Mount ISO of RHEL 9.0 to your system and confirm with df -h command that it is mounted.
Copy all content of iso to a folder, here in below example it is mounted under /opt/rhel9 folder
After copy confirm that files are all listed as below.
[root@localhost ~]# ls -l /opt/rhel9/
total 48
dr-xr-xr-x. 4 herry herry 38 Apr 20 2022 AppStream
dr-xr-xr-x. 4 herry herry 38 Apr 20 2022 BaseOS
dr-xr-xr-x. 3 herry herry 18 Apr 19 2022 EFI
-r--r--r--. 1 herry herry 8154 Apr 20 2022 EULA
-r--r--r--. 1 herry herry 1455 Apr 20 2022 extra_files.json
-r--r--r--. 1 herry herry 18092 Apr 20 2022 GPL
dr-xr-xr-x. 3 herry herry 59 Apr 19 2022 images
dr-xr-xr-x. 2 herry herry 4096 Apr 19 2022 isolinux
-r--r--r--. 1 herry herry 103 Apr 20 2022 media.repo
-r--r--r--. 1 herry herry 1669 Apr 20 2022 RPM-GPG-KEY-redhat-beta
-r--r--r--. 1 herry herry 3682 Apr 20 2022 RPM-GPG-KEY-redhat-release
Create a repo file
[root@localhost ~]# cat /etc/yum.repos.d/local.repo
[AppStream]
name=this is my AppStream repo
baseurl=file:///opt/rhel9/AppStream
enabled=1
gpgcheck=0
[BaseOS]
name=this is my BaseOS repo
baseurl=file:///opt/rhel9/BaseOS
enabled=1
gpgcheck=0
IF repo is all set properly, you will be able to install httpd package, here it is already installed, for
you output will be different if installing for the first time
[root@localhost ~]# dnf install httpd
Updating Subscription Management repositories.
Unable to read consumer identity
This system is not registered with an entitlement server. You can use subscription-manager to
register.
Last metadata expiration check: 23:43:03 ago on Monday 30 September 2024 12:39:58 PM.
Package httpd-2.4.51-7.el9_0.x86_64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
Check status of httpd service, as it is not yet started.
[root@localhost ~]# systemctl status httpd
○ httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor p>
Active: inactive (dead)
Docs: man:httpd.service(8)
Start httpd service and make it persistent on upon reboot.
[root@localhost ~]# systemctl enable --now httpd
Created symlink /etc/systemd/system/multi-user.target.wants/httpd.service →
/usr/lib/systemd/system/httpd.service.
[root@localhost ~]# systemctl status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; enabled; vendor pr>
Active: active (running) since Tue 2024-10-01 12:27:52 IST; 8s ago
====OMIT====
Oct 01 12:27:52 localhost.localdomain systemd[1]: Starting The Apache HTTP Ser>
Oct 01 12:27:52 localhost.localdomain httpd[3193]: AH00558: httpd: Could not r>
[root@localhost ~]#
Now check and set hostname of your system
[root@localhost ~]# hostname
localhost.localdomain
[root@localhost ~]# hostnamectl hostname vm1.example.com
[root@localhost ~]# hostname
vm1.example.com
[root@localhost ~]# exit ; exit
Open Terminal Again and become root
Check Your IP address
[root@vm1 ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen
1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: ens160: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen
1000
link/ether 00:0c:29:55:fb:b4 brd ff:ff:ff:ff:ff:ff
altname enp3s0
inet 192.168.116.129/24 brd 192.168.116.255 scope global dynamic noprefixroute ens160
valid_lft 1014sec preferred_lft 1014sec
inet6 fe80::20c:29ff:fe55:fbb4/64 scope link noprefixroute
valid_lft forever preferred_lft forever
Make entry in /etc/hosts file to resolve local ip to name
[root@vm1 ~]# vim /etc/hosts
[root@vm1 ~]# cat /etc/hosts
127.0.0.1 localhost localhost.localdomain localhost4 localhost4.localdomain4
::1 localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.116.129 vm1.example.com vm1
[root@vm1 ~]# ls -l /var/www/html/
total 0
[root@vm1 ~]# echo this is web server >> /var/www/html/index.html
[root@vm1 ~]# ls -l /var/www/html/
total 4
-rw-r--r--. 1 root root 19 Oct 3 11:26 index.html
[root@vm1 ~]# hostname
vm1.example.com
[root@vm1 ~]# curl http://vm1.example.com
this is web server
[root@vm1 ~]# rm /var/www/html/index.html
rm: remove regular file '/var/www/html/index.html'? y
[root@vm1 ~]#
[root@vm1 ~]# echo this is file 1 > file1
[root@vm1 ~]# echo this is file 2 > file2
[root@vm1 ~]# ls
anaconda-ks.cfg file1 file2
[root@vm1 ~]# cp file1 /var/www/html/
[root@vm1 ~]# curl http://vm1.example.com/file1
this is file 1
[root@vm1 ~]# ls /var/www/html/
file1
[root@vm1 ~]# mv file2 /var/www/html/
[root@vm1 ~]# ls /var/www/html/
anaconda-ks.cfg file1
[root@vm1 ~]# curl http://vm1.example.com/file2
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>
[root@vm1 ~]#
[root@vm1 ~]# ls -l /var/www/html
total 12
-rw-r--r--. 1 root root 14 Sep 30 13:08 file1
-rw-r--r--. 1 root root 14 Sep 30 13:08 file2
[root@vm1 ~]# setenforce 0
[root@vm1 ~]# getenforce
Permissive
[root@vm1 ~]# curl http://vm1.example.com/file2
this is file 2
[root@vm1 ~]# setenforce 1
[root@vm1 ~]# getenforce
Enforcing
[root@vm1 ~]# curl http://vm1.example.com/file2
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>
[root@vm1 ~]#
[root@vm1 ~]# ls -lZ /var/www/html
total 12
-rw-r--r--. 1 root root unconfined_u:object_r:httpd_sys_content_t:s0 14 Sep 30 13:08 file1
-rw-r--r--. 1 root root unconfined_u:object_r:admin_home_t:s0 14 Sep 30 13:08 file2
[root@vm1 ~]#
AS Context Do not match SELinux will not allow access.
Apply Selinux Label default as it should be to any file under /var/www/html directory.
[root@vm1 ~]# restorecon -vvFR /var/www/html/
Relabeled /var/www/html/file1 from unconfined_u:object_r:httpd_sys_content_t:s0 to
system_u:object_r:httpd_sys_content_t:s0
Relabeled /var/www/html/file2 from unconfined_u:object_r:admin_home_t:s0 to
system_u:object_r:httpd_sys_content_t:s0
[root@vm1 ~]# ls -lZ /var/www/html/
total 8
-rw-r--r--. 1 root root system_u:object_r:httpd_sys_content_t:s0 15 Oct 3 11:29 file1
-rw-r--r--. 1 root root system_u:object_r:httpd_sys_content_t:s0 15 Oct 3 11:29 file2
Now we will be able to access file2 with selinux in Enforcing mode.
[root@vm1 ~]# curl http://vm1.example.com/file2
this is file 2
[root@vm1 ~]#
Let’s See how we can change context of any file or folder.
[root@vm1 ~]# mkdir /custom
[root@vm1 ~]# ls -ld /custom
drwxr-xr-x. 2 root root 6 Oct 4 12:36 /custom
[root@vm1 ~]# ls -ldZ /custom
drwxr-xr-x. 2 root root unconfined_u:object_r:default_t:s0 6 Oct 4 12:36 /custom
[root@vm1 ~]# ls -ldZ /var/www/html/
drwxr-xr-x. 2 root root system_u:object_r:httpd_sys_content_t:s0 32 Oct 3 11:30 /var/www/html/
Chcon command can be used to change context of file/folder.
[root@vm1 ~]# chcon -t httpd_sys_content_t /custom
[root@vm1 ~]# ls -ldZ /custom
drwxr-xr-x. 2 root root unconfined_u:object_r:httpd_sys_content_t:s0 6 Oct 4 12:36 /custom
IF some one does a relabel to system, with restorecon command context applied with chcon will
be remove, changed to original what is in policy.
[root@vm1 ~]# restorecon -vvFR /custom
Relabeled /custom from unconfined_u:object_r:httpd_sys_content_t:s0 to
system_u:object_r:default_t:s0
[root@vm1 ~]# ls -ldZ /custom
drwxr-xr-x. 2 root root system_u:object_r:default_t:s0 6 Oct 4 12:36 /custom
[root@vm1 ~]#
Let’s Try to change Default Document Root of httpd from /var/www/html to /custom folder.
root@vm1 ~]# echo this is web server >> /custom/page1
[root@vm1 ~]# cat /custom/page1
this is web server
[root@vm1 ~]# curl http://vm1.example.com/page1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>404 Not Found</title>
</head><body>
<h1>Not Found</h1>
<p>The requested URL was not found on this server.</p>
</body></html>
Edit the Apache /etc/httpd/conf/httpd.conf configuration file, and replace the two occurrences of
the /var/www/html directory with the /custom directory. You can use the vim
/etc/httpd/conf/httpd.conf command to do so. (Edit file Carefully)
[root@vm1 ~]# vim /etc/httpd/conf/httpd.conf
1.
DocumentRoot /var/www/html
change it to
DocumentRoot /custom
2.
<Directory “/var/www/html”>
change it to
<Directory “/custom”>
[root@vm1 ~]#
As We modified httpd server configuration file we need to restart httpd service to take new changes
into effect.
[root@vm1 ~]# systemctl restart httpd
Do check with curl command, as we have selinux in enforcing mode it will not allow to open the page
but error is change to Forbidden from Page Not Found.
[root@vm1 ~]# curl http://vm1.example.com/page1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>
[root@vm1 ~]# getenforce
Enforcing
[root@vm1 ~]# setenforce 0
[root@vm1 ~]# getenforce
Permissive
If we put selinux in permissive mode we are able to access page
[root@vm1 ~]# curl http://vm1.example.com/page1
this is web server
[root@vm1 ~]#
[root@vm1 ~]# getenforce
Permissive
[root@vm1 ~]# setenforce 1
[root@vm1 ~]# curl http://vm1.example.com/page1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access this resource.</p>
</body></html>
[root@vm1 ~]# ls -ldZ /custom/
drwxr-xr-x. 2 root root system_u:object_r:default_t:s0 19 Oct 4 12:42 /custom/
Apply context as required by httpd service with chcon command to directory and file.
[root@vm1 ~]# chcon -t httpd_sys_content_t /custom
[root@vm1 ~]# chcon -t httpd_sys_content_t /custom/page1
[root@vm1 ~]# ls -ldZ /custom/
drwxr-xr-x. 2 root root system_u:object_r:httpd_sys_content_t:s0 19 Oct 4 12:42 /custom/
[root@vm1 ~]# ls -ldZ /custom/page1
-rw-r--r--. 1 root root unconfined_u:object_r:httpd_sys_content_t:s0 19 Oct 4 12:42 /custom/page1
[root@vm1 ~]# getenforce
Enforcing
[root@vm1 ~]# curl http://vm1.example.com/page1
this is web server
[root@vm1 ~]#
Thank you.
