View source for OPS235 Assignment 2/Fall 2011

[[Category:OPS235]]

{{Admon/important|Section B only!|This version of the assignment is for Fall 2011 OPS235 Section B only - taught by Chris Tyler.}}
{{Admon/note|Assignment Material May Appear on Tests and Exam|Doing your assignment is part of your ongoing learning process. As such you will be tested on this material in future tests and exams. If you have any questions or need help, please consult your instructor in a timely manner. The due date for this assignment will not be extended. As it must be marked in class.
This assignment will be marked partially through demonstration and partially through the submission of files.}}

= OPS235 Assignment #2 -- Fall 2011 -- Section B =

Weight: 5% of the overall grade

Due Date: December 9 ('''Check with your Professor for exact date''').

{{Admon/important|Backup Your Configuration Files|Before making any changes to your system configuration, backup the original configuration files into the <code>/backups</code> directory.}}

== Introduction and Purpose ==

In this assignment, you will demonstrate the skills you have learned to this point by configuring two services: a database server and a web server. You will install and use a database-backed web application, MediaWiki, to show that these services have been installed properly. Finally, you will configure the SELinux security system and the web server to serve files in the <code>public_html</code> subdirectory of each user's home directory, including a short web script.

In this assignment, you will attempt to maintain a high level of security, by using SELinux and the iptables firewall to guard against unauthorized access.

This lab may be performed using any combination of your virtual machines and/or host disk pack.

== About SELinux ==

SELinux stands for ''Security Enhanced Linux'' and is based on research performed at NSA and other locations. Where the normal Unix/Linux security system, based upon file permissions, is a ''discretionary access control'' system (DAC), SELinux is a ''mandatory access control'' system (MAC). This means that it attempts to enforce a consistent policy across the entire system, on top of the settings that any user has configured.

SELinux decisions are based on the ''security context'' of system resources such as files and processes. The security context consists of a user, role, type, and sensitivity component; you can see the security context of files and processes by adding the <code>-Z</code> option to the <code>ls</code> and <code>ps</code> commands:

 $ ls -lZ
 drwxr-xr-x. root  root  '''system_u:object_r:file_t:s0'''          arm
 drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' arm2
 drwxrwxr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' bin
 drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Desktop
 drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Documents
 drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Downloads
 -rw-------. chris chris '''unconfined_u:object_r:user_home_t:s0''' fedora0.ks
 -rw-------. chris chris '''unconfined_u:object_r:user_home_t:s0''' fedora1.ks
 -rw-------. chris chris '''unconfined_u:object_r:user_home_t:s0''' fedora2.ks
 -rw-------. chris chris '''unconfined_u:object_r:user_home_t:s0''' fedora3.ks
 -rw-rw-r--. chris chris '''unconfined_u:object_r:user_home_t:s0''' foo
 -rw-r--r--. chris chris '''unconfined_u:object_r:user_home_t:s0''' hosts
 drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Music
 drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Pictures
 drwxrwxr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' play
 drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Public
 drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Templates
 drwxr-xr-x. chris chris '''unconfined_u:object_r:user_home_t:s0''' Videos
 -rw-r--r--. chris chris '''unconfined_u:object_r:user_home_t:s0''' x
 [chris@muskoka ~]$ ps -Z
 LABEL                                                  PID TTY      TIME CMD
 '''unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023''' 2595 pts/1 00:00:00 bash
 '''unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023''' 2612 pts/1 00:00:00 ps

The SELinux policy controls the interactions between security contexts. For example, the policy may specify that the Apache httpd webserver cannot read files in <code>/etc</code>, so if an attacker finds a way to make httpd (or a script run by httpd) read a file in <code>/etc</code>, SELinux will recognize that this is not normal and will deny the access. Since this is done at the kernel level, httpd will get a "file not found" error, even though the file is present, and there is no way for httpd to work around that error.

=== SELinux Context Commands ===

There are two main commands used to set the SELinux security context of files:
# chcon - sets the security context of a file to a particular value
#* Example: setting the ''type'' of a file: <code>chcon -t ''unconfined_t'' ''/tmp/foo''</code>
#* Example: setting the user/role/type of a file: <code>chcon ''unconfined_u:object_r:user_home_t'' ''~/foo''</code>
# restorecon - resets the default security context of a file
#* Example: reset the context of one file: <code>restorecon /etc/services</code>
#* Example: recursively reset the contexts of all of the files in a directory: <code>restorecon -R ~</code>

You can reset the default security context of the entire system at the next boot with this command:

 touch /.autorelabel

=== SELinux Booleans ===

SELinux policy can be tuned (without writing an entirely new policy) through the use of ''booleans'' or option switches. Each boolean can have a value of on (1) or off (0).

The <code>getsebool</code> and <code>setsebool</code> commands can be used to view and set SELinux boolean values:

{|class="mediawiki sortable" border="1" cellspacing="0"
!Command
!Description
|-
|<code>getsebool -a</code>
|Displays all SELinux booleans
|-
|<code>getsebool ''foo''</code>
|Displays the SELinux boolean ''foo''
|-
|<code>setsebool ''foo'' ''value''</code>
|Sets the SELinux boolean ''foo'' to ''value'' (where ''value'' is 0 or "off", or 1 or "on")
|}


=== SELinux Graphical Tools ===

The ''system-config-selinux'' tool, which is on the menu as System>Adminstration>SELinux Management, provides a GUI for managing SELinux booleans and more.


{{Admon/note|Takes Notes!|Take detailed notes of the steps you perform from this point onward -- you will need them for the wiki pages you will create later.}}

== Installing Packages ==

Install these packages and any dependencies using ''yum'':
* '''httpd''' - this is the Apache web server software. It provides the '''httpd''' service, which runs on port 80.
* '''php''' - this is the PHP server software. It provides the '''php''' capabilities to the web server and wiki.
* '''mysql-server''' - this is the MySQL database server. It provides the '''mysqld''' service, which runs on a Unix domain socket and TCP port 3306 by default.
* '''mediawiki''' - this is the wiki software used by this wiki, Wikipedia, and many other sites. It is a series of PHP scripts which are run by Apache httpd as requests are received, and it connects to a database such as MySQL locally or on other servers.

== Configuring Services ==

=== Apache httpd ===

# Start the httpd service using the '''service''' command.
# Confirm that you can connect to your web server using a web browser -- both from the machine on which the server is running as well as from another machine on the same network. You should see a test page.
# Configure this software to start when the system is booted.
# Create a very simple HTML index page for your system, and place it at <code> /var/www/html/index.html </code>
# Confirm that you can view the index page. If not, adjust your iptables configuration as necessary, or check for errors in <code>/var/log/httpd</code>

=== MySQL ===
April 14
# Start the MySQL service (mysqld).
# '''When started for the first time, this service will print a message telling you how to set a password and take other basic steps to secure the the MySQL server.''' Follow those instructions to set a password, recording the detail of what you do for later use.
# Configure this software to start when the system is booted.

=== MediaWiki ===

# Edit MediaWiki's httpd configuration file, <code>/etc/httpd/conf.d/mediawiki.conf</code>
#* Uncomment the first two <code>Alias</code> lines
#* Reload the httpd configuration using the <code>service</code> command
# Access <code>http://localhost/wiki</code> on the machine on which the web server is running (this will not work if done remotely, unless you use an ssh tunnel so that the access appears to be coming from the local host). You will see the MediaWiki welcome page; click on the setup link.
# Enter the setup information for your wiki:
#* Enter a name for the wiki
#* Enter your learn e-mail address as the contact information
#* Disable all e-mail features
#* Leave the database host as "localhost"
#* Set up a database password
#* Get MediaWiki to set up the superuser account by checking the appropriate box and entering the superuser password ('''Note:''' This is the database superuser password, NOT the root password).
# Click the "Install MediaWiki!" button.
# Once the setup is complete, you will need to move a file within the MediaWiki directory (i.e. inside <code>/var/www/wiki</code>). Refer to the directions in the confirmation web page.

When you are done, you should be able to go to <code>http://'''hostname'''/wiki</code> from any directly-connected machine.

=== Serving Personal Web Pages ===

# Configure httpd to serve the <code>~/public_html</code> directories of your users. This will require changes to <code>/etc/httpd/conf/httpd.conf</code> as well as the SELinux configuration. See the man page for <code>httpd_selinux</code> and the Apache [http://httpd.apache.org/docs/2.2/ httpd documentation] for details.
# Prove that this works by creating a page in your <code>~/public_html</code> directory. The URL will be <code>http://''hostname''/~''your-user-id''/</code>
# Create a short web script which displays the available disk space on the computer. At its most basic level, a web script is the same as a regular script, with this additional requirement:
#* It must output the line "Content-type: text/plain" or "Content-type: text/html" (depending on whether the script output is plain text or HTML), followed by a blank line.
# Name the script <code>~/public_html/diskfree.cgi</code> - The URL will be <code>http://''hostname''/~''your-user-id''/diskfree.cgi</code>
# Configure httpd and SELinux to allow your script to be run from the web. This will require changes to <code>/etc/httpd/conf/httpd.conf</code> as well as the SELinux configuration (possibly including both booleans and SELinux context). As with step 1, see the man page for <code>httpd_selinux</code> and the Apache [http://httpd.apache.org/docs/2.2/ httpd documentation] for details.

{{Admon/tip|Hint|Look for an "add-handler" line in your httpd.conf file.}}

== Write-up ==

Create a high-quality write-up of this assignment on your wiki. '''Describe in detail exactly what you did to set up each component'''. Your write-up must contain these pages:
# A main page (page name Main Page), containing a hyperlinked table of contents linked to your other wiki pages, as well as a link to the page and the script in your <code>~/public_html</code> directory.
# A page for your httpd configuration (page name: httpd_conf). Include:
## A description of the changes you made.
## Your full Apache configuration file, with any changes highlighted in '''bold''' or with <span style="background:yellow">colour</span>.
# A page for your MySQL configuration (page name: mysql_conf). Include:
## A description of the steps performed to set up MySQL
# A page for your SELinux configuration (page name: selinux_conf). Include:
## A description of the changes you made, with any changes highlighted in '''bold''' or with <span style="background:yellow">colour</span>.
## A list of all of your booleans and their current settings.
## Explain why you think that your configuration is as tight (secure) as possible (e.g., you didn't change booleans unnecessarily).
# A page for your MediaWiki configuration (page name: mediawiki_conf).
## A description of the changes you made.
## Your full MediaWiki configuration file, with any changes highlighted in '''bold''' or with <span style="background:yellow">colour</span>.
# A page for your iptables configuration (page name iptables_conf). Include:
## A description of the changes you made.
## A full list of your iptables configuration rules (for the ''filter'' table), with any changes highlighted in '''bold''' or with <span style="background:yellow">colour</span>.
## A demonstration that the configuration is as tight as possible (for example, test access to other services, and include the results of those tests in the wiki page).
 
The easiest way to create new page is to create a link to it from an existing page (such as the main page), and then follow that link.

'''Write well and be creative:'''
* Make sure your spelling and grammar are correct (they count!).
* Present the pages attractively, and take advantage of graphics, colour, and fonts as appropriate.
* Stick to the important information - avoid including excessive text which doesn't add to the content that you are presenting (remember, your professor will be reading hundreds of wiki pages while marking!).

Resources on wiki markup:
* [http://en.wikipedia.org/wiki/Help:Wiki_markup Wiki markup] - Wikipedia
* [[Sandbox|Sandbox page on this wiki]] - examples

{{Admon/tip|Bonus Opportunity!|Change the default logo in the upper-left corner of your MediaWiki installation to a picture of your choosing. Be sure that you have copyright clearance to use that image (e.g., it is licensed to you, or it is a picture you own). Add an additional page to your wiki describing how you set up the logo, and the copyright that exists on that image file.}}

== Submitting the Assignment ==

Your professor will require you to submit this assignment in two ways:

# Demonstrate that the wiki is working. Be prepared to do this at the start of class on Friday December 9.
# Use wget to harvest the wiki pages:
#* Make sure all of the <code><nowiki>http://</nowiki></code>-style links (for the wiki image, the link to diskfree.cfgi, and so forth) use the same hostname (don't use "localhost" for one and "f13host" for another, for example).
#* Issue the command: <code>wget -prk http://''hostname''/wiki</code> -- where ''hostname'' matches the hostname used in the <code><nowiki>http://</nowiki></code> links in your wiki pages.
#* Create a compressed tar file containing the results. (name the file <learnid>-a2.tgz)
#* Check the tar file to see that it contains everything necessary to view your site (in particular, check that all needed image files are included). Do not edit the files in the tar archive -- if changes are needed, modify your wiki, and then repeat the <code>wget</code> and <code>tar</code> steps above.
#* Submit the tar file to your professor through this link: https://scs.senecac.on.ca/~chris.tyler/ops235/a2/ by 11:59 pm, Friday, December 9.

== Assessment ==

* 50% - completion of steps - quality of configuration, iptables and SELinux configuration as tight as possible
* 50% - documentation on the wiki - quality of writing, quality of presentation, and accuracy and completeness of information
* +5% - bonus for replacing the wiki logo