RHCSA Rapid Track
Apache can publish web content hosted in users' home directories, but SELinux prevents this by default. In this exercise, you will identify and change the SELinux Boolean that will permit Apache to access user home directories.
| Resources | |
|---|---|
| Files: | /etc/httpd/conf.d/userdir.conf |
| Machines: | serverX |
Outcomes
You will have a web server that publishes web content from users' home directories.
The Apache web server should already be installed and running on serverX.example.com.
Log in as
rootonserverX. Enable the Apache feature that permits users to publish web content from their home directories. Edit the/etc/httpd/conf.d/userdir.confconfiguration file and change two distinct lines with theUserDirdirective to read as follows:#UserDir disabled UserDir public_html
[root@serverX ~]#vi /etc/httpd/conf.d/userdir.conf[root@serverX ~]#grep '#UserDir' /etc/httpd/conf.d/userdir.conf#UserDir disabled[root@serverX ~]#grep '^ *UserDir' /etc/httpd/conf.d/userdir.confUserDir public_htmlRestart the Apache web service to make the changes take effect.
[root@serverX ~]#systemctl restart httpdCreate some web content that is published from a user's home directory.
Log in as
studentin another window and create apublic_htmldirectory.[student@serverX ~]$mkdir ~/public_htmlCreate some content in a
index.htmlfile.[student@serverX ~]$echo 'This is student content on serverX.' > ~/public_html/index.htmlChange the permissions on
student's home directory so Apache can access thepublic_htmlsubdirectory.[student@serverX ~]$chmod 711 ~
Open a web browser on
serverXand try to view the following URL:http://localhost/~student/index.html. You will get an error message that says you do not have permission to access the file.In your
rootwindow, use the getsebool command to see if there are any Booleans that restrict access to home directories.[root@serverX ~]#getsebool -a | grep home[... Output omitted ...] httpd_enable_homedirs --> off [... Output omitted ...]Use setsebool to enable home directory access persistently.
[root@serverX ~]#setsebool -P httpd_enable_homedirs onTry to view
http://localhost/~student/index.htmlagain. You should see the message “This is student content on serverX.”