Changes

[[Category:OPS235]] {{Admon/note|Assignment Material May Appear on Tests and Exam|Doing your assignment is part of your ongoing learning process. As such you will be tested on this material in future tests and exams. If you have any questions or need help, please consult your instructor in a timely manner. The due date for this assignment will not be extended. As it must be marked in class.This assignment will be marked partially through demonstration and partially through the submission of files.}}{{Admon/tip|Want some tips?|See [[User:Chris Tyler/Chris Tyler's Guide to Surviving OPS235 Assignment 2 with SELinux Enabled|Chris Tyler's Guide to Surviving OPS235 Assignment 2 with SELinux Enabled]]}} = OPS235 Assignment #2 -- Winter 2012=

'''Weight: ''' 5% of the overall grade

'''Due Date: Week 13 - week of April 8 ('''Check with Week 13 <br />Refer to your Professor instructor for exact date''').submission instructions

In this assignment, you will demonstrate the skills you have learned to this point by configuring two services: a '''database server''' and a '''web server'''. You will install and use a database-backed web application, '''MediaWikiWordpress''', to show that these services have been installed properly. In this assignment, you will attempt to maintain a high level of security, by using '''iptables''' firewall to guard against unauthorized access. You will also configure the '''SELinux''' security system to further enhance the security of your computer system.

'''NOTE: This Do this assignment may be performed using any combination of your inside the centos3 virtual machines and/or host disk packmachine. '''

== Required Tasks (ASSIGNMENT TOTAL: 70 Marks) Installing Packages==

Install these packages using ''yum'':* '''httpd''' - this is the Apache web server software. It provides the '''httpd''' service, which runs on port 80.* '''php''' - this is the PHP server software. It provides the '''php''' capabilities , which allows Apache to the web server and wikirun more complex websites.* '''php-mysql-server''' - this is the MySQL database server. It provides the '''mysqld''' service, which runs on a Unix domain socket and TCP port 3306 by default.* '''mediawiki''' - this is the wiki software used by this wiki, Wikipedia, and many other sites. It is a series of PHP scripts which are run by Apache httpd as requests are received, and it connects extension that allows PHP to use a database such as MySQL locally or on other serversserver.

====Apache httpd <u>Install the '''mysql-server''' (Section Total: 10 MarksMySQL database server)====package</u>

:# Start the httpd service using the '''systemctlNOTE:''' (or '''service''') command.:# Confirm that you can connect to your web server using a web browser -- both from the machine on which the server is running as well as from another machine on This package may not be in the same networkmain repository. You should see There a test page.couple of options:# Configure this software to start when the system is booted using '''systemctl'''.:# Create a very simple HTML index page for your system, and place it at <code> /var/www/html/index.html </code>:# Confirm that you can view the index page. If not, adjust your iptables configuration as necessary, or check for errors in <code>/var/log/httpd</code>

==== MySQL :*'''Preferred method:''' Use an alternative package (Section Totalfor example: 6 Marks'''mariadb''' and '''mariadb-server'''):*Download a "zipped tar-ball" from a website (google-search)====, decompress, and compile

==== MediaWiki # Start the httpd service using '''systemctl'''.# Ensure that the httpd service starts automatically during boot.# Confirm that you can connect to your web server using a web browser -- both from centos3 (Section Total: 12 Marksyou can test using '''links''')====as well as from the host. You should see the Apache Test Page.# If you can't connect to it from outside the machine - perhaps your firewall is blocking access to the web server.

::# Start the MySQL service (mysqld or mariadb) using '''NOTE:systemctl''' When .# Ensure that the mysqld/mariadb service starts automatically during boot.# You may get messages after starting the MySQL service for the first time. Do not ignore these messages, it will tell you how to set a password and take other basic steps to secure the the MySQL server. Follow those instructions to set a password, recording the detail of what you do for later use.#* If you are donedo not see any messages, research how you can secure the MySQL installation and set the MySQL-root password.#* Read those messages carefully, you should are setting up a production MySQL server and there shouldn't be able any "test" databases or anonymous users or users without a password.# Set your MySQL root password to go your learn ID (without the @senecac.on.ca part).# This following part is challenging so take your time and read the instructions to <code>make sure you do it properly, we have to set up a dedicated user and database for wordpress:## Start by looking at http://'''hostname'''codex.wordpress.org/wiki</code> from any directly-connected machineInstalling_WordPress#Using_the_MySQL_Client where you will find instructions for the setup.## You will need to run those commands in a centos3 terminal.## Your adminusername is root## Your databasename is myblog## Your wordpressusername is your learn ID## The password should also be your learn ID## Your hostname is localhost

==== Serving Personal Web Pages (Section Total: 12 Marks)==Installing and Configuring Wordpress ==

:# Configure httpd to serve the <code>~/public_html</code> directories of your users. This will require changes to <code>/etc/httpd/conf/httpd.conf</code> as well as the SELinux configuration. See the man page for <code>httpd_selinux</code> and the Apache [http://httpd.apache.org/docs/2.2/ httpd documentation] for details.:# Prove that this works by creating a page in your <code>~/public_html</code> directory. The URL will be <code>http://''hostname''/~''your-user-id''/</code>:# Create a short web script which displays the available disk space on the computer. At its Wordpress (like most basic level, a web script applications) is not available in the same as a regular scriptFedora repositories, with this additional requirement::#* It it must output the line "Content-type: text/plain" or "Content-type: text/html" (depending on whether the script output is plain text or HTML), followed by a blank line.:# Name the script <code>~/public_html/diskfree.cgi</code> - The URL will be <code>http://''hostname''/~''your-user-id''/diskfree.cgi</code>:# Configure httpd to allow your script to be run from the web. This will require changes to <code>/etc/httpd/conf/httpd.conf</code> as well as the SELinux configuration (possibly including both booleans and SELinux context). As with step 1, see the man page for <code>httpd_selinux</code> downloaded and the Apache [http://httpd.apache.org/docs/2.2/ httpd documentation] for detailsinstalled manually.

{{Admon# Download the latest .tar.gz version from wodpress.org into your centos3 (use wget).# Extract it into '''/var/www/html'''# Now we need to allow Apache to modify the wordpress installation. To do this use chown -R to make the owner and group of every file and directory inside wordpress "apache".# Check your work so far by pointing your web browser to http://centos3/wordpress/tip|Hint|Look for where you will get an error starting with "There doesn't seem to be a wp-config.php file"add# Copy the wp-config-sample.php file to wp-config.php and edit the new file:#* Change the DB_NAME, DB_USER, DB_PASSWORD to the appropriate values.# Now go back to http://centos3/wordpress/ -handleryou should see a Wordpress Welcome/Setup page.#* Set the title to Your Name's Blog. For example for me it would be " line in Andrew Smith's Blog"#* Set the password to your learn ID.#* Set the email to your httpdSeneca email address.conf file#* Click "Install Wordpress", you should see a "Success!" message.}}

===C. Write-up (Section Total: 12 Marks)===

Create Write a high-quality write-up of this assignment blog post on your wiki. '''Describe in detail exactly what you did to set up each component'''. Include at least these pagesnew blog explaining:# A main page (page name Main Page), describing in general terms what you did and containing links to the other wiki pages* What is Apache, as well as a link to the page and the script in your <code>~/public_html</code> directory.# A page for your httpd configuration (page name httpd_conf). Along with a descriptionPHP, include the exact text of your httpd.conf file.# A page for your MySQL configuration (page name mysql_conf). Along with a description, include the details of the steps you performed to set up MySQL.# A page for your MediaWiki configuration (page name mediawiki_conf). Along with a description, include your MediaWiki configuration fileand Wordpress.# A page for your iptables configuration (page name iptables_conf). Show the exact iptables rules that are in effect. Demonstrate that the configuration is as tight as possible * What problems (for example, test access to other services, minor and include the results of those tests in the wiki pagemajor).# A page for the SELinux configuration (page name selinux_conf). Show you ran into during the SELinux booleans installation and the context of your script file. The easiest way to create new page is to create a link to it from an existing page (such as the main page), and then follow that linkhow you solved them.

'''Write well and be creativea second post on your blog explaining:'''* Make sure your spelling and grammar are correct (they count!)Are you ready for the exam or not.* Present List the pages attractively, and take advantage of graphics, colour, and fonts as appropriate -- for example, material you may want to highlight are strong on.* List the changes that material you made in the configuration files using '''bold''' print, use outline numbering, divide the pages into easy-to-navigate sections, or use colour to show the <span style="color:orange">commands you typed</span> and <span style="color:green">what the system displayed in response</span>are worried about.* Stick to the important information - avoid including excessive text which doesn't add List any questions or topics you would like me to the content that you are presenting (remember, your professor will be reading hundreds of wiki pages while marking!)address during exam review.

Resources on wiki markup:* [http://en''' Make your posts look professional.wikipediaThat means use good english, headings, bullet or numbered lists, etc.org/wiki/Help:Wiki_markup Wiki markup] - Wikipedia* [[Sandbox|Sandbox page on this wiki]] - examples

=== D'''Due date:''' Your name will be called in the lab on the due date for the assignment. If you are not there when your name is called - you will lose 20% of your mark. In that case you may show me your submission in the second lab that week instead. Assignments submitted after that will receive a grade of 0, but must still be completed satisfactorily in order to pass the course. Security with SELinux (10 Marks) ===

== About SELinux = Ready to show ===

SELinux stands for ''Security Enhanced Linux'' and is based on research performed at NSA and other locations. Where the normal Unix/Linux security systemOpen one or more terminals in c7host, based upon file permissionsSSH to centos3 from those terminals, is a ''discretionary access control'' system (DAC), SELinux is a ''mandatory access control'' system (MAC). This means that it attempts to enforce a consistent policy across and have the entire systemfollowing ready:* The correct RPMs are installed* Output of chkconfig --list mysqld* Output of chkconfig --list httpd* MySQL output of: show databases; use mysql; select User, on top Password from user; use myblog; show tables;* Output of the settings that any user has configuredls -la /var/www/html/wodpress/* Output of head -30 /var/www/html/wodpress/wp-config.php* Open a firefox with http://centos3/wordpress/

$ ls -lZ{| class="wikitable" border="1"! Task !! drwxr-xr-x. root root '''system_u:object_r:file_t:s0''' armMaximum mark !! Actual mark drwxr-xr|-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' arm2 drwxrwxr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' bin| Correct packages installed || 1 || drwxr-xr|-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Desktop drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Documents| Apache set up and running || 2 || drwxr-xr|-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Downloads -rw-------. chris chris '''unconfined_u:object_r:user_home_t:s0''' fedora0.ks| MySQL set up correctly || 3 || |-rw-------. chris chris '''unconfined_u:object_r:user_home_t:s0''' fedora1.ks -rw-------. chris chris '''unconfined_u:object_r:user_home_t:s0''' fedora2.ks -rw-------. chris chris '''unconfined_u:object_r:user_home_t:s0''' fedora3.ks -rw-rw-r--. chris chris '''unconfined_u:object_r:user_home_t:s0''' foo -rw-r--r--. chris chris '''unconfined_u:object_r:user_home_t:s0''' hosts drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Music drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Pictures drwxrwxr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' play drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Public drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Templates drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Videos -rw-r--r--. chris chris '''unconfined_u:object_r:user_home_t:s0''' x [chris@muskoka ~]$ ps -Z LABEL PID TTY TIME CMD '''unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023''' 2595 pts/| Wordpress extracted correctly || 1 00:00:00 bash|| '''unconfined_u:unconfined_r:unconfined_t:s0|-s0:c0.c1023''' 2612 pts/1 00:00:00 ps The SELinux policy controls the interactions between security contexts. For example, the policy may specify that the Apache httpd webserver cannot read files in <code>/etc</code>, so if an attacker finds a way to make httpd (or a script run by httpd) read a file in <code>/etc</code>, SELinux will recognize that this is not normal and will deny the access. Since this is done at the kernel level, httpd will get a "file not found" error, even though the file is present, and there is no way for httpd to work around that error. === SELinux Context Commands === There are two main commands used to | Wordpress set the SELinux security context of files:up correctly || 2 ||# chcon - sets the security context of a file to a particular value#* Example: setting the ''type'' of a file: <code>chcon |-t ''unconfined_t'' ''/tmp/foo''</code>#* Example: setting the user/role/type of a file: <code>chcon ''unconfined_u:object_r:user_home_t'' ''~/foo''</code># restorecon - resets the default security context of a file#* Example: reset the context of one file: <code>restorecon /etc/services</code>#* Example: recursively reset the contexts of all of the files | Wordpress showing in a directory: <code>restorecon -R ~</code> You can reset the default security context of the entire system at the next boot with this command:  touch /.autorelabel === SELinux Booleans === SELinux policy can be tuned (without writing an entirely new policy) through the use of ''booleans'' or option switches. Each boolean can have a value of on (Firefox || 1) or off (0).|||-The <code>getsebool</code> and <code>setsebool</code> commands can be used | Everything ready to view and set SELinux boolean values: {show || 2 ||class="mediawiki sortable" border="1" cellspacing="0"!Command!Description

|<code>getsebool -a</code>First blog post || 3 ||Displays all SELinux booleans

|<code>getsebool ''foo''</code>Second blog post || 3 ||Displays the SELinux boolean ''foo''

|<code>setsebool ''foo'Total' ''value''</code>|Sets the SELinux boolean ''foo'' to ''value'' (where ''value'' is 0 or "off", or 1 or "on")| 18 || Use the <code>-P</code> option to make the change permanent.

=== SELinux Graphical Tools === The ''system-config-selinux'' tool, which is on the menu as System>Adminstration>SELinux Management, provides a GUI for managing SELinux booleans and more. {{Admon/tip|Remember|Configure httpd and SELinux to allow your script to be run from the web. This will require changes to <code>/etc/httpd/conf/httpd.conf</code> as well as the SELinux configuration (possibly including both booleans and SELinux context).}} {{Admon/note|Takes Notes!|Take detailed notes of the steps you perform from this point onward -- you will need them for the wiki pages you will create later.}}  == Submitting Your Assignment == Your professor will require you to submit this assignment in at least one of two ways[[Category: # Demonstrate that the wiki is working.# Use wget to harvest the wiki pages:#* Make sure all of the <code><nowiki>http://</nowiki></code>-style links (for the wiki image, the link to diskfree.cfgi, and so forth) use the same hostname (don't use "localhost" for one and "f16host" for another, for example).#* Issue the command: <code>wget -prk http://''hostname''/wiki</code> -- where ''hostname'' matches the hostname used in the <code><nowiki>http://</nowiki></code> links in your wiki pages.#* Create a compressed tar file containing the results. (name the file ''learnid''-a2.tgz)#* Check the tar file to see that it contains everything necessary to view your site (in particular, check that all needed image files are included). Do not edit the files in the tar archive -- if changes are needed, modify your wiki, and then repeat the <code>wget</code> and <code>tar</code> steps above.#* Refer to your OPS235 instructor on the proceedure to submit the tar archive file. For '''Section A''' (Chris Tyler), the assignment is due on April 15 at 11:49 pm. Upload your archive file to https://scs.senecac.on.ca/~chris.tyler/ops235/]]