Exercise: Capstone review

Capstone review

• Deliver a service with proof for every layer.
• Limit access to one caller and keep SELinux enforcing.
• Add a persistent journal and a scheduled backup that keeps ACLs and labels.

Before you start: reset the servers and complete the chapter's lessons and exercises. servera hosts the page and serverb is the partner. lab start and lab grade run on workstation. Finish by rebooting servera and grading again.

On servera:

1. Create the group ops (GID 4900) and the accounts statusadm (UID 3100, group ops, nologin) and auditor (UID 3101). Install and enable httpd.
2. /srv/status (statusadm:ops, 2750) holds index.html with Status page: ready (640). apache and auditor read through ACLs; new files inherit them.
3. httpd serves /srv/status on port 8095. Store the content mapping and the port label; SELinux stays enforcing.
4. Zone statuspartners with serverb as source and 8095/tcp; the default zone stays closed.
5. Persistent journal; status-backup.service and a daily, enabled status-backup.timer keeping ACLs and labels in /srv/backups/status.tar.gz. Run the backup once.
6. Test from serverb, reboot servera, test again.
7. On workstation, fill in answers.txt.

Start the exercise

[student@workstation ~]$ lab start sa-review-final
[student@workstation ~]$ ssh student@servera
[student@servera ~]$ sudo -i
[root@servera ~]#

Identity, software, content

[root@servera ~]# groupadd -g 4900 ops
[root@servera ~]# useradd -u 3100 -g ops -s /sbin/nologin statusadm
[root@servera ~]# useradd -u 3101 auditor
[root@servera ~]# dnf install -y httpd > /dev/null
[root@servera ~]# install -d -o statusadm -g ops -m 2750 /srv/status
[root@servera ~]# echo "Status page: ready" > /srv/status/index.html
[root@servera ~]# chown statusadm:ops /srv/status/index.html; chmod 640 /srv/status/index.html
[root@servera ~]# setfacl -m u:apache:rX,u:auditor:rX /srv/status
[root@servera ~]# setfacl -d -m u:apache:rX,u:auditor:rX /srv/status
[root@servera ~]# setfacl -m u:apache:r,u:auditor:r /srv/status/index.html

Service and labels

[root@servera ~]# cat > /etc/httpd/conf.d/status.conf <<'EOT'
Listen 8095
<VirtualHost *:8095>
    DocumentRoot /srv/status
    <Directory /srv/status>
        Require all granted
    </Directory>
</VirtualHost>
EOT
[root@servera ~]# semanage port -a -t http_port_t -p tcp 8095
[root@servera ~]# semanage fcontext -a -t httpd_sys_content_t "/srv/status(/.*)?"
[root@servera ~]# restorecon -Rv /srv/status
[root@servera ~]# systemctl enable --now httpd; curl -s localhost:8095
Status page: ready

Network, journal and backup

[root@servera ~]# getent hosts serverb
172.25.250.11   serverb.lab.example.com
[root@servera ~]# firewall-cmd --permanent --new-zone=statuspartners; firewall-cmd --reload
success
success
[root@servera ~]# firewall-cmd --permanent --zone=statuspartners --add-source=172.25.250.11
success
[root@servera ~]# firewall-cmd --permanent --zone=statuspartners --add-port=8095/tcp; firewall-cmd --reload
success
success
[root@servera ~]# mkdir -p /etc/systemd/journald.conf.d /srv/backups
[root@servera ~]# printf '[Journal]\nStorage=persistent\n' > /etc/systemd/journald.conf.d/10-persistent.conf
[root@servera ~]# systemctl restart systemd-journald; journalctl --flush
[root@servera ~]# chmod 750 /srv/backups
[root@servera ~]# cat > /etc/systemd/system/status-backup.service <<'EOT'
[Unit]
Description=Back up the status page

[Service]
Type=oneshot
ExecStart=/usr/bin/tar --acls --selinux -czf /srv/backups/status.tar.gz -C /srv status
EOT
[root@servera ~]# cat > /etc/systemd/system/status-backup.timer <<'EOT'
[Unit]
Description=Daily status backup

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target
EOT
[root@servera ~]# systemctl daemon-reload; systemctl enable --now status-backup.timer
[root@servera ~]# systemctl start status-backup.service; tar -tzf /srv/backups/status.tar.gz
status/
status/index.html

Use the address that getent hosts serverb shows on your lab.

Prove it, reboot, grade

[student@serverb ~]$ curl -s -m 3 http://servera:8095/
Status page: ready
[root@servera ~]# systemctl reboot
[student@serverb ~]$ sleep 60; curl -s -m 3 http://servera:8095/
Status page: ready

Grade once before and once after the reboot.

Grade

On workstation, fill in answers.txt and grade:

Check your work with lab grade sa-review-final, then put the exercise away with lab finish sa-review-final.