arno/privatebin
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
Page: Installation on Red Hat with SELinux
Pages
API Configuration Development Docker Encryption format FAQ Home Installation on Red Hat with SELinux Installation PrivateBin Directory Release Checklist Templates Third party clients Translation Upgrading from ZeroBin 0.19 Alpha
3 Installation on Red Hat with SELinux
elrido edited this page 2016-07-09 10:37:10 +02:00
Table of Contents

This tutorial on how to install httpd, php70 and PrivateBin on a minimal red hat or CentOS 7 installation was provided by @pozzo-balbi and was originally published at pozzo-balbi.com/help/Zerobin under Creative Commons Attribution ShareAlike 3.0 license.

Prerequisits

Assuming you are running a VM with minimal installation, you will need to install the following. First php in the latest version and httpd.

rpm -Uvh https://mirror.webtatic.com/yum/el7/webtatic-release.rpm
yum -y install php70w php70w-opcache php70w-gd php70w-intl php70w-mbstring php70w-mcrypt php70w-xml httpd httpd-tools

Update php.ini:

sed -i 's/expose_php = On/expose_php = Off/' /etc/php.ini
sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/' /etc/php.ini
sed -i 's/;date.timezone =/date.timezone = Europe\/Berlin/' /etc/php.ini
sed -i 's/;mail.log = syslog/mail.log = syslog/' /etc/php.ini
sed -i 's/;realpath_cache_size = 16k/realpath_cache_size = 256k/' /etc/php.ini
sed -i 's/;realpath_cache_ttl = 120/realpath_cache_ttl = 1200/' /etc/php.ini

Now customize httpd. Remove unnecessary modules (for PrivateBin) from /etc/httpd/conf.modules.d. Uncomment as needed.

00-base.conf:

LoadModule access_compat_module modules/mod_access_compat.so
  #Group authorizations based on host (name or IP address)
#LoadModule actions_module modules/mod_actions.so #Execute CGI scripts based on media type or request method.
#LoadModule alias_module modules/mod_alias.so  #Provides for mapping different parts of the host filesystem in the document tree and for URL redirection
#LoadModule allowmethods_module modules/mod_allowmethods.so #Easily restrict what HTTP methods can be used on the server
#LoadModule auth_basic_module modules/mod_auth_basic.so  #Basic HTTP authentication
#LoadModule auth_digest_module modules/mod_auth_digest.so  #User authentication using MD5 Digest Authentication
#LoadModule authn_anon_module modules/mod_authn_anon.so #Allows "anonymous" user access to authenticated areas
#LoadModule authn_core_module modules/mod_authn_core.so #Core Authentication
#LoadModule authn_dbd_module modules/mod_authn_dbd.so #User authentication using an SQL database
#LoadModule authn_dbm_module modules/mod_authn_dbm.so #User authentication using DBM files
#LoadModule authn_file_module modules/mod_authn_file.so #User authentication using text files
#LoadModule authn_socache_module modules/mod_authn_socache.so #Manages a cache of authentication credentials to relieve the load on backends
LoadModule authz_core_module modules/mod_authz_core.so
 #Core Authorization
#LoadModule authz_dbd_module modules/mod_authz_dbd.so #Group Authorization and Login using SQL
#LoadModule authz_dbm_module modules/mod_authz_dbm.so #Group authorization using DBM files
#LoadModule authz_groupfile_module modules/mod_authz_groupfile.so #Group authorization using plaintext files
#LoadModule authz_host_module modules/mod_authz_host.so  #Group authorizations based on host (name or IP address)
#LoadModule authz_owner_module modules/mod_authz_owner.so #Authorization based on file ownership
#LoadModule authz_user_module modules/mod_authz_user.so #User Authorization
#LoadModule autoindex_module modules/mod_autoindex.so #Generates directory indexes, automatically, similar to the Unix ls command or the Win32 dir shell command
LoadModule cache_module modules/mod_cache.so
 #RFC 2616 compliant HTTP caching filter.
LoadModule cache_disk_module modules/mod_cache_disk.so
 #Disk based storage module for the HTTP caching filter.
LoadModule data_module modules/mod_data.so
 #Convert response body into an RFC2397 data URL
#LoadModule dbd_module modules/mod_dbd.so #Manages SQL database connections
LoadModule deflate_module modules/mod_deflate.so
 #Compress content before it is delivered to the client
LoadModule dir_module modules/mod_dir.so
 #Provides for "trailing slash" redirects and serving directory index files
#LoadModule dumpio_module modules/mod_dumpio.so #Dumps all I/O to error log as desired.
#LoadModule echo_module modules/mod_echo.so #A simple echo server to illustrate protocol modules
#LoadModule env_module modules/mod_env.so #Modifies the environment which is passed to CGI scripts and SSI pages
LoadModule expires_module modules/mod_expires.so
 #Generation of Expires and Cache-Control HTTP headers according to user-specified criteria
#LoadModule ext_filter_module modules/mod_ext_filter.so #Pass the response body through an external program before delivery to the client
#LoadModule filter_module modules/mod_filter.so  #Context-sensitive smart filter configuration module
LoadModule headers_module modules/mod_headers.so
 #Customization of HTTP request and response headers
#LoadModule include_module modules/mod_include.so #Server-parsed html documents (Server Side Includes)
#LoadModule info_module modules/mod_info.so #Provides a comprehensive overview of the server configuration
LoadModule log_config_module modules/mod_log_config.so
 #Logging of the requests made to the server
#LoadModule logio_module modules/mod_logio.so #Logging of input and output bytes per request
#LoadModule mime_magic_module modules/mod_mime_magic.so #Determines the MIME type of a file by looking at a few bytes of its contents
LoadModule mime_module modules/mod_mime.so
 #Associates the requested filename's extensions with the file's behavior (handlers and filters) and content (mime-type, language, character set and encoding)
#LoadModule negotiation_module modules/mod_negotiation.so  #Provides for content negotiation
LoadModule remoteip_module modules/mod_remoteip.so
 #Replaces the original client IP address for the connection with the useragent IP address list presented by a proxies or a load balancer via the request headers. 
#LoadModule reqtimeout_module modules/mod_reqtimeout.so #Set timeout and minimum data rate for receiving requests
LoadModule rewrite_module modules/mod_rewrite.so
 #Provides a rule-based rewriting engine to rewrite requested URLs on the fly
#LoadModule setenvif_module modules/mod_setenvif.so #Allows the setting of environment variables based on characteristics of the request
#LoadModule slotmem_plain_module modules/mod_slotmem_plain.so #Slot-based shared memory provider.
#LoadModule slotmem_shm_module modules/mod_slotmem_shm.so #Slot-based shared memory provider.
#LoadModule socache_dbm_module modules/mod_socache_dbm.so #DBM based shared object cache provider.
#LoadModule socache_memcache_module modules/mod_socache_memcache.so #Memcache based shared object cache provider.
LoadModule socache_shmcb_module modules/mod_socache_shmcb.so
 #shmcb based shared object cache provider.
#LoadModule status_module modules/mod_status.so #Provides information on server activity and performance
#LoadModule substitute_module modules/mod_substitute.so #Perform search and replace operations on response bodies
#LoadModule suexec_module modules/mod_suexec.so #Allows CGI scripts to run as a specified user and Group
LoadModule unique_id_module modules/mod_unique_id.so
 #Provides an environment variable with a unique identifier for each request
LoadModule unixd_module modules/mod_unixd.so
 #Basic (required) security for Unix-family platforms.
#LoadModule userdir_module modules/mod_userdir.so #User-specific directories
#LoadModule version_module modules/mod_version.so #Version dependent configuration
#LoadModule vhost_alias_module modules/mod_vhost_alias.so  #Provides for dynamically configured mass virtual hosting

#LoadModule buffer_module modules/mod_buffer.so #Support for request buffering
#LoadModule watchdog_module modules/mod_watchdog.so #provides infrastructure for other modules to periodically run tasks
#LoadModule heartbeat_module modules/mod_heartbeat.so #Sends messages with server status to frontend proxy
#LoadModule heartmonitor_module modules/mod_heartmonitor.so #Centralized monitor for mod_heartbeat origin servers
#LoadModule usertrack_module modules/mod_usertrack.so #Clickstream logging of user activity on a site 
#LoadModule dialup_module modules/mod_dialup.so #Send static content at a bandwidth rate limit, defined by the various old modem standards
#LoadModule charset_lite_module modules/mod_charset_lite.so #Specify character set translation or recoding
#LoadModule log_debug_module modules/mod_log_debug.so #Additional configurable debug logging
#LoadModule ratelimit_module modules/mod_ratelimit.so #Bandwidth Rate Limiting for Clients
#LoadModule reflector_module modules/mod_reflector.so #Reflect a request body as a response via the output filter stack.
#LoadModule request_module modules/mod_request.so #Filters to handle and make available HTTP request bodies
#LoadModule sed_module modules/mod_sed.so #Filter Input (request) and Output (response) content using sed syntax
#LoadModule speling_module modules/mod_speling.so #Attempts to correct mistaken URLs by ignoring capitalization, or attempting to correct various minor misspellings.

00-dav.conf:

#LoadModule dav_module modules/mod_dav.so
#LoadModule dav_fs_module modules/mod_dav_fs.so
#LoadModule dav_lock_module modules/mod_dav_lock.so

00-lua.conf:

#LoadModule lua_module modules/mod_lua.so

00-proxy.conf:

#LoadModule proxy_module modules/mod_proxy.so
#LoadModule lbmethod_bybusyness_module modules/mod_lbmethod_bybusyness.so
#LoadModule lbmethod_byrequests_module modules/mod_lbmethod_byrequests.so
#LoadModule lbmethod_bytraffic_module modules/mod_lbmethod_bytraffic.so
#LoadModule lbmethod_heartbeat_module modules/mod_lbmethod_heartbeat.so
#LoadModule proxy_ajp_module modules/mod_proxy_ajp.so
#LoadModule proxy_balancer_module modules/mod_proxy_balancer.so
#LoadModule proxy_connect_module modules/mod_proxy_connect.so
#LoadModule proxy_express_module modules/mod_proxy_express.so
#LoadModule proxy_fcgi_module modules/mod_proxy_fcgi.so
#LoadModule proxy_fdpass_module modules/mod_proxy_fdpass.so
#LoadModule proxy_ftp_module modules/mod_proxy_ftp.so
#LoadModule proxy_http_module modules/mod_proxy_http.so
#LoadModule proxy_scgi_module modules/mod_proxy_scgi.so

01-cgi.conf:

<IfModule mpm_worker_module>
#   LoadModule cgid_module modules/mod_cgid.so
</IfModule>
<IfModule mpm_event_module>
#   LoadModule cgid_module modules/mod_cgid.so
</IfModule>
<IfModule mpm_prefork_module>
#   LoadModule cgi_module modules/mod_cgi.so
</IfModule>

Next adjust settings for modules in /etc/httpd/conf.d .

mv /etc/httpd/conf.d/autoindex.conf /etc/httpd/conf.d/autoindex.conf.orig
mv /etc/httpd/conf.d/userdir.conf /etc/httpd/conf.d/userdir.conf.orig
touch /etc/httpd/conf.d/autoindex.conf
touch /etc/httpd/conf.d/userdir.conf

Last but not least configure Apache httpd itself.

cd /etc/httpd/conf
cp httpd.conf httpd.conf.orig
#sed -i 's/ServerAdmin root@localhost/ServerAdmin youremail@example.com/' /etc/httpd/conf/httpd.conf # change against your email if needed
sed -i 's/Listen 80/Listen 0.0.0.0:80/' /etc/httpd/conf/httpd.conf
sed -i 's/LogLevel warn/LogLevel error/' /etc/httpd/conf/httpd.conf
sed -i 's/#EnableMMAP off/EnableMMAP on/' /etc/httpd/conf/httpd.conf
#echo -e "ServerSignature off\nServerTokens Prod\nExtendedStatus Off\nStartServers 10\nMinSpareServers 1\nMaxSpareServers 2\nServerLimit 12\nMaxClients 12\nMaxRequestsPerChild 10000\nKeepAlive on\nKeepAliveTimeout 120" | cat - /etc/httpd/conf/httpd.conf > /etc/httpd/conf/temp && mv /etc/httpd/conf/temp /etc/httpd/conf/httpd.conf <<< y
cat >> /etc/httpd/conf.d/custom.conf << EOF
ServerSignature off
ServerTokens Prod
ExtendedStatus Off
StartServers 10
MinSpareServers 1
MaxSpareServers 2
ServerLimit 12
MaxClients 12
MaxRequestsPerChild 10000
KeepAlive on
KeepAliveTimeout 120
<Directory "/var/www/html/paste/data">
 Require all denied
</Directory>
<Directory "/var/www/html/paste/tmp">
 Require all denied
</Directory>
<Directory "/var/www/html/paste/cfg">
 Require all denied
</Directory>
<Directory "/var/www/html/paste/lib">
 Require all denied
</Directory>
 ExpiresActive On
 ExpiresDefault A2592000 # (= one month)
 Header set Cache-Control "max-age=2592000, public"
<FilesMatch "\.(pl|php|cgi|spl)$">
 Header unset Cache-Control
 Header unset Expires
 Header unset Last-Modified
 FileETag None
 Header unset Pragma
</FilesMatch>
EOF
setsebool -P httpd_execmem=1
setsebool -P httpd_builtin_scripting=1
systemctl enable httpd

Installation

Download the latest version of PrivateBin and extract it to /var/www/html/paste.

Create directories needed by PrivateBin, update permissions and (re)start httpd:

cd /var/www/html/paste
mkdir data
mkdir tmp
chown apache:apache *
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/paste/tmp(/.*)?"
semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/paste/data(/.*)?"
systemctl restart httpd

Update selinux after some time with:

cd /var/log/audit
grep hugetlbfs audit.log | audit2allow -M hugetlbfs
semodule -i hugetlbfs.pp

Nginx/Naxsi

If using nginx with naxsi on your reverse proxy, add these whitelist_rules:

BasicRule wl:1015 "mz:$URL:/paste/|$BODY_VAR:data";
BasicRule wl:1315 "mz:$URL:/paste/|$HEADERS_VAR:cookie";
BasicRule wl:1001 "mz:$URL:/paste/|$BODY_VAR:data";
BasicRule wl:1009 "mz:$URL:/paste/|$BODY_VAR:data";
BasicRule wl:1009 "mz:$URL:/paste/|$BODY_VAR:nickname";
BasicRule wl:1001 "mz:$URL:/paste/|$BODY_VAR:nickname";
BasicRule wl:1015 "mz:$URL:/paste/|$BODY_VAR:nickname";