Chapter 1. Setting up the Apache HTTP web server

Procedure

1. Install the httpd package:

   # dnf install httpd

2. Open the TCP port 80 in the local firewall:

   # firewall-cmd --permanent --add-port=80/tcp
   # firewall-cmd --reload

3. Enable and start the httpd service:

   # systemctl enable --now httpd

4. Optional: Add HTML files to the /var/www/html/ directory.

   Note

   When adding content to /var/www/html/, files and directories must be readable by the user under which httpd runs by default. The content owner can be the either the root user and root user group, or another user or group of the administrator’s choice. If the content owner is the root user and root user group, the files must be readable by other users. The SELinux context for all the files and directories must be httpd_sys_content_t, which is applied by default to all content within the /var/www directory.

Procedure

1. Install the httpd package:

   # dnf install httpd

2. Edit the /etc/httpd/conf/httpd.conf file:

   1. Append the following virtual host configuration for the example.com domain:

      <VirtualHost *:80>
          DocumentRoot "/var/www/example.com/"
          ServerName example.com
          CustomLog /var/log/httpd/example.com_access.log combined
          ErrorLog /var/log/httpd/example.com_error.log
      </VirtualHost>

      These settings configure the following:

      • All settings in the <VirtualHost *:80> directive are specific for this virtual host.
      • DocumentRoot sets the path to the web content of the virtual host.

      • ServerName sets the domains for which this virtual host serves content.

        To set multiple domains, add the ServerAlias parameter to the configuration and specify the additional domains separated with a space in this parameter.

      • CustomLog sets the path to the access log of the virtual host.

      • ErrorLog sets the path to the error log of the virtual host.

        Note

        Apache uses the first virtual host found in the configuration also for requests that do not match any domain set in the ServerName and ServerAlias parameters. This also includes requests sent to the IP address of the server.

3. Append a similar virtual host configuration for the example.net domain:

   <VirtualHost *:80>
       DocumentRoot "/var/www/example.net/"
       ServerName example.net
       CustomLog /var/log/httpd/example.net_access.log combined
       ErrorLog /var/log/httpd/example.net_error.log
   </VirtualHost>

4. Create the document roots for both virtual hosts:

   # mkdir /var/www/example.com/
   # mkdir /var/www/example.net/

5. If you set paths in the DocumentRoot parameters that are not within /var/www/, set the httpd_sys_content_t context on both document roots:

   # semanage fcontext -a -t httpd_sys_content_t "/srv/example.com(/.*)?"
   # restorecon -Rv /srv/example.com/
   # semanage fcontext -a -t httpd_sys_content_t "/srv/example.net(/.\*)?"
   # restorecon -Rv /srv/example.net/

   These commands set the httpd_sys_content_t context on the /srv/example.com/ and /srv/example.net/ directory.

   Note that you must install the policycoreutils-python-utils package to run the restorecon command.

6. Open port 80 in the local firewall:

   # firewall-cmd --permanent --add-port=80/tcp
   # firewall-cmd --reload

7. Enable and start the httpd service:

   # systemctl enable --now httpd

Verification steps

1. Create a different example file in each virtual host’s document root:

   # echo "vHost example.com" > /var/www/example.com/index.html
   # echo "vHost example.net" > /var/www/example.net/index.html

2. Use a browser and connect to http://example.com. The web server shows the example file from the example.com virtual host.
3. Use a browser and connect to http://example.net. The web server shows the example file from the example.net virtual host.

Procedure

1. Edit the /etc/httpd/conf/httpd.conf file and add the following settings to the <VirtualHost> directive for which you want to configure client authentication:

   <Directory "/var/www/html/Example/">
     SSLVerifyClient require
   </Directory>

   The SSLVerifyClient require setting defines that the server must successfully validate the client certificate before the client can access the content in the /var/www/html/Example/ directory.

2. Restart the httpd service:

   # systemctl restart httpd

Verification steps

1. Use the curl utility to access the https://example.com/Example/ URL without client authentication:

   $ curl https://example.com/Example/
   curl: (56) OpenSSL SSL_read: error:1409445C:SSL routines:ssl3_read_bytes:tlsv13 **alert certificate required**, errno 0

   The error indicates that the web server requires a client certificate authentication.

2. Pass the client private key and certificate, as well as the CA certificate to curl to access the same URL with client authentication:

   $ curl --cacert ca.crt --key client.key --cert client.crt https://example.com/Example/

   If the request succeeds, curl displays the index.html file stored in the /var/www/html/Example/ directory.

Procedure

1. Install the httpd-manual package:

   # dnf install httpd-manual

2. Optional: By default, all clients connecting to the Apache HTTP Server can display the manual. To restrict access to a specific IP range, such as the 192.0.2.0/24 subnet, edit the /etc/httpd/conf.d/manual.conf file and add the Require ip 192.0.2.0/24 setting to the <Directory "/usr/share/httpd/manual"> directive:

   <Directory "/usr/share/httpd/manual">
   ...
       **Require ip 192.0.2.0/24**
   ...
   </Directory>

3. Restart the httpd service:

   # systemctl restart httpd

Verification steps

1. To display the Apache HTTP Server manual, connect with a web browser to http://host_name_or_IP_address/manual/