Increase web application stack security (LAMP virtualization, step 4/6)

Configuring the Apache web server to work with HTML + PHP5 files of a network file system (NFS)

In the fourth lesson of a series of articles on setting up a stack of web applications, we will talk about the Apache server.

The Apache web server is responsible for providing access to dynamic content over the HTTP or HTTPS protocol. In this example, we will install and use Apache2 + php5 web-server, as well as install DocumentRoot on vm 05: / exports / html , having mounted it in / var / www / html . To do this, we will enter the following commands on our virtual server vm02 with the IP address 192.168.1.11 .

Configure NFS Client

Using the yum-manager, install the NFS client packages:

# yum groupinstall "Network file system client"

Or a little easier:

 # yum install nfs-utils nfs4-acl-tools

Enable the NFSv4 client services:

 # chkconfig rpcbind on # chkconfig rpcidmapd on # chkconfig nfslock on

/etc/idmapd.conf nfs client configuration

Edit nfs client configuration file

 # vi /etc/idmapd.conf

Make sure that the parameters are set to match the domain name of the NFS server:

 Domain = cyberciti.biz [Mapping] Nobody-User = nobody Nobody-Group = nobody

Save and close the file. Run all NFS client services:

 # /sbin/service rpcbind start # /sbin/service rpcidmapd start # /sbin/service nfslock start

Mounting file system

Enter the following command

 # showmout -e vm05

Or:

 # showmout -e 192.168.1.14

Example command output:

 Export list for v.txvip1: /exports/html     192.168.1.10,192.168.1.11 /exports/static   192.168.1.10,192.168.1.11

Mount the / exports / html file system in / var / www / html by entering the following command:

 # /bin/mount -t nfs4 -orsize=32768,wsize=32768,intr,hard,proto=tcp,sync vm05:/exports/html /var/www/html/

Or:

 # /bin/mount -t nfs4 -orsize=32768,wsize=32768,intr,hard,proto=tcp,sync 192.168.1.14:/exports/html /var/www/html/

Mounting a file system via / etc / fstab

Edit / etc / fstab:

 # vi /etc/fstab

Add the following line:

 vm05:/exports/html /var/www/html nfs4 orsize=32768,wsize=32768,intr,hard,proto=tcp,sync

Save and close the file. Make sure the netfs service is enabled:

 # chkconfig netfs on

Make sure the apache user sees our files.

 # su - apache $ ls /var/www/html/ $ exit #

Please note that the root user or any other user does not see / var / www / html due to our security policy. Only apache-user must access DocumentRoot. These are our default settings.

Install Apache Software

Install the Apache2 packages via the yum manager:

 # yum install httpd

Installing php5 and required modules

Enter the following commands to install php5, modules that provide access to mysql, modules for working with graphic files and all the other modules required by the operation of your application:

 # yum install -y php-pear php-common php-bcmath php-mbstring php-cli php-pdo php-php-gettext php-mcrypt php-gd php-xml php-pecl-apc php php-mysql php-xmlrpc

Installing memcached support for php5

In order to access the memcached server installed on vm03, you need to install a php cache server:

 # yum install -y php-pecl-memcache

Apache setup

Edit the Apache server configuration file / etc / httpd / conf / httpd .conf :

 # vi /etc/httpd/conf/httpd.conf

Add or edit the following settings (DocumentRoot should point to an nfs partition mounted in / var / www / html ):

 #  -     Listen 192.168.1.11:80 #        ServerTokens Prod ServerSignature Off #  DocumentRoot DocumentRoot "/var/www/html" <Directory "/var/www/html">   Indexes Includes FollowSymLinks SymLinksifOwnerMatch ExecCGI MultiViews   Options Indexes FollowSymLinks   AllowOverride All   Order allow,deny   Allow from all </Directory>

Save and close the file.

PHP5 configuration

PHP is a widely used server-side scripting language (" Moscow, the capital of our motherland" ) .
Edit the / etc / httpd / conf .d / php .conf file with the following command:

 # cat /etc/httpd/conf.d/php.conf

Approximate command output:

 # PHP is an HTML-embedded scripting language which attempts to make it # easy for developers to write dynamically generated webpages.<br /> <IfModule prefork.c>  LoadModule php5_module modules/libphp5.so </IfModule> <IfModule worker.c>  LoadModule php5_module modules/libphp5-zts.so </IfModule> #  PHP-     .php AddHandler php5-script .php AddType text/html .php # Add index.php to the list of files that will be served as directory # indexes. DirectoryIndex index.php # Uncomment the following line to allow PHP to pretty-print .phps # files as PHP source code: # #AddType application/x-httpd-php-source .phps

See and read about how to protect and optimize PHP5 in an additional article on the topic ( or ask for a translation - comment. Per. )

Extract real IP for redirected HTTP requests

Install the mod_extract_forwarded package to get the real IP source of the sent HTTP request (we connect the EPEL repository):

 # yum -y install mod_extract_forwarded package

Edit /etc/httpd/conf.d/mod_extract_forwarded.conf :

 # vi /etc/httpd/conf.d/mod_extract_forwarded.conf

Add or change the setting as follows:

 ## Accept real ip from our nginx reverse proxy  at 192.168.1.1 ## MEFaccept 192.168.1.1

Save / close the file and restart the web server:

 # service httpd reload

Configuring iptables to access the web-server

Edit the / etc / sysconfig / Iptables file by adding the following parameters (make sure that they are written before the final LOG and DROP settings of the INPUT chain):

 ##       ## -A INPUT -m state --state NEW -p tcp -s 192.168.1.0/24 --dport 80 -j ACCEPT

Save, close. Restart iptables :

 # /sbin/service iptables restart # /sbin/iptables -L -v -n

Enable Apache

Start the Apache2 web server with the following command:

 # chkconfig httpd on # service httpd start

Cut in the browser and break into our server:

 http://192.168.1.11/

MySQL and Memcached server notes

If you need to use mysql in your application - the IP address is 192.168.1.13 and tcp-port 3306 :

 /*  php-  */ /*    WordPress */ define('DB_NAME', 'foo'); /* MySQL database username */ define('DB_USER', 'bar'); /* MySQL database password */ define('DB_PASSWORD', 'mypassword'); /* MySQL hostname */ define('DB_HOST', '192.168.1.13');

If you need a memcached server, the IP address is 192.168.1.12 and the tcp port is 11211 :

 /*  php- */                if ( isset($memcached_servers) )                        $buckets = $memcached_servers;                else                        $buckets = array('default' => array('192.168.1.12:11211'));

Or:

 $config['Datastore']['class'] = 'myApp_MemCached; $i = 0; $i++; $config['Misc']['memcacheserver'][$i]           = '192.168.1.12'; $config['Misc']['memcacheport'][$i]             = 11211; $config['Misc']['memcachepersistent'][$i]       = true; $config['Misc']['memcacheweight'][$i]           = 1; $config['Misc']['memcachetimeout'][$i]          = 1; $config['Misc']['memcacheretry_interval'][$i]   = 15;

Source: https://habr.com/ru/post/148489/

All Articles