Web Application on vvm06 and MariaDB Database on vvm07

We are going to create a web server on vvm06 and a database server on vvm07. Packages used will be Apache for the webserver and MariaDB for a database server. We will create a web page using HTML and PHP which will also be used to connect to the database hosted on vvm07

    In Linux operating system, Apache, MariaDB, and PHP are jointly known as LAMP (Linux, Apache, MariaDB, and PHP).

Prerequisite:
  • Two Centos 7 install servers.
  • Yum configured.


Environment:

Hostname: vvm06
IP-Address: 192.168.2.200
Application: Web Servers.

Hostname: vvm07
IP-Address: 192.168.2.201
Application: Database Servers.

Part 1: Apache Web Server Installation on VVM06

Install Apache HTTP Server.

[root@vvm06 ~]# yum install httpd -y

Start the Apache service.

[root@vvm06 ~]# systemctl start httpd

Enable the Apache service (Start automatically on every reboot).

[root@vvm06 ~]# systemctl enable httpd

Check your Apache server status.

[root@vvm06 ~]# systemctl status httpd

Open Firewall ports permanently

[root@vvm06 ~]# firewall-cmd --permanent --zone=public --add-service=http
[root@vvm06 ~]# firewall-cmd --permanent --zone=public --add-service=https
[root@vvm06 ~]# firewall-cmd --permanent --zone=public --add-service=mysql

Reload the firewall service.

[root@vvm06 ~]# firewall-cmd --reload

List the port open

[root@vvm06 ~]# firewall-cmd --permanent --zone=public --list-services

We will test Apache web server. Open your web browser and navigate to http://192.168.2.201/

Part 2: MariaDB Database Installation, configuration and creation of database and tables on VVM07

To install MariaDB & MariaDB-server.

[root@vvm07 ~]# yum install mariadb mariadb-server -y

Start the MariaDB service .

[root@vvm07 ~]# systemctl start mariadb

Enable the mariadb service.(Start automatically on every reboot)

[root@vvm07 ~]# systemctl enable mariadb

Check your MariaDB status.

[root@vvm07 ~]# systemctl status mariadb

Setup MySQL root Password

By default, MariaDB does not set root user password. But to secure mariadb, we have to setup root user password. To set root user password, run the following command from your terminal and follow the instructions.

[root@vvm07 ~]# mysql_secure_installation
NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MySQL

NOTE: RUNNING ALL PARTS OF THIS SCRIPT IS RECOMMENDED FOR ALL MariaDB
SERVERS IN PRODUCTION USE! PLEASE READ EACH STEP CAREFULLY!

In order to log into MariaDB to secure it, we'll need the current
password for the root user. If you've just installed MariaDB, and
you haven't set the root password yet, the password will be blank,
so you should just press enter here.

Enter current password for root (enter for none):Enter
OK, successfully used password, moving on...

Setting the root password ensures that nobody can log into the MariaDB
root user without the proper authorisation.

Set root password? [Y/n]
New password: redhat
Re-enter new password: redhat
Password updated successfully!
Reloading privilege tables..
... Success!

By default, a MariaDB installation has an anonymous user, allowing anyone
to log into MariaDB without having to have a user account created for
them. This is intended only for testing, and to make the installation
go a bit smoother. You should remove them before moving into a
production environment.

Remove anonymous users? [Y/n] Y
... Success!

Normally, root should only be allowed to connect from 'localhost'. This
ensures that someone cannot guess at the root password from the network.

Disallow root login remotely? [Y/n] n        #---> Allow root user to access DB
... skipping.

By default, MariaDB comes with a database named 'test' that anyone can
access. This is also intended only for testing, and should be removed
before moving into a production environment.

Remove test database and access to it? [Y/n] Y
- Dropping test database...
... Success!
- Removing privileges on test database...
... Success!

Reloading the privilege tables will ensure that all changes made so far
will take effect immediately.

Reload privilege tables now? [Y/n] Y
... Success!

Cleaning up...

All done! If you've completed all of the above steps, your MariaDB
installation should now be secure.
Thanks for using MariaDB!

[root@vvm07 ~]#

Login to MariaDB on VVM07 using mysql

[root@vvm07 ~]# mysql -u root -p

Create Database name database123

MariaDB [(none)]> CREATE DATABASE database123;

Check the database123

MariaDB [(none)]> SHOW DATABASES;

Login to database

MariaDB [(none)]> USE database123;

Create Table name entry_details.

MariaDB [database123]>
CREATE TABLE entry_details (first_name VARCHAR(100) NOT NULL, last_name VARCHAR(100) NOT NULL, gender VARCHAR(100) NOT NULL, email VARCHAR(100) NOT NULL, mobile BIGINT(100) NOT NULL);

Check the table.

MariaDB [database123]> SHOW TABLES;

Verify the parameters.

MariaDB [database123]> desc entry_details ;

Check the User created for access database.

MariaDB [database123]> SELECT host FROM mysql.user ;

Give permission to root user of vvm06 to access the database.(IDENTIFIED BY 'password')

MariaDB [database123]> GRANT ALL ON database123.* to 'root'@'vvm06' IDENTIFIED BY 'redhat';

Check the User created for access database.

MariaDB [database123]> SELECT host FROM mysql.user ;

Part 3: PHP Installation on VVM06

Install php and php-mysql packages.

[root@vvm06 ~]# yum install php php-mysql -y

To test PHP installation, we will create a simple php file (testphp.php) in Apache document root folder (by default /var/www/html).

[root@vvm06 ~]# vi /var/www/html/testphp.php
<?php
phpinfo();
?>

Now restart httpd service.

[root@vvm06 ~]# systemctl restart httpd

Now open the phptest.php file in your browser following the http://192.168.2.201/testphp.php. It will display all the details about php such as version, build date and commands etc.

Part 4: Create Web page on VVM06

Create web page sample_register.html to get user information. 

[root@vvm06 html]# cat sample_register.html
<html>
<head>
<title>
A Sample Tutorial for database connection.
</title>
</head>
<body bgcolor="#32e692">
<div align="center">
<h1>Details Entry Form</h1>
</div>
<form action="details_entry.php" method="post">
<table border="1" align="center">
<tr>
<td>
<label>Enter First Name</label></td>
<td><input type="text" name="first_name"></td>
</tr>
<tr>
<td>
<label>Enter Last Name</label></td>
<td><input type="text" name="last_name"></td>
</tr>
<tr>
<td>
<label>Gender</label></td>
<td><input type="radio" name="gender" value="male">Male
<input type="radio" name="gender" value="female">Female< /td>
</tr>
<tr>
<td>
<label>Enter Email</label></td>
<td><input type="email" name="email"></td>
</tr>
<tr>
<td>
<label>Enter Phone</label></td>
<td><input type="phone" name="phone"></td>
</tr>
<tr>
<td colspan="2" align="center" ><input type="submit" name="save" value="Submit" style="font-size:20px"></td>
</tr>
</table>
</form>
</body>
</html>
[root@vvm06 html]#

Create details_entry.php will update the user information into database.

[root@vvm06 html]# cat details_entry.php
//Full Code of php file for mySql database connection with html form
<?php
$server_name="vvm07";
$username="root";
$password="redhat";
$database_name="database123";

$conn=mysqli_connect($server_name,$username,$password,$database_name);
//now check the connection
if(!$conn)
{
die("Connection Failed:" . mysqli_connect_error());

}

if(isset($_POST['save']))
{
$first_name = $_POST['first_name'];
$last_name = $_POST['last_name'];
$gender = $_POST['gender'];
$email = $_POST['email'];
$phone = $_POST['phone'];

$sql_query = "INSERT INTO entry_details (first_name,last_name,gender,email,mobile)
VALUES ('$first_name','$last_name','$gender','$email','$phone')";

if (mysqli_query($conn, $sql_query))
{
echo "New Details Entry inserted successfully !";
}
else
{
echo "Error: " . $sql . "" . mysqli_error($conn);
}
mysqli_close($conn);
}
?>
<html>
<body>
<a href="http://192.168.2.201/sample_register.html">Back</a>
</body>
</html>
[root@vvm06 html]#

Part 5: Verify the data in table on VVM07

Login to MariaDB on VVM07

[root@vvm07 ~]# mysql -u root -p

MariaDB [(none)]> SHOW DATABASES;

Login to database123

MariaDB [(none)]> USE database123;

Check the details of tables.

MariaDB [database123]> select * from entry_details ;



Troubleshooting Steps for Network Connectivity between Web Server and Database Server
MySQL Installation on Web Server:
Install the MySQL client package on the web server (vvm06) to enable database connections

[root@vvm06 ~]#  yum install mysql 

Connectivity Test:
Attempt to connect to the MySQL database server (vvm07) from the web server (vvm06) using the MySQL client.

[root@vvm06 ~]# mysql -u -h vvm07 root -p

You will be prompted to enter the MySQL root password. Provide the correct password and verify if the connection is successful.

Check MySQL Error Logs:
If the connection fails, check the MySQL error logs on the database server (vvm07) for any relevant error messages that might indicate the cause of the connectivity issue.

[root@vvm07 ~]# tail -f /var/log/mysql/error.log

Firewall Configuration:
Ensure that the necessary firewall rules are configured to allow MySQL traffic between the web server and the database server. Open port 3306 if it's closed.

[root@vvm06 ~]# firewall-cmd --zone=public --add-port=3306/tcp --permanent
[root@vvm06 ~]#  firewall-cmd --reload

If you're encountering SELinux denials related to `httpd_t` trying to connect to `mysqld_port_t`, you may need to create a custom SELinux policy module to allow this access. Here's how you can generate and apply a custom policy module to permit this connection:

1. Installation the below package 

 [root@vvm06 ~]  yum install policycoreutils-python-2.5-33.el7.x86_64

2. Identify SELinux Denial:
 Ensure that you've correctly identified the SELinux denial in your system logs. You can use the `grep` command to filter the audit log for relevant denials.
 [root@vvm06 ~] grep AVC /var/log/audit/audit.log | grep httpd_t | grep mysqld_port_t
3. Generate Custom SELinux Policy Module:
 Use the `audit2allow` command to generate a custom SELinux policy module based on the denial.
 [root@vvm06 ~] grep AVC /var/log/audit/audit.log | grep httpd_t | grep mysqld_port_t | audit2allow -M myhttpdmysqlmodule
4. Load Custom SELinux Policy Module:
 Use the `semodule` command to load the custom policy module into the SELinux policy store.
 [root@vvm06 ~] semodule -i myhttpdmysqlmodule.pp
5. Verify SELinux Policy:
 Verify that the custom SELinux policy module is loaded and applied correctly.
 [root@vvm06 ~] semodule -l | grep myhttpdmysqlmodule
6. Test Connection:
 Test the PHP script again to verify that it can now connect to MySQL without encountering SELinux denials.
7. Monitor SELinux Logs:
 Continuously monitor SELinux audit logs (`/var/log/audit/audit.log`) for any new denials related to PHP-MySQL connections. Address any new denials as necessary by repeating the process.



No comments:

Post a Comment