Chapter 1. Setting up the Apache HTTP web server

Procedure

1. Enable access to the keytab file of HTTP/<SERVER_NAME>@realm principal by creating the service principal:

   # ipa service-add HTTP/<SERVER_NAME>

2. Retrieve the keytab for the principal stored in the /etc/gssproxy/http.keytab file:

   # ipa-getkeytab -s $(awk '/^server =/ {print $3}' /etc/ipa/default.conf) -k /etc/gssproxy/http.keytab -p HTTP/$(hostname -f)

   This step sets permissions to 400, thus only the root user has access to the keytab file. The apache user does not.

3. Create the /etc/gssproxy/80-httpd.conf file with the following content:

   [service/HTTP]
     mechs = krb5
     cred_store = keytab:/etc/gssproxy/http.keytab
     cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
     euid = apache

4. Restart and enable the gssproxy service:

   # systemctl restart gssproxy.service
   # systemctl enable gssproxy.service

Procedure

1. Configure the mod_auth_gssapi module to protect the /var/www/html/private/ directory:

   <Location /var/www/html/private>
     AuthType GSSAPI
     AuthName "GSSAPI Login"
     Require valid-user
   </Location>

2. Create system unit configuration drop-in file:

   # systemctl edit httpd.service

3. Add the following parameter to the system drop-in file:

   [Service]
   Environment=GSS_USE_PROXY=1

4. Reload the systemd configuration:

   # systemctl daemon-reload

5. Restart the httpd service:

   # systemctl restart httpd.service

Verification steps

1. Obtain a Kerberos ticket:

   # kinit

2. Open the URL to the protected directory in a browser.

Procedure

1. Install the mod_ssl package:

   # dnf install mod_ssl

2. Edit the /etc/httpd/conf.d/ssl.conf file and add the following settings to the <VirtualHost _default_:443> directive:

   1. Set the server name:

      ServerName example.com

   Important

   The server name must match the entry set in the Common Name field of the certificate.

   1. Optional: If the certificate contains additional host names in the Subject Alt Names (SAN) field, you can configure mod_ssl to provide TLS encryption also for these host names. To configure this, add the ServerAliases parameter with corresponding names:

      ServerAlias www.example.com server.example.com

   2. Set the paths to the private key, the server certificate, and the CA certificate:

      SSLCertificateKeyFile "/etc/pki/tls/private/example.com.key"
      SSLCertificateFile "/etc/pki/tls/certs/example.com.crt"
      SSLCACertificateFile "/etc/pki/tls/certs/ca.crt"

3. For security reasons, configure that only the root user can access the private key file:

   # chown root:root /etc/pki/tls/private/example.com.key
   # chmod 600 /etc/pki/tls/private/example.com.key

   Warning

   If the private key was accessed by unauthorized users, revoke the certificate, create a new private key, and request a new certificate. Otherwise, the TLS connection is no longer secure.

4. If you use firewalld, open port 443 in the local firewall:

   # firewall-cmd --permanent --add-port=443/tcp
   # firewall-cmd --reload

5. Restart the httpd service:

   # systemctl restart httpd

   Note

   If you protected the private key file with a password, you must enter this password each time when the httpd service starts.

Procedure

1. Edit the /etc/httpd/conf/httpd.conf file, and add the following setting to the <VirtualHost> directive for which you want to set the TLS protocol version. For example, to enable only the TLSv1.3 protocol:

   SSLProtocol -All TLSv1.3

2. Restart the httpd service:

   # systemctl restart httpd

Verification steps

1. Use the following command to verify that the server supports TLSv1.3:

   # openssl s_client -connect example.com:443 -tls1_3

2. Use the following command to verify that the server does not support TLSv1.2:

   # openssl s_client -connect example.com:443 -tls1_2

   If the server does not support the protocol, the command returns an error:

   140111600609088:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:ssl/record/rec_layer_s3.c:1543:SSL alert number 70

3. Optional: Repeat the command for other TLS protocol versions.

Procedure

1. Edit the /etc/httpd/conf/httpd.conf file, and add the SSLCipherSuite parameter to the <VirtualHost> directive for which you want to set the TLS ciphers:

   SSLCipherSuite "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!SHA1:!SHA256"

   This example enables only the EECDH+AESGCM, EDH+AESGCM, AES256+EECDH, and AES256+EDH ciphers and disables all ciphers which use the SHA1 and SHA256 message authentication code (MAC).

2. Restart the httpd service:

   # systemctl restart httpd

Verification steps

1. To display the list of ciphers the Apache HTTP Server supports:

   1. Install the nmap package:

      # dnf install nmap

   2. Use the nmap utility to display the supported ciphers:

      # nmap --script ssl-enum-ciphers -p 443 example.com
      ...
      PORT    STATE SERVICE
      443/tcp open  https
      | ssl-enum-ciphers:
      |   TLSv1.2:
      |     ciphers:
      |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
      |       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
      |       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
      ...

Procedure

1. Install the mod_security, mod_security_crs, and httpd packages:

   # dnf install -y mod_security mod_security_crs httpd

2. Start the httpd server:

   # systemctl restart httpd

Verification

1. Verify that the ModSecurity web-based application firewall is enabled on your Apache HTTP server:

   # httpd -M | grep security
    security2_module (shared)

2. Check that the /etc/httpd/modsecurity.d/activated_rules/ directory contains rules provided by mod_security_crs:

   # ls /etc/httpd/modsecurity.d/activated_rules/
   ...
   REQUEST-921-PROTOCOL-ATTACK.conf
   REQUEST-930-APPLICATION-ATTACK-LFI.conf
   ...

Procedure

1. Open the /etc/httpd/conf.d/mod_security.conf file in a text editor of your choice, for example:

   # vi /etc/httpd/conf.d/mod_security.conf

2. Add the following example rule after the line starting with SecRuleEngine On:

   SecRule ARGS:data "@contains evil" "deny,status:403,msg:'param data contains evil data',id:1"

   The previous rule forbids the use of resources to the user if the data parameter contains the evil string.

3. Save the changes, and quit the editor.

4. Restart the httpd server:

   # systemctl restart httpd

Verification

1. Create a test.html page:

   # echo "mod_security test" > /var/www/html/test.html

2. Restart the httpd server:

   # systemctl restart httpd

3. Request test.html without malicious data in the GET variable of the HTTP request:

   $ curl http://localhost/test.html?data=good
   
   mod_security test

4. Request test.html with malicious data in the GET variable of the HTTP request:

   $ curl localhost/test.html?data=xxxevilxxx
   
   <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
   <html><head>
   <title>403 Forbidden</title>
   </head><body>
   <h1>Forbidden</h1>
   <p>You do not have permission to access this resource.</p>
   </body></html>

5. Check the /var/log/httpd/error_log file, and locate the log entry about denying access with the param data containing an evil data message:

   [Wed May 25 08:01:31.036297 2022] [:error] [pid 5839:tid 139874434791168] [client ::1:45658] [client ::1] ModSecurity: Access denied with code 403 (phase 2). String match "evil" at ARGS:data. [file "/etc/httpd/conf.d/mod_security.conf"] [line "4"] [id "1"] [msg "param data contains evil data"] [hostname "localhost"] [uri "/test.html"] [unique_id "Yo4amwIdsBG3yZqSzh2GuwAAAIY"]

Procedure

1. Search for the module name in the configuration files in the /etc/httpd/conf.modules.d/ directory:

   # grep mod_ssl.so /etc/httpd/conf.modules.d/*

2. Edit the configuration file in which the module name was found, and uncomment the LoadModule directive of the module:

   LoadModule ssl_module modules/mod_ssl.so

3. If the module was not found, for example, because a RHEL package does not provide the module, create a configuration file, such as /etc/httpd/conf.modules.d/30-example.conf with the following directive:

   LoadModule ssl_module modules/<custom_module>.so

4. Restart the httpd service:

   # systemctl restart httpd