
      If you want to allow /usr/sbin/httpd to bind to network port 82
      Then you need to modify the port type.
      Do
      # semanage port -a -t PORT_TYPE -p tcp 82 where PORT_TYPE is one of the following: http_cache_port_t, http_port_t, jboss_management_port_t, jboss_messaging_port_t, ntop_port_t, puppet_port_t.
      ...output omitted...
      Raw Audit Messages
      type=AVC msg=audit(1554726569.188:852): avc:  denied  { name_bind } for  pid=28393 comm="httpd" src=82 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:reserved_port_t:s0 tclass=tcp_socket permissive=0
      ...output omitted...

3. Configure SELinux to allow the httpd service to bind to the 82/TCP port, and then restart the httpd.service service.

   1. Find an appropriate port type for the 82/TCP port.

      The http_port_t type includes the default HTTP ports, 80/TCP and 443/TCP. This type is the correct port type for the web server.

      [root@servera ~]# semanage port -l | grep http
      http_cache_port_t              tcp      8080, 8118, 8123, 10001-10010
      http_cache_port_t              udp      3130
      http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000
      pegasus_http_port_t            tcp      5988
      pegasus_https_port_t           tcp      5989

   2. Assign the 82/TCP port the http_port_t type.

      [root@servera ~]# semanage port -a -t http_port_t -p tcp 82

   3. Restart the httpd.service service. This command should succeed.

      [root@servera ~]# systemctl restart httpd.service

4. Verify that you can now access the web server that runs on the 82/TCP port.

   [root@servera ~]# curl http://servera.lab.example.com:82
   Hello

5. In a different terminal window, verify whether you can access the new web service from workstation.

   [student@workstation ~]$ curl http://servera.lab.example.com:82
   curl: (7) Failed to connect to servera.example.com:82; No route to host

   That error means that you still cannot connect to the web service from workstation.

6. On servera, open the 82/TCP port on the firewall.

   1. Open the 82/TCP port in the permanent configuration, for the default zone on the firewall, on servera.

      [root@servera ~]# firewall-cmd --permanent --add-port=82/tcp
      success

   2. Activate your firewall changes on servera.

      [root@servera ~]# firewall-cmd --reload
      success

7. Access the web service from workstation.

   [student@workstation ~]$ curl http://servera.lab.example.com:82
   Hello

8. Return to the workstation system as the student user.

   [root@servera ~]# exit
   logout
   [student@servera ~]$ exit
   logout
   Connection to servera closed.
   [student@workstation ~]$