RHCSA Rapid Track
In this lab, you will make a persistent change to the SELinux context of a directory and its contents.
Outcomes
You should be able to configure the Apache HTTP server to publish web content from a non-standard document root.
Log in as the student user on workstation using student as the password.
On workstation, run the lab selinux-filecontexts start command.
This command runs a start script that determines whether the servera machine is reachable on the network.
It also installs the httpd service and configures the firewall on servera to allow HTTP connections.
[student@workstation ~]$lab selinux-filecontexts start
Use the
sshcommand to log in toserveraas thestudentuser. The systems are configured to use SSH keys for authentication, so a password is not required.[student@workstation ~]$ssh student@servera...output omitted...[student@servera ~]$Use the
sudo -icommand to switch to therootuser. The password for thestudentuser isstudent.[student@servera ~]$sudo -i[sudo] password for student:student[root@servera ~]#Configure Apache to use a document root in a non-standard location.
Create the new document root,
/customusing themkdircommand.[root@servera ~]#mkdir /customCreate the
index.htmlfile in the/customdocument root using theechocommand.[root@servera ~]#echo 'This is SERVERA.' > /custom/index.htmlConfigure Apache to use the new document root location. To do so, edit the Apache
/etc/httpd/conf/httpd.confconfiguration file and replace the two occurrences of/var/www/htmlwith/custom....output omitted...
DocumentRoot"/custom" ...output omitted... <Directory"/custom"> ...output omitted...
Start and enable the Apache web service and confirm that the service is running.
Start and enable the Apache web service using the
systemctlcommand.[root@servera ~]#systemctl enable --now httpdUse the
systemctlcommand to confirm that the service is running.[root@servera ~]#systemctl status httpd●httpd.service- The Apache HTTP Server Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled) Active:active (running)since Mon 2019-03-25 19:16:48 CET; 15h ago Docs: man:httpd.service(8) Main PID: 6565 (httpd) Status: "Total requests: 16; Idle/Busy workers 100/0;Requests/sec: 0.000285; Bytes served/sec: 0 B/sec" Tasks: 213 (limit: 11406) Memory: 37.3M CGroup: /system.slice/httpd.service ├─6565 /usr/sbin/httpd -DFOREGROUND ├─6566 /usr/sbin/httpd -DFOREGROUND ├─6567 /usr/sbin/httpd -DFOREGROUND ├─6568 /usr/sbin/httpd -DFOREGROUND └─6569 /usr/sbin/httpd -DFOREGROUND Mar 25 19:16:48 servera.lab.example.com systemd[1]:Starting The Apache HTTP Server...Mar 25 19:16:48 servera.lab.example.com httpd[6565]: Server configured, listening on: port 80 Mar 25 19:16:48 servera.lab.example.com systemd[1]:Started The Apache HTTP Server.
Open a web browser on
workstationand try to viewhttp://servera/index.html. You will get an error message that says you do not have permission to access the file.To permit access to the
index.htmlfile onservera, SELinux must be configured. Define an SELinux file context rule that sets the context type tohttpd_sys_content_tfor the/customdirectory and all the files below it.[root@servera ~]#semanage fcontext -a \-t httpd_sys_content_t '/custom(/.*)?'Use the
restoreconcommand to change the file contexts.[root@servera ~]#restorecon -Rv /customRelabeled /custom from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0 Relabeled /custom/index.html from unconfined_u:object_r:default_t:s0 to unconfined_u:object_r:httpd_sys_content_t:s0Try to view
http://servera/index.htmlagain. You should see the messageThis is SERVERA.displayed.Exit from
servera.[root@servera ~]#exitlogout[student@servera ~]$exitlogout Connection to servera closed. [student@workstation ~]$
This concludes the guided exercise.