So friends, to kick us off, what I first want to do is to walk through some
basic
AC Lennox configuration that is ultimately going to allow us to access a web
server.
Now what I want to do first is just to walk through the process manually so
that you're
very, very clear as to what is going on because quite simply, if you just look
at the resultant
playbook that we're going to be writing to configure this, well, it is quite
easy to
get lost in the woods.
AC Lennox can be a little bit confusing.
So if you see exactly what you're trying to do manually, you will be much more WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if you see exactly what you're trying to do manually, you will be much more
easily
able to map what it is we have to do in the playbook and it should make more
sense.
So what we're going to be doing is installing an HTTP server and ultimately
this server
is going to, well, serve up a very particular web page.
Now as it transpires, the actual configuration that we're going to invoke is
going to run
into some problems because of AC Lennox configuration and then we're going to
see how we can actually
solve those issues and like I say, once we've done that, we'll map it to an Ans
ible Playbook
and begin automating the process. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
and begin automating the process.
This is actually a really good way to begin building out complex Ansible Blue
Books.
So with that said, let's go and walk through what we've got to do here.
So here I am over on my Blue Box.
The very first thing that I'm going to do before I even begin is to turn off my
firewall
configuration.
That is because the firewall is going to present some problems.
Now the good news is that later on within this very scale, we'll be talking
about how we
can actually use firewall D via automation.
So realistically, we'll get to see how this is actually solved in the real WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So realistically, we'll get to see how this is actually solved in the real
world.
But for now, let's just keep things as simple as possible.
After all, AC Lennox is complex enough.
So all I will do is I will just say pseudo systemctl stop firewall D and to
enter.
I'll now type in my password for the super user.
And now if I say systemctl status on firewall D, as we can see here, the
service has stopped.
Perfect.
That's the first thing that we want to be doing.
So the next thing that I want to do is I want to install my HTTP server on the WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the next thing that I want to do is I want to install my HTTP server on the
system.
So I will just say it's pseudo DNF install, HTTP D and hit enter.
We'll begin pulling down the information.
Just give it a moment.
And now we can see all of the additional dependencies that are going to be
installed.
Let's just hit Y and hit enter.
Now let's just give this a moment to complete.
And as we can see here now, we have installed everything.
So as it stands at the moment, if I just say systemctl status on 80 DPD, notice
the status
is inactive and dead. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is inactive and dead.
So what I will do here is I will say pseudo systemctl start 80 DPD and just
give this
a few seconds to load up.
Now if we check the status, as we can see here, the server is active and
running.
So what I can do is if I just say IP adder and get my IP address here, this is
my IP address.
Let's just copy this for the moment.
And if I go to my web browser, all I will do is I'll paste in the IP address
and hit
enter and we land on the Red Hat Enterprise Linux test page. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
enter and we land on the Red Hat Enterprise Linux test page.
Pretty much this page is telling us if we happen to have installed an HTTP
server, this
means that the HTTP service is installed.
Okay, that is working correctly.
Perfect.
Let's say we want to have a custom location whereby our site is going to serve
up content.
Now by default, if I just go back to my terminal right here, I think we'll
screen and I go
into a very particular configuration file, so I'll say pseudo them and I'll go
into the
Etsy directory and then 80 DPD and then the conf directory and then a fail WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Etsy directory and then 80 DPD and then the conf directory and then a fail
called 80 DPD
dot conf.
Let's go in here.
Okay.
Now if I scroll all the way down, just keep on going.
We'll see a whole bunch of configurations and then we'll come to this portion
right
here.
Now as it stands, what it actually tells us here is that the document route is
in the
var directory and then www and then HTML.
This is where we expect to effectively house our configuration files.
So if you want to put in an index page, which would be your homepage index dot WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So if you want to put in an index page, which would be your homepage index dot
HTML, pretty
much the server is set up to look in this particular directory for this
particular file
and as we can see here, we have some particular configurations relating to
these directories
within the var www directory.
We have some configs right here allowing access as well as into the HTML file
directly or
rather the HTML directory directly a little bit of a tongue twister.
We also have some configurations again, if you scroll on down, we can see here
we're
granting everyone access to this particular directory or rather the contents WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
granting everyone access to this particular directory or rather the contents
within that
directory.
So what we want to do is we want to have a custom directory and not actually
follow that particular
directory structure.
Now what I want to show you here is by default, when we happen to just install
HTTP, some security
context labels are already going to be set for us.
So if I go into the var directory and then www, if I do an LS and then dash
capital Z
to show the security context attached to this particular directory, we have WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to show the security context attached to this particular directory, we have
this particular
type here, the HTTP underscore sys underscore content underscore T.
What this is pretty much telling us here is that the HTTP process can access
content
within this particular directory.
What we want to do is you want to have our own custom directory.
So all I will do here is I will make a directory, let's just say pseudo, MKDAR,
and let's just
call this my site.
Okay.
Now if I go into my sites and I just say pseudo vim and I create an index dot WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Now if I go into my sites and I just say pseudo vim and I create an index dot
HTML right
here and inside of here, I would just say this as the blue box website.
Okay.
Now there's a problem here.
First off, the actual configuration file is not configured to look into this
particular
directory for this particular file.
So that's the first thing we want to be fixing there.
Okay.
So what I will do here is I'll go and I'll say pseudo vim.
I'll go into the exit directory once again, 80dPD, and then the cons directory
and then
the 80dPD dot conf file.
All I'm going to do here is go into insert mode and I'm going to specify that WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
All I'm going to do here is go into insert mode and I'm going to specify that
the document
route is not going to be var www HTML.
Instead it's just going to be forward slash my site.
And similarly, all I'll do is just comment out this particular part right here.
And this directory here, all I will do is I'm going to change this also to my
site.
Okay.
Forward slash my site and all this part here, all these comments, let's just
remove all
them just for simplicity.
Okay.
Just delete all these.
What we're now doing is we're telling the server to look into this directory
for the
content of the website. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
content of the website.
And again, all we've done is just assign some associated configurations that
allow for access.
So if I just write and quit at the moment, let's maybe try reloading the server
.
Okay.
So just do a restart on 80dPD.
Give it a few seconds.
Okay.
Let's go back to our webpage.
Let's type an IP address and we still get the same default page.
What is going on here?
Even though we've told the HTTP server to look into the my site directory for
its contents, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
its contents,
we actually are having a problem via SEO Linux and it is explicitly related to
the security
context labels.
So let me go and show you what I mean.
If I do an LS and my route directory, we can see all of my doors that I've
created here
is the my site directory.
If I want to see the security context associated, I would just do my dash
capital Z and to
answer.
So look at this right here.
Let's look at the third column.
Okay.
So the associated type is default underscore T. Now recall in order for the 80d WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So the associated type is default underscore T. Now recall in order for the 80d
PD process
to be able to access this directory, we want this directory to have this
particular content
80dPD sys content T.
So first let me prove to you that SEO Linux is the problem and the way we will
do that
is by changing SEO Linux to be in permissive mode so that it doesn't actually
block anything.
It just logs any potential issues.
So all I will do here is also pseudo set enforce and I'll change this to per
missive.
If I now do SE status, we can see the current mode is now permissive. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If I now do SE status, we can see the current mode is now permissive.
And because of this, even though we have a mismatch in labels, the 80dPD server
is not
going to be blocked by SEO Linux and it should be able to consume what we
actually have within
the my site directory.
So let's go back to a browser.
Let's open IP address of the server and to enter and now look at this with SE
Linux now
effectively disabled or at least in permissive mode.
Now the 80dPD server can access the content within that particular directory as
we have
specified and check this out as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
specified and check this out as well.
Let's close this for a moment.
We can actually see in the logs, if I say pseudo SE alert and then check the
logs in
var log audit forward slash audit dot log, give this a moment to build.
Look at what we actually have here.
Let's scroll on up a little bit.
It says here in the logs, SE Linux is preventing the actual 80dPD demon from
getting access
to the index file within the my site directory.
So that of course the option isn't really just to effectively change SE Linux WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So that of course the option isn't really just to effectively change SE Linux
and put
it into permissive mode whereby it's going to allow a whole bunch of
potentially dangerous
interactions.
What we really want to do is you want to effectively change the SE Linux
context associated with
the my site directory.
So what I will do here is I'll just put SE Linux back on and I'll say pseudo
set enforce
and I'll put it back to enforcing.
Let's go back to our webpage, type in IP address and now we're back to seeing
this default
webpage.
We can't access the content within the my site directory anymore.
So let's fix this by adding in the label. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So let's fix this by adding in the label.
Now you can do this in different ways.
You can use SE manage in order to have a permanent solution or if you just want
to have
a quick temporary change, you can just use CHcon and interest or simplicity
right now
and I would have used CHcon to change the label but when it comes to the actual
playbook,
we'll change it properly.
So what I will do here is I'll specify that I want to attach the 80 DPD
underscore sys
underscore content underscore T label and I want to assign it to the forward
slash my
site directory.
If I hit enter and I now go to that particular directory, so here's my root WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
If I hit enter and I now go to that particular directory, so here's my root
file system.
If I say LS dash Z on the roots, look at what we actually have here.
The my site directory now has the correct security context associated and
inside of that directory.
Here is the index dot HTML file and again, if I check the security context, we
have
recursively added that label.
So this particular file here, the index dot HTML now has the correct label.
So again, if you go back to our server and we just refresh the page, now we're
getting
access to the actual content within that directory, even with AC Linux fully WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
access to the actual content within that directory, even with AC Linux fully
enforced.
So I know that was a lot to kind of wrap your head around.
We had to create directories.
We had to change configuration files.
We had to modify labels now that we know what all the pieces are and why we do
them.
Let us now automate this process using Ansible.
[BLANK_AUDIO]