-
Language:
English
-
Language:
English
Red Hat Training
A Red Hat training course is available for Red Hat JBoss Core Services
Chapter 2. Installing JBoss Core Services Apache HTTP Server on Red Hat Enterprise Linux
2.1. ZIP Installation
2.1.1. Prerequisites
The following packages are required to run Red Hat JBoss Core Services Apache HTTP Server 2.4.23 on Red Hat Enterprise Linux:
- apr
- apr-devel
- apr-util
- apr-util-devel
- apr-util-ldap
- elinks
- krb5-workstation
- mailcap
To install these prerequisites on Red Hat Enterprise Linux, issue the following command as the root user:
# yum install apr apr-devel apr-util apr-util-devel apr-util-ldap elinks krb5-workstation mailcap
2.1.2. Download and Extract Apache HTTP Server
To install Apache HTTP Server, download and extract the installation ZIP files. Installation can be performed by non-root users if the user account has write access to the intended installation directory.
- Open a browser and log in to the Red Hat Customer Portal JBoss Software Downloads page.
- Select Apache HTTP Server in the Product drop-down menu.
- Select the correct JBoss Core Services version from the Version drop-down menu.
- Find Red Hat JBoss Core Services Apache HTTP Server in the list, ensuring that you select the correct platform and architecture for your system, and click the Download link.
Extract the downloaded ZIP file to your installation directory.
NoteWe recommend that you install Apache HTTP Server in the
/opt/
directory.
The jbcs-httpd24-2.4/httpd
directory created by extracting the ZIP archive is the top-level directory for Apache HTTP Server. This is referred to in this documentation as HTTPD_HOME
.
2.1.3. Configuring the Apache HTTP Server Installation
Some configuration is required before running JBoss Core Services Apache HTTP Server. This section includes the following configuration procedures:
Creating an Apache User
Follow this procedure to create the apache
user and its parent group:
As the root user:
-
On a command line, change directory to
HTTPD_HOME
. Run the following command to create the
apache
user group:# groupadd -g 48 -r apache
Run the following command to create the
apache
user in theapache
user group:# useradd -c "Apache" -u 48 -g apache -s /bin/sh -r apache
From
HTTPD_HOME
, issue the following command to assign the ownership of the Apache directories to theapache
user to allow the user to run Apache HTTP Server:# chown -R apache:apache *
You can use
ls -l
to verify that theapache
user is the owner of the directory.
Disabling/Enabling SSL Support
Apache HTTP Server supports SSL by default, but it can be disabled. Follow this procedure to disable or re-enable SSL support.
Go to the
HTTPD_HOME/conf.d/
directory and rename the SSL configuration file:-
To disable SSL, rename
ssl.conf
tossl.conf.disabled
. -
To re-enable SSL, rename
ssl.conf.disabled
tossl.conf
.
-
To disable SSL, rename
Running the Apache HTTP Server Post-Installation Script
-
On a command line, change to the
HTTPD_HOME
directory (root user access not required). Issue the following command:
./.postinstall
2.1.4. Starting Apache HTTP Server
To start Apache HTTP Server, on a command line as root user, change to HTTPD_HOME/sbin/
and issue the following command:
./apachectl start
2.1.5. Stopping Apache HTTP Server
To stop Apache HTTP Server, on a command line as root user, change to HTTPD_HOME/sbin/
, and issue the following command:
./apachectl stop
2.1.6. Running Apache HTTP Server without root access on Red Hat Enterprise Linux (ZIP installation)
To run Apache HTTP Server as a non-root user, such as the apache
user:
Stop all instances of Apache HTTP Server:
pkill httpd
Set the
http
listen port to higher than 1024 inHTTPD_HOME/conf/httpd.conf
:Listen 2080 ServerName <hostname>:2080
Set the
https
listen port to higher than 1024 inHTTPD_HOME/conf.d/ssl.conf
:Listen 2443
Change the ownership of the
logs
directory:chown -R apache:apache HTTPD_HOME/logs/
Change the ownership of the
run
directory:chown -R apache:apache HTTPD_HOME/var/run/
Verify that
httpd
is only running under theapache
user, not theroot
andapache
users:$ ps -eo euser,egroup,comm | grep httpd apache apache httpd apache apache httpd apache apache httpd ...
ImportantTo prevent unauthorized access or modification of files and directories by website users and to prevent unwanted changes to Apache HTTP Server configuration files, limit the file permissions of the
apache
user and enable SELinux .
2.2. RPM Installation
Installing JBoss Core Services Apache HTTP Server from RPM packages installs Apache HTTP Server as a service. The RPM installation option is only available for Red Hat Enterprise Linux 6 and Red Hat Enterprise Linux 7.
2.2.1. Installing the Apache HTTP Server from RPM Packages
Before downloading and installing the RPM packages, you must register your system with Red Hat Subscription Management and subscribe to the respective Content Delivery Network (CDN) repositories.
For information on registering Red Hat Enterprise Linux, see Configuring the Subscription Service for Red Hat Enterprise Linux 6 or The Subscription Manager for Red Hat Enterprise Linux 7.
Attaching subscriptions to Red Hat Enterprise Linux (if required)
If the system does not have a subscription attached that provides the Apache HTTP Server:
- Log in to the Red Hat Subscription Manager.
- Click on the Systems tab.
-
Click on the
Name
of the system to add the subscription to. -
Change from the Details tab to the Subscriptions tab, then click
Attach Subscriptions
. -
Select the check box beside the subscription to attach, then click
Attach Subscriptions
.
To verify that a subscription provides the required CDN repositories:
- Log in to: https://access.redhat.com/management/subscriptions.
-
Click the
Subscription Name
. Under Products Provided, you require:
- Red Hat JBoss Core Services.
Installing the Apache HTTP Server from RPM packages using YUM
On a command line, subscribe to the Apache HTTP Server CDN repositories for your operating system version using
subscription-manager
:# subscription-manager repos --enable <repository>
For Red Hat Enterprise Linux 6:
- jb-coreservices-1-for-rhel-6-server-rpms
For Red Hat Enterprise Linux 7:
- jb-coreservices-1-for-rhel-7-server-rpms
Run the following command as the root user to install the Apache HTTP Server:
# yum groupinstall jbcs-httpd24
2.2.2. Configuring the Apache HTTP Server Installation (RPM Installation)
Before starting an RPM installation of JBoss Core Services Apache HTTP Server, there are some optional configurations you can perform. This section includes the following configuration procedures:
Removing SSL Support
Apache HTTP Server supports SSL by default, but it can be removed. To remove SSL support, remove the mod_ssl package.
At a shell prompt, run the following command as the root user:
# yum remove jbcs-httpd24-mod_ssl
2.2.3. Starting Apache HTTP Server
In a shell prompt as the root user, start the Apache HTTP Server service:
For Red Hat Enterprise Linux 6:
# service jbcs-httpd24-httpd start
For Red Hat Enterprise Linux 7:
# systemctl start jbcs-httpd24-httpd.service
2.2.4. Stopping Apache HTTP Server
In a shell prompt as the root user, stop the Apache HTTP Server service:
For Red Hat Enterprise Linux 6:
# service jbcs-httpd24-httpd stop
For Red Hat Enterprise Linux 7:
# systemctl stop jbcs-httpd24-httpd.service
2.2.5. Configuring Apache HTTP Server to Start at Boot
Use the following command to enable the Apache HTTP Server service to start at boot.
For Red Hat Enterprise Linux 6:
# chkconfig jbcs-httpd24-httpd on
For Red Hat Enterprise Linux 7:
# systemctl enable jbcs-httpd24-httpd.service
2.3. SELinux Policies
2.3.1. SELinux Policy Information
The Security-Enhanced Linux (SELinux) security model is enforced by the kernel and ensures applications have limited access to resources such as file system locations and ports. This helps ensure that the errant processes (either compromised or poorly configured) are restricted and in some cases prevented from running.
The following table contains information about the SELinux policies provided in the jbcs-httpd2.4-httpd-selinux
packages.
Table 2.1. RPMs and Default SELinux Policies
Name | Port Information | Policy Information |
---|---|---|
mod_cluster |
Two ports ( |
A post installation script configures the context mapping for |
For more information about using SELinux and other Red Hat Enterprise Linux security information, see the Red Hat Enterprise Linux Security Guide.
2.3.2. SELinux Policies for an RPM Installation
SELinux policies for Apache HTTP Server are provided by the jbcs-httpd2.4-httpd-selinux
package available in the jb-coreservices-1-for-rhel-7-server-rpms
and jb-coreservices-1-for-rhel-6-server-rpms
Content Delivery Network (CDN) repositories.
To enable SELinux policies on Apache HTTP Server, install the jbcs-httpd2.4-httpd-selinux
package for the version of Red Hat Enterprise Linux in use.
2.3.3. SELinux Policies for a ZIP Installation
By default, the SELinux policy provided is not active and the Apache HTTP Server processes run in the unconfined_t
domain. This domain does not confine the processes, and if you chose not to enable the SELinux policy provided, it is recommended that you restrict file access for the apache
user to the files and directories required by the Apache HTTP Server runtime.
For this release, SELinux policies are provided in the ZIP packages. The .postinstall.selinux
file is included in root Apache HTTP Server folder. If required, you can run the .postinstall.selinux
script.
To install the SELinux policies for ZIP installations:
Install the
selinux-policy-devel
package:yum install -y selinux-policy-devel
Execute the
.postinstall.selinux
script:cd <httpd_home> sh .postinstall.selinux
Make and install the SELinux module:
cd <httpd_home>/selinux/ make -f /usr/share/selinux/devel/Makefile semodule -i jbcs-httpd24-httpd.pp
Apply the SELinux contexts for Apache HTTP Server:
restorecon -r <httpd_home>
Add access permissions to the required ports for Apache HTTP Server:
semanage port -a -t http_port_t -p tcp 6666 semanage port -a -t http_port_t -p udp 23364
Start the Apache HTTP Server service:
<httpd_home>/sbin/apachectl start
Check the context of the running process expecting
httpd_t
:$ ps -eZ | grep httpd | head -n1 unconfined_u:unconfined_r:httpd_t:s0-s0:c0.c1023 2864 ? 00:00:00 httpd
To verify the contexts of the httpd directories, for example:
ls -lZ <httpd_home>/logs/