Installing secure phpMyAdmin on CentOS 6.2

Following on from Sunday's post on how to set up phpMyAdmin on CentOS 6.2, I thought it would be a good idea to set up phpMyAdmin as a secure website (HTTPS), rather than in clear-text (HTTP). This will ensure that all traffic between the web browser and phpMyAdmin is encrypted.

In a previous post I set up a Certification Authority so I will be using this CA to generate the necessary certificates, but don't worry if you don't have one, you can use makecert or OpenSSL to generate a self signed certificate.

All that is needed is a server and CA certificate, if you've followed my previous post on phpMyAdmin, you can go directly to step 7. Thus armed with a pkcs#12 server certificate (phpMyAdmin.pfx) and a CA certificate (win2kca.cer) we can start:

1. Set SELinux to allow Apache to bind to a non-default port:

   setsebool -P allow_ypbind 1

2. Download EPEL Release to enable usage of EPEL Repository: 

   wget http://download.fedora.redhat.com/pub/epel/6/i386/epel-release-6-5.noarch.rpm

3. Install EPEL Release package:

   yum install epel-release-6-5.noarch.rpm -y

4. Install phpMyAdmin:

   yum install phpmyadmin -y

5. Create new directory to host the phpMyAdmin website: 

   mkdir /var/www/phpMyAdmin

6. Copy phpMyAdmin installation to the directory created in the previous step: 

   cp -r /usr/share/phpMyAdmin/. /var/www/phpMyAdmin

7. Extract public and private key from server certificate:

   openssl pkcs12 -in phpMyAdmin.pfx -out phpMyAdmin.key -nodes -nocerts
   openssl pkcs12 -in phpMyAdmin.pfx -out phpMyAdmin.crt -nodes -nokeys

8. Restrict permissions on key file:

   chmod 400 phpMyAdmin.key

9. Create certificate and key directories and move certificates and keys to them:

   mkdir /etc/httpd/conf.d/certs
   mkdir /etc/httpd/conf.d/keys
   mv phpMyAdmin.crt /etc/httpd/conf.d/certs
   mv phpMyAdmin.key /etc/httpd/conf.d/keys
   cp win2k8ca.cer /etc/httpd/conf.d/certs

10. Set SELinux to permissive, this is to prevent issues with SELinux preventing Apache from working properly:

    setenforce 0

11. Edit Apache's SSL configuration file (/etc/httpd/conf.d/ssl.conf). I have changed the port to 7777 and prevented LOW ciphers from being accepted. The rest is simply providing the location of the certificates. Only listing relevant parts of ssl.conf:
    

    Listen 7777
    
    <VirtualHost _default_:7777>
    
    #   SSL Cipher Suite:
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM
    
    #   Server Certificate:
    
    SSLCertificateFile /etc/httpd/conf.d/certs/phpMyAdmin.crt
    
    #   Server Private Key:
    
    SSLCertificateKeyFile /etc/httpd/conf.d/certs/phpMyAdmin.key
    
    #   Server Certificate Chain:
    SSLCertificateChainFile /etc/httpd/conf.d/certs/win2k8ca.cer
    
    #   Certificate Authority (CA):
    SSLCACertificateFile /etc/httpd/conf.d/certs/win2k8ca.cer
    
    </VirtualHost>

    1. You can check that the apache configuration file is correct by using:
       

       apachectl -t 

12. Restart Apache:
    

    apachectl -k restart or service httpd restart

13. Open firewall for port 7777 and save IPTables configuration:

    iptables -I INPUT -p tcp --dport 7777 -j ACCEPT; service iptables save

14. You can now navigate to https://phpmyadmin.dev.com:7777/setup (If you are using Chrome, you will see this screen first. Other browsers will show similar screens). Note that you'll need a entry on your hosts file that points phpmyadmin.dev.com to the IP address of the Server: 

Click Procceed anyway. You are seeing this because your CA is not trusted by Chrome.

Although it would seem that the connection is not encrypted, the icon is misleading, it just means that it is not trusted. See below for confirmation:

15. Because I'm lazy, I'm going to reuse the screenshots and text from my previous phpMyAdmin post, so .. Click New Server. I only changed the name and compression, accepted defaults for everything else:
    
    
16. Go To Authentication Tab. See this link for an overview of the authentication types:
    
    
17. Click Save, which will bring you to the screen below:
    
    
18. Download the configuration file (config.inc.php) and copy it to /var/www/phpMyAdmin.
    
19. You can now start using phpMyAdmin on https://phpmyadmin.dev.com:7777:
    
    
    
    
20. All that remains is to renable SELinux and deal with the policy violations:
    

    cat /var/log/audit/audit.log | grep denied > ssl
    audit2allow -M apachessl -i ssl
    semodule -i apachessl.pp
    setenforce 1

Note that steps 2 & 3 simply add repository for the EPEL repository to your yum repository collection and install the repository key.

In theory, the setup script should be able to generate the configuration file for you, but I've not been able to get it to work. Instructions can be found here if you are interested. 

I haven't thoroughly tested this setup so it is possible, as always, that there could be SELinux issues. All I can suggest is that, if you have some inexplicable issue, have a look at the SELinux log (/var/log/audit/audit.log).

HTTP/HTTPS -- Configure group-managed content

I must confess that I'm not sure what this objective refers to. I initially thought this referred to group authentication, however when I tried to find other what other people were saying I came up empty. This blog does not cover it, neither does this one. It does not seem to be covered by this book. I was about to give up, when I found this blog, where the objective is simply to set up a directory that is configured for collaborative editing.
Note that there is an error, step four should use chown rather than chgrp.

HTTP/HTTPS -- Deploy a basic CGI application

This is actually a surprisingly easy objective to achieve. Create a script in the /var/www/cgi-bin directory, like this and call it uptime.cgi:

#!/bin/bash
echo "Content-type: text/html"
echo ""
echo "Uptime is:  $(uptime)"

If you move/copy the script from a different directory or you use a different directory, the SELinux context is likely to be wrong and will need to be changed, so bear that in mind.

Make the script executable:

chmod +x uptime.cgi

You can now test your new cgi script with:

elinks 127.0.0.1/cgi-bin/uptime.cgi

You might want to add the following directives to a different directory to enable script execution and allow other script extensions.

Directory Options +ExecCGI 
AddHandler cgi-script pl cgi

Note that the . before the file extension is not needed and that the extensions are case insensitive.

HTTP/HTTPS -- Configure private directories

I'm not 100% sure whether this objective refers to making the home directory of system users available via Apache or simply to configuring a private area, whose access is controlled via user name. I will cover the former in this post and refer you to this post for the latter.

Again we'll be editing the httpd config file (etc/httpd/conf/httpd.conf). Make sure that you have the following directives set:

UserDir public_html
 #  UserDir disabled

And then simply uncomment the example provided, which will give you read access to the user files:

<Directory /home/*/public_html>
    AllowOverride FileInfo AuthConfig Limit
    Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
    <Limit GET POST OPTIONS>
        Order allow,deny
        Allow from all
    </Limit>
    <LimitExcept GET POST OPTIONS>
        Order deny,allow
        Deny from all
    </LimitExcept>
</Directory>

You'll now need to create a public_html directory for all users and make sure that permissions and SELinux are configured correctly. This is for a user called myuser.

mkdir /home/myuser/public_html;chmod 701 /home/myuser; chmod 705 /home/myuser/public_html

Now create a test page and give it the right permissions:

echo 'A Simple User Page' >> public_html/index.html; chmod 604 public_html/index.html

Finally, set the SELinux settings to enable home directories:

setsebool -P httpd_enable_homedirs 1

and change the user contexts to the Apache user context (you can get this command from the manual page for httpd_selinux):

 chcon -R -t httpd_sys_content_t /home/myuser/public_html

Restart Apache and you should be able to visit myuser's fancy page:

elinks 127.0.0.1/~myuser

You can create by public_html directory and even a simple page for all new users by modifying the skeleton directory, like so:

mkdir /etc/skel/public_html
echo 'A Simple User Page' >> public_html/index.html;
chmod -R 705 /etc/skel/public_html/

This only helps for new users, but for existing users the process could be scripted like this:

#!/bin/bash 

if [ -n "$1" ]
then
  user=$1
else
   echo "Usage prepare username"
exit
fi

##Set appropriate permissions for home directory
chmod 701 /home/$user

##Create public_html
mkdir /home/$user/public_html

##Create Index.html file
echo "A Simple User Page for $user" >> /home/$user/public_html/index.html;

##Change permissions and ownership
chown -R $user:$user /home/$user/public_html
chmod -R 705 /home/$user/public_html/

##Change SELinux context
chcon -R -t httpd_sys_content_t /home/$user/public_html

This script can be improved by looping through the accounts and checking that public_html does not exist, but it does the work.

HTTP/HTTPS -- Configure a virtual host

If you are coming from a Windows background virtual hosts are the equivalent of hosting several websites using host headers.
In my case I have created a couple of CNAME aliases on my DNS server for 10.168.20.225, so that rhel6virtual.dev.com and rhel6morevirtual.dev.com both point to 10.168.20.225, the ip address of the Apache server. You can replicate this by modifying your /etc/hosts file if you don't want to be using a DNS server. Note that this needs to be added to the client too.

I can now edit the Apache config file (/etc/httpd/conf/httpd.conf) like this:

NameVirtualHost *:80

<VirtualHost *:80>
    ServerAdmin webmaster@dummy-host.example.com
    DocumentRoot /var/www/rhel6virtual/
    ServerName rhel6virtual.dev.com
    ErrorLog logs/rhel6virtual
    CustomLog logs/rhel6virtual common
</VirtualHost>
<VirtualHost *:80>
    ServerAdmin webmaster@dummy-host.example.com
    DocumentRoot /var/www/rhel6morevirtual
    ServerName rhel6morevirtual.dev.com
    ErrorLog logs/rhel6mv
    CustomLog logs/rhel6mv common
</VirtualHost>

I now create the DocumentRoot directories:

mkdir /var/www/rhel6virtual; mkdir /var/www/rhel6morevirtual

and add a file to each directory to allow easy testing:

  echo "More Virtual" > /var/www/rhel6morevirtual/index.html; 

  echo "Virtual" > /var/www/rhel6virtual/index.html

You can now restart Apache:

httpd -k restart

So now if you visit http://rhel6virtual.dev.com/index.html you'll see a web page that simply says Virtual and if you visit http://rhel6morevirtual.dev.com/index.html you'll see a web page that simply says More Virtual.

Installing Apache has already been covered here. You can check the rather long list of SELinux settings with:

getsebool -a | grep httpd

For an explanation of what each settings does, check this manual page out:

man httpd_selinux

In order to prevent access to the websites you can use iptables (don't forget to save the configuration), e.g.

 iptables -I INPUT -p tcp --dport 80 -s 10.168.20.0/24 -j DROP

or you can edit the configuration file for Apache, add the following to the second virtual host from above:

 <Directory "/var/www/rhel6morevirtual/">
         Options            Indexes FollowSymLinks
         AllowOverride      None
         Order              deny,allow
         Allow              from 10.168.20.203
         Deny from all
    </Directory>

Only 10.168.20.203 can see rhel6morevirtual now.

In order to prohibit users from accessing the web server, you first need to allow users to use it, so add a user and password with the following command (The -c creates the file, so it's only needed the first time):

 htpasswd -cm /etc/httpd/conf/apachepass myuser

Now, edit the Apache config file and inside the directory directive for "/var/www/rhel6morevirtual/" add:

AuthType Basic
AuthName "Restricted Files"
AuthUserFile /etc/httpd/conf/apachepass
Require user myuser

Restart Apache and now the only user that can see rhel6morevirtual will be myuser.

Note that an alternative to this method is to use the .htaccess file. In this method  we create an .htaccess file on the target directory /home/myuser/public_html/ in my case.

Edit the .htaccess file and enter the following :

AuthType Basic
AuthName "Restricted to myuser"
AuthUserFile /home/myuser/public_html/.htauthusers
Require valid-user

You now need to run:

htpasswd -c .htauthusers myuser

If you try to visit the page, you'll be prompted for a username and password. The beauty of this method is that it allows users without root access to restrict access to "their" web site.

Configure a system to run a default configuration HTTP server

In its simplest interpretation, the one I'm sticking to by the way, this is a fairly simple objective.
The first step is to install Apache

yum install httpd

 Now, you can switch it on with

service httpd start

Since you presumably want the web server to be running automatically at boot, you need to do the following:

chkconfig httpd on

That's it, you now have a apache running and configured to start at boot.  You just need to allow traffic to it, so open the firewall for port 80 and save it:

iptables -I INPUT -p tcp --dport http -j ACCEPT; iptables-save > /etc/sysconfig/iptables

You can check this by using a browser to navigate to localhost, e.g.

elinks 127.0.0.1

You can now add an index.html page, no need to worry about html, just do

echo "hello" > /var/www/html/index.html

if we try elinks again:

elinks 127.0.0.1

Obviously this is just the beginning and you can have a look at the configuration file for Apache, /etc/httpd/conf/httpd.conf, which is very well commented or you could have a look at the manual.