顯示具有 selinux 標籤的文章。 顯示所有文章
顯示具有 selinux 標籤的文章。 顯示所有文章

2015年9月25日 星期五

CentOS 7 + Apache 2.4 + WebDav (Not so secure)

1. Create webdav directory 

mkdir /var/www/webdav
chown apache:apache /var/www/webdav

2.  Add a virtual host to apache server


vim /etc/httpd/conf/httpd.conf

NameVirtualHost *:8080

        ServerAdmin webmaster@localhost

        DocumentRoot /var/www/webdav/
       
                Options Indexes MultiViews
                AllowOverride None
                Order allow,deny
                allow from all
       


        DavLockDB "/tmp/DavLock"
        Alias /webdav /var/www/webdav/

       
                DAV On
                AuthType Basic
                AuthName "webdav"
                AuthUserFile /var/www/webdav/passwd.dav
                Require valid-user
                RewriteEngine off
       



3. Create webdav user

htpasswd -c /var/www/webdav/passwd.dav test

Use"-c" at first time to create the passwd file
To add other users, don't use "-c" option


4. SELINUX , set the webdav folder writable by apache httpd

grep denied /var/log/audit/audit.log | grep webdav

type=AVC msg=audit(1443167688.330:3067): avc:  denied  { write } for  pid=10689 comm="httpd" name="webdav" dev="dm-0" ino=770665 scontext=system_u:system_r:httpd_t:s0 tcontext=unconfined_u:object_r:httpd_sys_content_t:s0 tclass=dir

grep "Permission denied" /var/log/httpd/error_log

[Fri Sep 25 15:54:48.332239 2015] [dav:error] [pid 10689] (13)Permission denied: [client 192.168.1.195:45679] Could not open file for writing  [500, #0]

chcon -R -t httpd_sys_content_rw_t /var/www/webdav/

5. Test webdav


yum install cadaver
cadaver http://192.168.1.195:8080/webdav/
Authentication required for webdav on server `192.168.1.195':
Username: test
Password:
dav:/webdav/> exit



2014年10月17日 星期五

CentOS SELinux http bind port (http listen port other than (80, 81, 443, 488, 8008, 8009, 8443, 9000)

https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Confined_Services/chap-Managing_Confined_Services-The_Apache_HTTP_Server.html



1. List current allowed port

semanage port -l | grep -w http_port_t

http_port_t                    tcp      80, 81, 443, 488, 8008, 8009, 8443, 9000


2. Add another port

semanage port -a -t http_port_t -p tcp 12345


2013年9月11日 星期三

CentOS 6.4 chroot sftp with SELinux


1.

addgroup sftpusers
useradd -g sftpusers -d /incoming -s /sbin/nologin  guestuser
passwd guestuser

guestuser:x:500:500::/incoming:/sbin/nologin
 如果是已有帳號
# usermod -g sftpusers -d /incoming -s /sbin/nologin john
2.
vim /etc/ssh/sshd_config

#Subsystem       sftp    /usr/libexec/openssh/sftp-server
Subsystem       sftp    internal-sftp 

Match Group sftpusers
        ChrootDirectory /home/sftpusers/%u
        ForceCommand internal-sftp
        X11Forwarding no
        AllowTcpForwarding no
3.
mkdir /home/sftpusers
mkdir /home/sftpusers/guestuser
mkdir /home/sftpusers/guestuser/incoming
chown guestuser:sftpusers /home/sftpusers/guestusers/incoming

ls -ld /home
drwxr-xr-x. 7 root root 4096 Sep 11 12:42 /home

ls -ld /home/sftpusers
drwxr-xr-x. 3 root root 4096 Sep 11 12:39 /home/sftpusers/

ls -ld /home/sftpusers/guestuser
drwxr-xr-x. 3 root root 4096 Sep 11 12:33 /home/sftpusers/guestuser/

ls -ld /home/sftpusers/guestuser/incoming
drwxr-xr-x. 3 guestuser sftpusers 4096 Sep 11 13:41 /home/sftpusers/guestuser/incoming/




4.
setsebool -P ssh_chroot_rw_homedirs on
restorecon -R /home/sftpusers
restorecon -R /home/sftpusers/guestuser

5.
sftp guestuser@localhost
sftp> pwd
Remote working directory: /incoming
sftp> cd /
sftp> pwd
Remote working directory: /
sftp> cd /etc
Couldn't canonicalise: No such file or directory


ref:

http://www.thegeekstuff.com/2012/03/chroot-sftp-setup/
http://cassjohnston.wordpress.com/2012/08/16/selinux-and-chrooted-sftp/

2013年6月2日 星期日

Install Drupal in CentOS 6.4 with Apache/MySQL/SELinux




1. 要讓httpd 可以存取遠端資料庫(remote database)

     要打開SELinux httpd_can_network_connect
    
   setsebool -P httpd_can_network_connect 1

2.  如果 Enable Clean URL fail


    先確認 RewriteEngine 是否能正常運作
    VirtualHost + RewriteEngine
    A: httpd.conf 要打開  Options  FollowSymLinks


3. httpd.conf 相關與其他安全設定

打開 .htaccess override 讓 apache 去讀drupal的 .htaccess

        AllowOverride All

上面註解了以後,autopath 模組應該就不用另外設定rewrite rule 在httpd.conf裡面了


修改Drupal的.htaccess


        Order deny,allow
        Deny from all
        Allow from 127.0.0.1

讓相關檔案只能從local存取

另外依照 https://drupal.org/node/244924 調整目錄權限
[root@localhost]cd /path_to_drupal_installation
[root@localhost]chown -R webadmin:www-data .
[root@localhost]find . -type d -exec chmod u=rwx,g=rx,o= '{}' \;
[root@localhost]find . -type f -exec chmod u=rw,g=r,o= '{}' \;

[root@localhost]cd /path_to_drupal_installation/sites
[root@localhost]find . -type d -name files -exec chmod ug=rwx,o= '{}' \;
[root@localhost]for d in ./*/files
do
   find $d -type d -exec chmod ug=rwx,o= '{}' \;
   find $d -type f -exec chmod ug=rw,o= '{}' \;
done 



Summarizing the permissions

  • drupal_admin: the user on the server that administrates Drupal, not necessarily is the root.
  • site_admin: the owner of the hosted site (a customer)

Ownership

Core modules/themes files and directories: drupal_admin:www-data
Hosted sites modules/themes/files files and directories: site_admin:www-data

Permissions

Core modules/themes directories: rwxr-x---
Core modules/themes files: rw-r-----
Hosted sites modules/themes directories: rwxr-x---
Hosted sites modules/themes files: rw-r-----
Hosted sites "files" directory: rwxrwx---
Hosted sites files under "files" directories: rw-rw----
Hosted sites subdirectories under "files" directories: rwxrwx---



參考
http://www.madirish.net/242

 

4. Update Manger with SSH


Just ran into same issue on my CentOS 6 box...
Here's the info...
# su -
# php -m | grep ssh2
# rpm -qa | grep libssh2

If one or both queries are empty, then proceed with following...
# yum install libssh2 libssh2-devel
# pecl install ssh2
   *** Note you'll probably get a PECL error, if so then fix with...
   # pecl install "channel://pecl.php.net/ssh2-0.12"

如果pecl 安裝 ssh2 時出現
 ex :
              sh: phpize: command not found




解法 :   yum install php-devel

如果pecl 安裝 ssh2 時出現
ex:
       configure: error: no acceptable C compiler found in $PATH

解法: yum install gcc

Then enable the extension...
# echo "extension=ssh2.so" > /etc/php.d/ssh2.ini

Finally restart Apache
# /etc/init.d/httpd restart

最後要注意上傳目錄
sites/all/modules/views
sites/all/modules/themes
的寫入權限

必須SSH user 有write
(建議新增一個webadministrator 之類的user)






drush dl views ctools panels advanced_help pathauto token wysiwyg entity ds nivo_slider nivo_formatter media admin_menu omega_tools

drush dl delta context jquery_update libraries link drupalforfirebug devel imce

drush dl css_injector workbench


drush install youtube views_slideshow varnish quicktabs fb_social


Relate Modules:

https://drupal.org/project/views
(http://ftp.drupal.org/files/projects/views-7.x-3.7.tar.gz)

https://drupal.org/project/ctools
 (http://ftp.drupal.org/files/projects/ctools-7.x-1.3.tar.gz)
 
https://drupal.org/project/panels
(http://ftp.drupal.org/files/projects/panels-7.x-3.3.tar.gz)

https://drupal.org/project/advanced_help
(http://ftp.drupal.org/files/projects/advanced_help-7.x-1.0.tar.gz)

http://ftp.drupal.org/files/projects/pathauto-7.x-1.2.tar.gz


http://ftp.drupal.org/files/projects/token-7.x-1.5.tar.gz

https://drupal.org/project/wysiwyg
()
裝普通版(先不要裝dev版)
  • http://download.moxiecode.com/tinymce/tinymce_3.5.8.zip
  • http://download.cksource.com/CKEditor/CKEditor/CKEditor%203.6.4/ckeditor_3.6.4.tar.gz

http://ftp.drupal.org/files/projects/entity-7.x-1.1.tar.gz

http://ftp.drupal.org/files/projects/ds-7.x-2.3.tar.gz

https://drupal.org/project/admin_menu
()

Omega:
https://drupal.org/node/1298616

https://drupal.org/project/omega
(http://ftp.drupal.org/files/projects/omega-7.x-3.1.tar.gz)


omegatool
http://ftp.drupal.org/files/projects/omega_tools-7.x-3.0-rc4.tar.gz
delta
http://ftp.drupal.org/files/projects/delta-7.x-3.0-beta11.tar.gz
context
http://ftp.drupal.org/files/projects/context-7.x-3.0-beta6.tar.gz






nivo_slider:
https://drupal.org/project/nivo_slider
https://drupal.org/project/Jquery_update
https://drupal.org/project/libraries
http://ftp.drupal.org/files/projects/nivo_formatter-7.x-1.x-dev.tar.gz
http://dev7studios.com/wp-content/uploads/downloads/2013/01/nivo-slider3.2.zip


views slideshow
https://drupal.org/project/views_slideshow
(http://ftp.drupal.org/files/projects/views_slideshow-7.x-3.0.tar.gz)
https://drupal.org/project/libraries
(http://ftp.drupal.org/files/projects/libraries-7.x-2.1.tar.gz)
https://github.com/malsup/cycle/downloads
(
  1. Locate/download the jQuery cycle plugin from the internet, download jquery.cycle.all.latest.min.js and rename it to jquery.cycle.all.min.js
)
https://drupal.org/project/link
(http://ftp.drupal.org/files/projects/link-7.x-1.1.tar.gz)


responsive :
https://drupal.org/project/views_responsive_grid
https://drupal.org/project/cs_adaptive_image



2013年6月1日 星期六

CentOS 6.4 找可能被SELinux 阻擋的權限

yum install setroubleshoot-server (如果有需要)


假設是要找 postfix的問題

grep postfix audit.log | audit2allow -m mymodule (可以看一下module內容)

產生module併install
grep postfix audit.log | audit2allow -M mymodule
semodule -i mymodule.pp