RHCSA Rapid Track

On your serverX system, make sure that both the httpd and mod_ssl packages are installed. These packages provide the Apache web server you will protect with a firewall, and the necessary extensions for the web server to serve content over SSL.

1. [student@serverX ~]$ sudo yum -y
               install httpd mod_ssl

On your serverX system, create a new file called /var/www/html/index.html, with the following contents:

I am alive

1. [student@serverX ~]$ sudo bash -c "echo 'I am alive' > /var/www/html/index.html"

Start and enable the httpd service on your serverX system.

1. [student@serverX ~]$ sudo systemctl start httpd

2. [student@serverX ~]$ sudo systemctl enable httpd

On your serverX system, make sure that both the iptables and ip6tables services are masked, and that the firewalld service is enabled and running.

1. [student@serverX ~]$ sudo systemctl mask iptables
   [student@serverX ~]$ sudo systemctl mask ip6tables
   [student@serverX ~]$ sudo systemctl status firewalld

On your serverX system, start the firewall-config application. When prompted for the student password, enter student.

1. [student@serverX ~]$ firewall-config

   or

   Select Applications → Sundry → Firewall from the system menu.

From the Configuration dropdown menu, select Permanent to switch to editing the permanent configuration.

Add the https service to the list of services allowed in the public zone.

1. In the Zone list, select public. Since this zone is also the default zone, it is highlighted in bold.

2. In the Services tab, add a checkmark in front of the https service.

3. Important: Also add a checkmark in front of the vnc-server service. Failing to do so will lock out your graphical interface when you activate the firewall. If you do accidentally lock yourself out, recover by using ssh -X serverX firewall-config from your desktopX machine.

Activate your firewall configuration by selecting Options → Reload Firewalld from the menu.

Verify your work by attempting to view your web server contents from desktopX.

1. This command should fail:

   [student@desktopX ~]$ curl -k http://serverX.example.com

2. This command should succeed:

   [student@desktopX ~]$ curl -k https://serverX.example.com