Apache cheatsheet for CentOS8

1. sudo systemctl stop httpd
2. backup all config files:

   # it is one of these files:
     /etc/apache2/httpd.conf
     /etc/apache2/apache2.conf
     /etc/httpd/httpd.conf  # this one
     /etc/httpd/conf/httpd.conf
   
   # the do the backup
   sudo cp /etc/httpd/conf.d/*.conf ~/httpd-backup
   sudo cp /etc/httpd/conf/httpd.conf ~/httpd-backup/httpd.conf
   sudo cp /etc/httpd/conf/ssl.conf ~/httpd-backup/ssl.conf
   

3. sudo dnf install httpd --upgrade is NOT the way to do it. To update Apache in CentOS, we have to fully install the latest version of httpd (Apache server)
4. sudo systemctl start httpd (or sudo service httpd start on other Linux distribution)

centos expects firewalld to be running. i turned off firewalld in favour of the traditional iptables. therefore the following apache firewall steps did nothing:

• sudo firewall-cmd –permanent –zone=public –add-service=http
• sudo firewall-cmd –permanent –zone=public –add-service=https
• sudo firewall-cmd –reload

instead I added these iptable forward rules:

0 log        tcp  --              192.168.111.11       tcp dpt:80 log flags 0 level 6 prefix " f o r w a r d http --> vm1"
0 accept     tcp  --              192.168.111.11       tcp dpt:80 /* forward web to vm1 */

along with these prerouting rules:

log    tcp  --  ens33  *  0.0.0.0/0   0.0.0.0/0   tcp dpt:80 log flags 0 level 6 prefix " . . d n a t  web pkt to vm1 "
dnat   tcp  --  ens33  *  0.0.0.0/0   0.0.0.0/0   tcp dpt:80 /* translate web destination to vm1 */ to:192.168.111.11

Other distributions might install in /etc/apache2 but Centos installs in:

• /etc/httpd/conf/httpd.conf and
• /etc/httpd/conf.d/php.conf and others like welcome.conf autoindex.conf etc.

In fact, you can change this behaviour by looking for the ServerRoot line in httpd.conf. In my case I left it as "/etc//httpd"

documentroot is an environment variable set within apache config file that specifies the root of the web server. all web files served by this apache server see this directory as the root directory:

by default it is /var/www/html or /var/www

this can be changed with by changing documentroot in the config file: /etc/httpd/conf/httpd.conf

if it is not listed there, you simply add the line: documentroot /var/www/newdocumentroot

top of the tree under which apaches config, error, and log files are kept. see /etc/httpd/conf/httpd.conf

• /var/log/httpd
• /var/lib/httpd # contains the httpd state
• /etc/httpd/conf/httpd.conf # the main config file!
• /etc/httpd/conf/magic # contains the mime types supported
• /etc/httpd/conf.d/php.conf
• /etc/httpd/conf.d/welcome.conf
• /etc/httpd/conf.d/userdir.conf
• /etc/httpd/conf.d/autoindex.conf

see man 5 httpd.conf which states that the main config file for apache is:

• /etc/httpd/conf/httpd.conf

dnf upgrade httpd

Each of these daemons should be run by a least privileged user, and NOT run by root.

1. Make the user have nologin shell. Here are a few lines of /etc/passwd where you can see that these users have least privileges.

   zintis:x:1000:1000::/home/zintis:/bin/bash
   apache:x:48:48:Apache:/usr/share/httpd:/sbin/nologin
   mysql:x:27:27:MySQL Server:/var/lib/mysql:/sbin/nologin
   nginx:x:992:989:Nginx web server:/var/lib/nginx:/sbin/nologin
   

To change a user to use /sbin/nologin use the command:

• chsh /sbin/nologin apache

OR

• usermod -s /sbin/nologin apache

1. Ensure all the files in /var/www are owned by apache with group apache:
   • cd /var/www ; chown apache:apache *
2. change the home directory of each user. So for apache -> /var/www/html
   • sudo vipw and change the home directory to /var/www/html
   • or, usermod -m -d /var/www/html apache -d is an abbreviation for --home and changes the user's home directory

   Typically you would run these commands as a common sequence:

   • mkdir /home/new_home_directory
   • chown username:username /home/new_home_directory
   • chmod 700 /home/new_home_directory
   • usermod --home /home/new_home_directory username

You can change global directory security settings, or override these global settings for a particular directory with the AllowOverride yes Otherwise just the global settings will take effect.

Starting from DocumentRoot "/var/www/html"

<Directory>
Require ip 77.68.0.0/16 127.0.0.1/32   
Require ip 2001:db8::a00:20ff:fea7:ccea
Require ip 2001:db8:1:1::a
Require ip 2001:db8:2:1::/64
Require ip 2001:db8:3::/48
</Directory>

This should get you a line (among others) that is:

• /var/www/html(/.*)? all files system_u:object_r:httpd_sys_rw_content_t:s0 where the right section means that:
  1. the process httpd has read/write permissions inside the directories specifed i.e /var/www/html

I had to tell semange to also allow the process access out the network, so that it is able to download and use plugins that are in the cloud. So, do this: setsebool -P httpd_can_network_connect on

Then I confirmed that change with getsebool -a | grep httpd_can_network_connect like this:

root@zinux /var/www/html[1014]$
getsebool -a |  grep httpd_can_network
httpd_can_network_connect --> off
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
root@zinux /var/www/html[1015]$
setsebool -P httpd_can_network_connect on
root@zinux /var/www/html[1016]$
getsebool -a |  grep httpd_can_network
httpd_can_network_connect --> on
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
root@zinux /var/www/html[1017]$

Seems like my database had privileges but not to the correct database or to the correct host.

GRANT ALL PRIVILEGES ON wordpress.* TO "wordpress"@"zintis.net" 
    -> IDENTIFIED BY "###yoursecretpass######";

That was part of it. The other was properly editing wp-config.php

// ** MySQL settings - You can get this info from your web host ** //
/** The name of the database for WordPress */
define( 'DB_NAME', 'wordpress' );

/** MySQL database username */
define( 'DB_USER', 'wordpress' );

/** MySQL database password */
define( 'DB_PASSWORD', '###yoursecrretpass######' );

/** MySQL hostname */
/** define( 'DB_HOST', 'localhost' ); */
define( 'DB_HOST', 'zintis.net' );

The admin site is: zintis.net/wp-admin/ username and password are what you set them when installing wordpress.

I installed wpscan using brew, so: brew install wpscan Well actually I tried that unsuccessfully. What did work was this:

1. curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh > wpscan-install.sh
2. chmod 740 wpscan-install.sh
3. mv wpscan-install.sh ~/bin
4. less ~/bin/wpscan-install
5. ~/bin/wpscan-install.sh
6. brew install wpscanteam/tap/wpscan * actually I do not remember if I did this step or not…, but I did run brew upgrade wpscan after this point.

I got a message: Warning: wpscanteam/tap/wpscan 3.8.15 already installed

• openssl genrsa -des3 -out vm2.andrewsmith.ops.key 2048
• chmod 600 vm2.andrewsmith.ops.key
• openssl req -new -key vm2.andrewsmith.ops.key -out vm2.andrewsmith.ops.csr
• openssl x509 -req -days 365 -in vm2.andrewsmith.ops.csr -signkey vm2.andrewsmith.ops.key -out vm2.andrewsmith.ops.crt
• openssl rsa -in vm2.andrewsmith.ops.key -out vm2.andrewsmith.ops.key.nopass
• mv vm2.andrewsmith.ops.key.nopass vm2.andrewsmith.ops.key
• openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650
• chmod 600 vm2.andrewsmith.ops.key cakey.pem
• cp vm2.andrewsmith.ops.key cakey.pem /etc/ssl/private
• cp vm2.andrewsmith.ops.crt cacert.pem /etc/ssl/certs

/etc/httpd/conf/httpd.conf

Actually be careful here , as there are several places where the certificates could be referenced. To find out run the following:=

• grep -i -r "SSLCertificate" /etc/httpd
• grep -i -r "SSLCertificate" /etc/httpd

root@vm1/etc/httpd[1017]$ 
grep -i -r "SSLCertificate" /etc/httpd
/etc/httpd/conf.d/ssl.conf.holding:#   Point SSLCertificateFile at a PEM encoded certificate.  If
/etc/httpd/conf.d/ssl.conf.holding:# SSLCertificateFile /etc/pki/tls/certs/localhost.crt
/etc/httpd/conf.d/ssl.conf.holding:# SSLCertificateFile /etc/ssl/certs/vm2.zintis.ops.crt
/etc/httpd/conf.d/ssl.conf.holding:# SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
/etc/httpd/conf.d/ssl.conf.holding:# SSLCertificateKeyFile /etc/ssl/private/vm2.zintis.ops.key
/etc/httpd/conf.d/ssl.conf.holding:#   Point SSLCertificateChainFile at a file containing the
/etc/httpd/conf.d/ssl.conf.holding:#   the referenced file can be the same as SSLCertificateFile
/etc/httpd/conf.d/ssl.conf.holding:# SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
/etc/httpd/conf.d/ssl.conf:#   Point SSLCertificateFile at a PEM encoded certificate.  If
/etc/httpd/conf.d/ssl.conf:SSLCertificateFile /etc/pki/tls/certs/localhost.crt
/etc/httpd/conf.d/ssl.conf:SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
/etc/httpd/conf.d/ssl.conf:#   Point SSLCertificateChainFile at a file containing the
/etc/httpd/conf.d/ssl.conf:#   the referenced file can be the same as SSLCertificateFile
/etc/httpd/conf.d/ssl.conf:#SSLCertificateChainFile /etc/pki/tls/certs/server-chain.crt
/etc/httpd/conf/httpd.conf:SSLCertificateFile "/etc/ssl/certs/vm1.zintis.ops.crt"
root@vm1/etc/httpd[1018]$ 

You're about to add a TXT record to the DNS settings at your domain registrar. This is the easiest method for most new Google Workspace administrators.

If you prefer a different verification method, you can also use the setup tool to:

add a CNAME record at your domain registrar. This is similar to the TXT verification method described below. get an HTML file with your verification code. You can upload that file to your website, and we'll confirm your domain ownership when we see the file on your site. get your verification code in the form of an HTML meta tag. You can add that meta tag to your website's home page, and we'll confirm your domain ownership when we see the tag in your home page's HTML code. If your domain doesn't have MX records for an existing email provider, you might be able to use an MX record to confirm your domain ownership. Note: The setup tool only offers this option if it determines your domain is eligible for this verification method. To use one of these other verification methods, click Switch verification methods when you open the setup tool.

Run April 23, 2021 Key to this process are the snap install commands, and the certbot –apache command. See certbot.eff.org/docs

dnf install snapd
iptables -L
iptables -S
iptables -A INPUT -p tcp -m tcp --dport 80 -j LOG --log-prefix " Remote web " --log-level 6
iptables -A INPUT -p tcp -m tcp --dport 80 -j ACCEPT
iptables -A INPUT -p tcp -m tcp --dport 443 -j LOG --log-prefix " Remote https " --log-level 6
iptables -A INPUT -p tcp -m tcp --dport 443 -j ACCEPT
systemctl enable --now snapd.socket
systemctl start snapd
snap install core
snap refresh core
dnf list --installed | grep certbot
dnf remove certbot
lst /var/lib/snapd/
ln -s /var/lib/snapd/snap /snap
snap install --classic certbot
ln -s /snap/bin/certbot /usr/bin/certbot
dnf install mod_ssl
which ssl_module
ssr httpd
apachectl -M | grep ssl
certbot --apache

Then you can check if your auto-renew is set up correctly. I found that crontab -l had zero entries, so I looked further with:

• systemctl list-timers

  systemctl list-timers
  NEXT                         LEFT          LAST                         PASSED       UNIT                         ACTIVATES
  Fri 2021-04-23 11:40:00 EDT  6min left     Fri 2021-04-23 11:30:04 EDT  3min 37s ago sysstat-collect.timer        sysstat-collect.service
  Fri 2021-04-23 12:22:15 EDT  48min left    Fri 2021-04-23 11:22:14 EDT  11min ago    dnf-makecache.timer          dnf-makecache.service
  Fri 2021-04-23 16:23:55 EDT  4h 50min left Thu 2021-04-22 16:23:55 EDT  19h ago      systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.s>
  Fri 2021-04-23 19:01:00 EDT  7h left       n/a                          n/a          snap.certbot.renew.timer     snap.certbot.renew.servi>
  Sat 2021-04-24 00:00:00 EDT  12h left      Fri 2021-04-23 00:00:00 EDT  11h ago      unbound-anchor.timer         unbound-anchor.service
  Sat 2021-04-24 00:07:00 EDT  12h left      Fri 2021-04-23 00:07:00 EDT  11h ago      sysstat-summary.timer        sysstat-summary.service
  Sat 2021-04-24 06:18:24 EDT  18h left      Fri 2021-04-23 06:17:02 EDT  5h 16min ago dnf-automatic.timer          dnf-automatic.service
  
  7 timers listed.
  Pass --all to see loaded but inactive timers, too.
  root@zinux ~[1003]$
  

  Of note is the snap.certbot.renew.timer line. So looks good.

The obvious one is looking at what certificates you have instaslled:

• certbot certificates

  certbot certificates
  Saving debug log to /var/log/letsencrypt/letsencrypt.log
  
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  Found the following certs:
    Certificate Name: www.zintis.net
      Serial Number: 381beada275ecacc9cb450278104dcacb28
      Key Type: RSA
      Domains: www.zintis.net
      Expiry Date: 2021-07-22 14:05:28+00:00 (VALID: 89 days)
      Certificate Path: /etc/letsencrypt/live/www.zintis.net/fullchain.pem
      Private Key Path: /etc/letsencrypt/live/www.zintis.net/privkey.pem
  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  root@zinux /etc/letsencrypt[1073]$
  
  

  Looks good.

You can usewww.ssllabs.com to check your letsencrypt installation:

This failed for me. I believe it is because my certbot –apache gave me the option of creating a cert for www.zintis.net which I took. However, my apache2 setup seems to only have zintis.net (no www).

1. fix by recreating a cert for zintis.net?
2. fix by getting apache to use www.zintis.net?
3. The domain name is an alias for a web site whose main name is different, but the alias was not included in the certificate by mistake

I am not sure which way to go…. hmmmmm I will try 1) and include an alias 3) so, I will delete my certbot certificate by running certbot --apache again, and replace it.

I am getting this:

root@zinux /var/www/html[1085]$
certbot --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache

Which names would you like to activate HTTPS for?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: www.zintis.net
2: zinux.zintis.net
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate numbers separated by commas and/or spaces, or leave input
blank to select all options shown (Enter 'c' to cancel): c
Please specify --domains, or --installer that will help in domain names autodiscovery, or --cert-name for an existing certificate name.
root@zinux /var/www/html[1086]$
certbot --apache --domains zintis.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Requesting a certificate for zintis.net
Performing the following challenges:
http-01 challenge for zintis.net
Waiting for verification...
Cleaning up challenges

We were unable to find a vhost with a ServerName or Address of zintis.net.
Which virtual host would you like to choose?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: wordpress-le-ssl.conf          | Multiple Names        | HTTPS | Enabled
2: wordpress.conf                 | Multiple Names        |       | Enabled
3: ssl.conf                       |                       | HTTPS | Enabled
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-3] then [enter] (press 'c' to cancel): c
No vhost exists with servername or alias of zintis.net. No vhost was selected. Please specify ServerName or ServerAlias in the Apache config.
No vhost selected

IMPORTANT NOTES:
 - Unable to install the certificate
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/zintis.net/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/zintis.net/privkey.pem
   Your certificate will expire on 2021-07-22. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again with the "certonly" option. To non-interactively
   renew *all* of your certificates, run "certbot renew"
root@zinux /var/www/html[1087]$

So, I then changed the apache httpd.conf file to specify my server correctly from www.zintis.net to just zintis.net. the restarted httpd, but still I got this:

root@zinux /etc/httpd/conf[1097]$
certbot --apache --domains zintis.net
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/zintis.net.conf)

What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Attempt to reinstall this existing certificate
2: Renew & replace the certificate (may be subject to CA rate limits)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Renewing an existing certificate for zintis.net

We were unable to find a vhost with a ServerName or Address of zintis.net.
Which virtual host would you like to choose?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: wordpress-le-ssl.conf          | Multiple Names        | HTTPS | Enabled
2: wordpress.conf                 | Multiple Names        |       | Enabled
3: ssl.conf                       |                       | HTTPS | Enabled
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-3] then [enter] (press 'c' to cancel): c
No vhost exists with servername or alias of zintis.net. No vhost was selected. Please specify ServerName or ServerAlias in the Apache config.
No vhost selected

IMPORTANT NOTES:
 - Unable to install the certificate
 - Congratulations! Your certificate and chain have been saved at:
   /etc/letsencrypt/live/zintis.net/fullchain.pem
   Your key file has been saved at:
   /etc/letsencrypt/live/zintis.net/privkey.pem
   Your certificate will expire on 2021-07-22. To obtain a new or
   tweaked version of this certificate in the future, simply run
   certbot again with the "certonly" option. To non-interactively
   renew *all* of your certificates, run "certbot renew"
root@zinux /etc/httpd/conf[1098]$

But???? I checked to browse to zintis.net and now got a valid secure certificate?????

Lets check ssllab.com…

I found this discussion on community.letsencrypt.org that points out the tricky nature of getting your certs straightened out.

Seems that the best solution is let them expire (after 90 days).

Another, slightly later discussion has some better info: here

The user got his error:

 usage:
certbot [SUBCOMMAND] [options] [-d DOMAIN] [-d DOMAIN] ...

 Certbot can obtain and install HTTPS/TLS/SSL certificates.  By default,
 it will attempt to use a webserver both for obtaining and installing the
 certificate.
 certbot: error: unrecognized arguments: