Chapter 1. Setting up the Apache HTTP web server

Procedure

1. Enable access to the keytab file of HTTP/<SERVER_NAME>@realm principal by creating the service principal:

   # ipa service-add HTTP/<SERVER_NAME>

   Copy to Clipboard Toggle word wrap

2. Retrieve the keytab for the principal stored in the /etc/gssproxy/http.keytab file:

   # ipa-getkeytab -s $(awk '/^server =/ {print $3}' /etc/ipa/default.conf) -k /etc/gssproxy/http.keytab -p HTTP/$(hostname -f)

   Copy to Clipboard Toggle word wrap

   This step sets permissions to 400, thus only the root user has access to the keytab file. The apache user does not.

3. Create the /etc/gssproxy/80-httpd.conf file with the following content:

   [service/HTTP]
     mechs = krb5
     cred_store = keytab:/etc/gssproxy/http.keytab
     cred_store = ccache:/var/lib/gssproxy/clients/krb5cc_%U
     euid = apache

   Copy to Clipboard Toggle word wrap

4. Restart and enable the gssproxy service:

   # systemctl restart gssproxy.service
   # systemctl enable gssproxy.service

   Copy to Clipboard Toggle word wrap

Procedure

1. Configure the mod_auth_gssapi module to protect the /var/www/html/private/ directory:

   <Location /var/www/html/private>
     AuthType GSSAPI
     AuthName "GSSAPI Login"
     Require valid-user
   </Location>

   Copy to Clipboard Toggle word wrap

2. Create system unit configuration drop-in file:

   # systemctl edit httpd.service

   Copy to Clipboard Toggle word wrap

3. Add the following parameter to the system drop-in file:

   [Service]
   Environment=GSS_USE_PROXY=1

   Copy to Clipboard Toggle word wrap

4. Reload the systemd configuration:

   # systemctl daemon-reload

   Copy to Clipboard Toggle word wrap

5. Restart the httpd service:

   # systemctl restart httpd.service

   Copy to Clipboard Toggle word wrap

Verification

1. Obtain a Kerberos ticket:

   # kinit

   Copy to Clipboard Toggle word wrap
2. Open the URL to the protected directory in a browser.

Procedure

1. Install the mod_ssl package:

   # yum install mod_ssl

   Copy to Clipboard Toggle word wrap

2. Edit the /etc/httpd/conf.d/ssl.conf file and add the following settings to the <VirtualHost _default_:443> directive:

   1. Set the server name:

      ServerName example.com

      Copy to Clipboard Toggle word wrap

1. Optional: If the certificate contains additional host names in the Subject Alt Names (SAN) field, you can configure mod_ssl to provide TLS encryption also for these host names. To configure this, add the ServerAliases parameter with corresponding names:

   ServerAlias www.example.com server.example.com

   Copy to Clipboard Toggle word wrap

2. Set the paths to the private key, the server certificate, and the CA certificate:

   SSLCertificateKeyFile "/etc/pki/tls/private/example.com.key"
   SSLCertificateFile "/etc/pki/tls/certs/example.com.crt"
   SSLCACertificateFile "/etc/pki/tls/certs/ca.crt"

   Copy to Clipboard Toggle word wrap

   1. For security reasons, configure that only the root user can access the private key file:

      # chown root:root /etc/pki/tls/private/example.com.key
      # chmod 600 /etc/pki/tls/private/example.com.key

      Copy to Clipboard Toggle word wrap
      Warning

      If the private key was accessed by unauthorized users, revoke the certificate, create a new private key, and request a new certificate. Otherwise, the TLS connection is no longer secure.

   2. If you use firewalld, open port 443 in the local firewall:

      # firewall-cmd --permanent --add-port=443/tcp
      # firewall-cmd --reload

      Copy to Clipboard Toggle word wrap

   3. Restart the httpd service:

      # systemctl restart httpd

      Copy to Clipboard Toggle word wrap
   Note

   If you protected the private key file with a password, you must enter this password each time when the httpd service starts.

Procedure

1. Edit the /etc/httpd/conf/httpd.conf file, and add the following setting to the <VirtualHost> directive for which you want to set the TLS protocol version. For example, to enable only the TLSv1.3 protocol:

   SSLProtocol -All TLSv1.3

   Copy to Clipboard Toggle word wrap

2. Restart the httpd service:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap

Verification

1. Use the following command to verify that the server supports TLSv1.3:

   # openssl s_client -connect example.com:443 -tls1_3

   Copy to Clipboard Toggle word wrap

2. Use the following command to verify that the server does not support TLSv1.2:

   # openssl s_client -connect example.com:443 -tls1_2

   Copy to Clipboard Toggle word wrap

   If the server does not support the protocol, the command returns an error:

   140111600609088:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:ssl/record/rec_layer_s3.c:1543:SSL alert number 70

   Copy to Clipboard Toggle word wrap
3. Optional: Repeat the command for other TLS protocol versions.

Procedure

1. Edit the /etc/httpd/conf/httpd.conf file, and add the SSLCipherSuite parameter to the <VirtualHost> directive for which you want to set the TLS ciphers:

   SSLCipherSuite "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH:!SHA1:!SHA256"

   Copy to Clipboard Toggle word wrap

   This example enables only the EECDH+AESGCM, EDH+AESGCM, AES256+EECDH, and AES256+EDH ciphers and disables all ciphers which use the SHA1 and SHA256 message authentication code (MAC).

2. Restart the httpd service:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap

Verification

1. To display the list of ciphers the Apache HTTP Server supports:

   1. Install the nmap package:

      # yum install nmap

      Copy to Clipboard Toggle word wrap

   2. Use the nmap utility to display the supported ciphers:

      # nmap --script ssl-enum-ciphers -p 443 example.com
      ...
      PORT    STATE SERVICE
      443/tcp open  https
      | ssl-enum-ciphers:
      |   TLSv1.2:
      |     ciphers:
      |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (ecdh_x25519) - A
      |       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 2048) - A
      |       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (ecdh_x25519) - A
      ...

      Copy to Clipboard Toggle word wrap

Procedure

1. Install the mod_security, mod_security_crs, and httpd packages:

   # yum install -y mod_security mod_security_crs httpd

   Copy to Clipboard Toggle word wrap

2. Start the httpd server:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap

Verification

1. Verify that the ModSecurity web-based application firewall is enabled on your Apache HTTP server:

   # httpd -M | grep security
    security2_module (shared)

   Copy to Clipboard Toggle word wrap

2. Check that the /etc/httpd/modsecurity.d/activated_rules/ directory contains rules provided by mod_security_crs:

   # ls /etc/httpd/modsecurity.d/activated_rules/
   ...
   REQUEST-921-PROTOCOL-ATTACK.conf
   REQUEST-930-APPLICATION-ATTACK-LFI.conf
   ...

   Copy to Clipboard Toggle word wrap

Procedure

1. Open the /etc/httpd/conf.d/mod_security.conf file in a text editor of your choice, for example:

   # vi /etc/httpd/conf.d/mod_security.conf

   Copy to Clipboard Toggle word wrap

2. Add the following example rule after the line starting with SecRuleEngine On:

   SecRule ARGS:data "@contains evil" "deny,status:403,msg:'param data contains evil data',id:1"

   Copy to Clipboard Toggle word wrap

   The previous rule forbids the use of resources to the user if the data parameter contains the evil string.

3. Save the changes, and quit the editor.

4. Restart the httpd server:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap

Verification

1. Create a test.html page:

   # echo "mod_security test" > /var/www/html/test.html

   Copy to Clipboard Toggle word wrap

2. Restart the httpd server:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap

3. Request test.html without malicious data in the GET variable of the HTTP request:

   $ curl http://localhost/test.html?data=good
   
   mod_security test

   Copy to Clipboard Toggle word wrap

4. Request test.html with malicious data in the GET variable of the HTTP request:

   $ curl localhost/test.html?data=xxxevilxxx
   
   <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
   <html><head>
   <title>403 Forbidden</title>
   </head><body>
   <h1>Forbidden</h1>
   <p>You do not have permission to access this resource.</p>
   </body></html>

   Copy to Clipboard Toggle word wrap

5. Check the /var/log/httpd/error_log file, and locate the log entry about denying access with the param data containing an evil data message:

   [Wed May 25 08:01:31.036297 2022] [:error] [pid 5839:tid 139874434791168] [client ::1:45658] [client ::1] ModSecurity: Access denied with code 403 (phase 2). String match "evil" at ARGS:data. [file "/etc/httpd/conf.d/mod_security.conf"] [line "4"] [id "1"] [msg "param data contains evil data"] [hostname "localhost"] [uri "/test.html"] [unique_id "Yo4amwIdsBG3yZqSzh2GuwAAAIY"]

   Copy to Clipboard Toggle word wrap

Procedure

1. Search for the module name in the configuration files in the /etc/httpd/conf.modules.d/ directory:

   # grep mod_ssl.so /etc/httpd/conf.modules.d/*

   Copy to Clipboard Toggle word wrap

2. Edit the configuration file in which the module name was found, and uncomment the LoadModule directive of the module:

   LoadModule ssl_module modules/mod_ssl.so

   Copy to Clipboard Toggle word wrap

3. If the module was not found, for example, because a RHEL package does not provide the module, create a configuration file, such as /etc/httpd/conf.modules.d/30-example.conf with the following directive:

   LoadModule ssl_module modules/<custom_module>.so

   Copy to Clipboard Toggle word wrap

4. Restart the httpd service:

   # systemctl restart httpd

   Copy to Clipboard Toggle word wrap