Run a web server with Apache

هذا الجزء لم يُترجم بعد. أنت ترى النص الإنجليزي.

$ مستخدم عادي# بصلاحية root (أو مع sudo)

Install and start Apache

Install the package, start the service for good, open the firewall, and test.

#dnf install -y httpd
#systemctl enable --now httpd
#firewall-cmd --add-service=http --permanent
#firewall-cmd --add-service=https --permanent
#firewall-cmd --reload
$curl -I http://localhost

ملاحظة

The group "Basic Web Server" (dnf group install "Basic Web Server") adds more modules, like mod_ssl for HTTPS.

21.2

Find the main configuration file

The main file is /etc/httpd/conf/httpd.conf. Lines are directives; <Directory> blocks set rules for folders.

$grep -vE '^\s*(#|$)' /etc/httpd/conf/httpd.conf | head -30

Directive	Meaning
`ServerRoot "/etc/httpd"`	Base folder for relative paths
`Listen 80`	Port to listen on
`Include conf.modules.d/*.conf`	Load the modules
`User apache`, `Group apache`	Account that serves the pages
`DocumentRoot "/var/www/html"`	Folder with the website files
`<Directory "/var/www/html">` … `</Directory>`	Rules for a folder (Require, Options, AllowOverride)
`IncludeOptional conf.d/*.conf`	Your own config files
`ErrorLog "logs/error_log"`	Errors (in /var/log/httpd/)

21.3

Create web content

Files in the DocumentRoot are the website. index.html is the default page.

#echo "Welcome to server1" > /var/www/html/index.html
$curl http://localhost
Welcome to server1
#ls -Z /var/www/html/index.html

انتبه

A file created in your home folder and then moved (mv) to /var/www/html keeps its old SELinux label (user_home_t) and Apache gets "403 Forbidden". Use cp, or fix it with restorecon -Rv /var/www/html.

21.4

Understand the configuration files

Apache's configuration is split over several folders.

Path	Contains
`/etc/httpd/conf/httpd.conf`	Main settings
`/etc/httpd/conf.d/*.conf`	Extra config: vhosts, ssl.conf, welcome page
`/etc/httpd/conf.modules.d/*.conf`	Which modules are loaded
`/var/www/html/`	Default DocumentRoot
`/var/log/httpd/`	access_log and error_log

#apachectl configtest
Syntax OK
#httpd -M | head
#systemctl reload httpd

تذكّر

After every config change: apachectl configtest, then systemctl reload httpd.

21.5

Create virtual hosts

One Apache can serve many websites. A virtual host chooses the site by the host name the browser asks for.

Create the content folders.

#mkdir -p /srv/web/{site1,site2}
#echo "This is site1" > /srv/web/site1/index.html
#echo "This is site2" > /srv/web/site2/index.html

Create a config file for both sites.

/etc/httpd/conf.d/vhosts.conf

<Directory "/srv/web">
    Require all granted
    AllowOverride None
</Directory>
 
<VirtualHost *:80>
    ServerName site1.example.com
    DocumentRoot /srv/web/site1
    ErrorLog logs/site1_error_log
    CustomLog logs/site1_access_log combined
</VirtualHost>
 
<VirtualHost *:80>
    ServerName site2.example.com
    DocumentRoot /srv/web/site2
</VirtualHost>

Give the new folder the web content SELinux label (see the SELinux chapter).

#semanage fcontext -a -t httpd_sys_content_t "/srv/web(/.*)?"
#restorecon -Rv /srv/web

Test the syntax, reload, and test with the names (here via /etc/hosts).

#apachectl configtest && systemctl reload httpd
#echo "192.168.122.10 site1.example.com site2.example.com" >> /etc/hosts
$curl http://site1.example.com
$curl http://site2.example.com

ملاحظة

The first VirtualHost is also the default for requests with an unknown name.

21.6

Serve on another port

A non-standard port needs three changes: Apache, SELinux and the firewall.

#echo "Listen 82" > /etc/httpd/conf.d/port82.conf
#semanage port -a -t http_port_t -p tcp 82
#firewall-cmd --add-port=82/tcp --permanent; firewall-cmd --reload
#systemctl restart httpd
$curl http://localhost:82

نصيحة للامتحان

When the web server "does not work", check in this order: systemctl status httpd, apachectl configtest, curl localhost on the server, the firewall, then SELinux (ls -Z, ausearch -m avc -ts recent).

في العمل

Hide the version and add security headers: ServerTokens Prod, ServerSignature Off, Header always set X-Content-Type-Options nosniff, and use HTTPS (mod_ssl) for every real site.

21.7

Remember the main points

The most important facts of this chapter, in short.

Install with dnf install httpd, start with systemctl enable --now httpd, open the firewall service http (and https).
The main config is /etc/httpd/conf/httpd.conf; extra files go in /etc/httpd/conf.d/*.conf.
The default web folder is /var/www/html (DocumentRoot).
Virtual hosts serve more websites on one server, chosen by ServerName; each has its own DocumentRoot.
A new DocumentRoot outside /var/www needs a <Directory> block with Require all granted and the SELinux type httpd_sys_content_t.
A new port needs Listen PORT, an SELinux port label (http_port_t) and a firewall rule.
Test the config with apachectl configtest (or httpd -t); test the site with curl http://NAME/.

21.8

Learn the key terms

The words of this chapter in simple English.

Term	Meaning
httpd	The Apache web server program and service.
DocumentRoot	The folder with the files of a website.
Virtual host	One of several websites on the same server.
ServerName	The host name a virtual host answers to.
Directory block	Settings for one folder, like who may read it.
Listen	The port (and address) Apache waits on.
conf.d	The folder for extra Apache config files.
http_port_t	The SELinux type for ports that web servers may use.

21.9

Check what you learned

Think about the answer first, then open it.

1Which three commands make a basic web server work and reachable?

dnf install httpd, systemctl enable --now httpd, firewall-cmd --permanent --add-service=http + --reload.

2Where do you put a new virtual host file?

In /etc/httpd/conf.d/NAME.conf.

3Your site is in /web and Apache shows "Forbidden". Which two things do you check?

A <Directory "/web"> block with Require all granted, and the SELinux type httpd_sys_content_t (semanage fcontext + restorecon).

4How do you test the Apache config before a restart?

apachectl configtest.

5How do you let Apache listen on port 82?

Listen 82, semanage port -a -t http_port_t -p tcp 82, firewall rule for 82/tcp, restart httpd.

6Why is port 8080 a bad choice for the example?

It already has another SELinux type (http_cache_port_t), so it needs -m instead of -a.

7Which log shows Apache errors?

/var/log/httpd/error_log.

8How do you test a virtual host from the server itself?

Add the name to /etc/hosts and run curl http://NAME/.

تدرّب

معمل 21.1Host two websitesمتوسط · 40 دقيقةلم يبدأ

تدرّب

كل الأوامر في هذا الفصل