So come on then.
Let's go through and dive out to our command line,
take a look at installing the Apache web server and illustrating some of the
weaknesses that might lighten up our security on our systems.
So here we are then ready to begin our glorious journey on AlmaLinux 8.5.
We're going to begin by raising our privileges with sudo.
We'll talk about privilege escalation later on,
but we do need to install software as the root account.
Using YUM or DNF on Red Hat‑based systems such as AlmaLinux,
we can go ahead and install our software.
The package that we want for our Apache web server is httpd
when we're talking about this distribution.
We can go ahead then and see our packages installing.
It does just install the software.
It doesn't start the underlying service,
but these are always good things to check.
Are we actually listening now on our web server ports?
Are we going to leave it and just ignore it, or are we going to check it?
We're going to check it.
This is what we really must get in to our heads
when we're talking about security.
We don't rely on, oh no, it wouldn't have started it.
So let's go through and take a look at ss ‑ntl.
This then allows us to see our listening ports.
We're looking for port 80 or 443, and we can see,
well, at the moment then the service hasn't started.
So this is perhaps one good thing.
But we were talking about our file system permissions as well
and seeing that these might not be as tight as they could be
when talking about security.
So ls ‑ld, we can see then the permissions of a directory.
The web pages are stored in /var/www/html.
And looking at this, don't worry too much about the permissions at the moment,
but we've got read, write, and execute through to the root user.
The root group has read and execute, and then others,
everyone else has read and execute.
There's no mention of any of our web users or web groups here.
So they're reliant on gaining access by making use
of permissions granted to others, which is quite shameful really,
but something that we can easily secure and fix up.
The biggest shame are those people that just assume
everything is going to be okay.
Well okay, this is how it's set up then on our AlmaLinux system.
How is it configured on other systems?
Well, let's go through and take a look.
If I exit out of this connection, I'm going to return to my macOS system,
my host operating system.
Ctrl+L will clear my screen.
And then because I'm using Vagrant,
I can go through and use vagrant ssh and then the Ubuntu system.
This was all set up through a Vagrantfile,
and this Vagrantfile is available for you,
and it certainly is going to make your life a lot more easy
because you can mimic what we're using.
So you can see now that we've been able to quickly
connect through to our Ubuntu host.
And from this Ubuntu host, we can pretty much run exactly the same command,
so starting with sudo and apt.
The package manager we're talking about on
Debian‑based systems such as Ubuntu is apt,
advanced packaging tools.
We can go through and install ‑y.
Now also, we do need to be aware of some of these differences.
The package name is no longer httpd.
It's apache2.
But let's look at what happens when we try and install this.
I've just set this Vagrant virtual machine up,
and we can see then that we're having a problem trying to
connect through and download the packages.
I haven't updated the package cache.
So we can now see that we're working on Ubuntu systems.
We do have to do an apt update to ensure we've got a current
metadata relating to the packages to be installed.
So there's no problems with the previous command that I had run.
I just needed up to date metadata information.
So this is the importance of learning Linux,
not just one Linux distribution,
so we're not going to be caught out when these sorts of things happen.
Now as we run through the install here,
we might gain from some of our understanding,
seeing the systemd information on the screen,
that it's also setting up or starting our services.
This could be a bad thing.
We haven't looked at security at all yet.
If I go through and look at my open ports,
well look at this, It's listening on port 80 already.
Now it's never necessarily a bad thing or a good thing.
What's bad if we're not aware that the service had automatically
started when we're installing on Debian‑based systems.
But let's go through and check those same file system permissions.
The location is going to be the same, /var/www/html,
and we've got that same issue where the web server is reliant on gaining
access to its own web pages through others or as everyone.
So it's not very good, and we do need to be aware of this.
This is just something simple we're setting up for some very basic tests.
Well, maybe we don't need to be concerned about security.
But obviously, if we need to use this within our working environment,
then we probably need to be a little bit more cautious when working with the defaults.