Chapter 1. Setting up the Apache HTTP web server

Procedure

1. Install the httpd package:

   # dnf install httpd

2. If you use firewalld, open the TCP port 80 in the local firewall:

   # firewall-cmd --permanent --add-port=80/tcp

   # firewall-cmd --reload

3. Enable and start the httpd service:

   # systemctl enable --now httpd

4. Optional: Add HTML files to the /var/www/html/ directory.

   Note

   When adding content to /var/www/html/, files and directories must be readable by the user under which httpd runs by default. The content owner can be either the root user and root user group, or another user or group of the administrator’s choice. If the content owner is the root user and root user group, the files must be readable by other users. All the files and directories must have the httpd_sys_content_t SELinux context, which is applicable by default to all content within the /var/www directory.

5. Connect to a web browser at http://server_IP_or_host_name/.

   If the /var/www/html/ directory is empty or does not contain an index.html or index.htm file, Apache displays the Red Hat Enterprise Linux Test Page. If /var/www/html/ contains HTML files with a different name, you can load them by entering the URL to that file, such as http://server_IP_or_host_name/example.html.

   For details, see the httpd.service(8) man page on your system.

Procedure

1. Install the httpd package:

   # dnf install httpd

2. Edit the /etc/httpd/conf/httpd.conf file:

   1. Append the following virtual host configuration for the example.com domain:

      <VirtualHost *:80>
          DocumentRoot "/var/www/example.com/"
          ServerName example.com
          CustomLog /var/log/httpd/example.com_access.log combined
          ErrorLog /var/log/httpd/example.com_error.log
      </VirtualHost>

      These settings configure the following:

      • All settings in the <VirtualHost *:80> directive are specific for this virtual host.
      • DocumentRoot sets the path to the web content of the virtual host.

      • ServerName sets the domains for which this virtual host serves content.

        To set multiple domains, add the ServerAlias parameter to the configuration and specify the additional domains separated with a space in this parameter.

      • CustomLog sets the path to the access log of the virtual host.

      • ErrorLog sets the path to the error log of the virtual host.

        Note

        The Apache HTTP Server uses the first virtual host found in the configuration also for requests that do not match any domain set in the ServerName and ServerAlias parameters. This also includes requests sent to the IP address of the server.

3. Append a similar virtual host configuration for the example.net domain:

   <VirtualHost *:80>
       DocumentRoot "/var/www/example.net/"
       ServerName example.net
       CustomLog /var/log/httpd/example.net_access.log combined
       ErrorLog /var/log/httpd/example.net_error.log
   </VirtualHost>

4. Create the document roots for both virtual hosts:

   # mkdir /var/www/example.com/
   # mkdir /var/www/example.net/

5. Install the policycoreutils-python-utils package to run the restorecon command:

   # dnf install policycoreutils-python-utils

6. If you set paths in the DocumentRoot parameters that are not within /var/www/, set the httpd_sys_content_t context on both document roots:

   # semanage fcontext -a -t httpd_sys_content_t "/srv/example.com(/.*)?"
   # restorecon -Rv /srv/example.com/
   # semanage fcontext -a -t httpd_sys_content_t "/srv/example.net(/.\*)?"
   # restorecon -Rv /srv/example.net/

   These commands set the httpd_sys_content_t context on the /srv/example.com/ and /srv/example.net/ directory.

7. If you use firewalld, open port 80 in the local firewall:

   # firewall-cmd --permanent --add-port=80/tcp
   # firewall-cmd --reload

8. Enable and start the httpd service:

   # systemctl enable --now httpd

Verification

1. Create a different example file in each virtual host’s document root:

   # echo "vHost example.com" > /var/www/example.com/index.html
   # echo "vHost example.net" > /var/www/example.net/index.html

2. Use a browser and connect to http://example.com. The web server shows the example file from the example.com virtual host.

Procedure

1. Edit the /etc/httpd/conf/httpd.conf file to configure client authentication:

   <Directory "/var/www/html/Example/">
     SSLVerifyClient require
   </Directory>

   The SSLVerifyClient require setting configures the server to require a client certificate before the client can access the content in the /var/www/html/Example/ directory.

2. Restart the httpd service:

   # systemctl restart httpd

Verification

1. Access the https://example.com/Example/ URL without client authentication:

   $ curl \https://example.com/Example/

   curl: (56) OpenSSL SSL_read: error:1409445C:SSL routines:ssl3_read_bytes:tlsv13 alert certificate required, errno 0

   The error indicates that the web server requires a client certificate authentication.

2. Access the same URL with client authentication by passing the client private key and certificate, and the CA certificate:

   $ curl --cacert ca.crt --key client.key --cert client.crt https://example.com/Example/

   If the request succeeds, the curl utility displays the index.html file stored in the /var/www/html/Example/ directory.

Procedure

1. Install the httpd-manual package:

   # dnf install httpd-manual

2. Optional: By default, all clients connecting to the Apache HTTP Server can display the manual. To restrict access to a specific IP range, such as the 192.0.2.0/24 subnet, edit the /etc/httpd/conf.d/manual.conf file and add the Require ip 192.0.2.0/24 setting to the <Directory "/usr/share/httpd/manual"> directive:

   <Directory "/usr/share/httpd/manual">
   ...
       Require ip 192.0.2.0/24
   ...
   </Directory>

3. Restart the httpd service:

   # systemctl restart httpd