====Reverse Proxy using Apache on CentOS 8====

This will install a Apache on CentOS 8 and use virtual hosts for reverse proxying. It includes fail2ban, SSH security, letsencrypt and auto updates.

Install CentOS 8 minimal with 2 CPU, 512MB+ RAM, 10GB+ storage, set FQDN, set static IP, enable NTP.

3.) After install if finished reboot -> login -> perform a "dnf update".

==Create limited user account and add to wheel group for sudo==
<code>
useradd example_user && passwd example_user
usermod -aG wheel example_user
</code>

==Install dependencies and vim==
<code>
dnf install unzip wget vim
</code>

Logout of root and login using sudo user

==Disallow root login over SSH==
<code>
sudo vim /etc/ssh/sshd_config
</code>
then set
<code>
PermitRootLogin no
</code>

==Generate SSH key for sudo user on client computer (not the webserver)==
To help keep things organized we'll create a keypair that is specific to the user and the remote sudo user+host. \\
https://www.ssh.com/ssh/keygen/

<code>
ssh-keygen -C "your_email@example.com" -f ~/.ssh/your_email@example.com-remote_sudo_username_@remote_hostname -t ed25519
</code>

Record the private and public keys in a secure document for the webserver. \\
Copy the public key to the remote webserver. \\

<code>
ssh-copy-id -i ~/.ssh/your_email@example.com-remote_sudo_username_@remote_hostname.pub sudo_username@remote_hostname
</code>

<code>
sudo vim /etc/ssh/sshd_config
</code>
then set
<code>
PasswordAuthentication no
</code>

Restart sshd
<code>
sudo systemctl restart sshd
</code>

Login using SSH key
<code>
ssh -i deployment_key.txt demo@192.237.248.66
</code>

https://www.tecmint.com/install-lamp-on-centos-8/
https://linuxize.com/post/how-to-install-php-on-centos-8/
https://www.linode.com/docs/web-servers/lamp/how-to-install-a-lamp-stack-on-centos-8/
https://www.linode.com/docs/web-servers/apache/how-to-install-and-configure-fastcgi-and-php-fpm-on-centos-8/
https://www.digitalocean.com/community/tutorials/how-to-run-multiple-php-versions-on-one-server-using-apache-and-php-fpm-on-ubuntu-18-04
https://certbot.eff.org/lets-encrypt/centosrhel8-apache.html

====Install Apache====
==Configure hosts==
<code>
sudo vim /etc/hosts
</code>
Add a line for your FQDN
<code>
127.0.0.1   localhost localhost.localdomain localhost4 localhost4.localdomain4
::1         localhost localhost.localdomain localhost6 localhost6.localdomain6
192.168.10.30  websrv01.domainname.com websrv01
</code>

<code>
sudo dnf install httpd httpd-tools mod_ssl
sudo systemctl enable httpd
sudo systemctl start httpd
sudo firewall-cmd --permanent --zone=public --add-service=http
sudo firewall-cmd --permanent --zone=public --add-service=https
sudo firewall-cmd --reload
</code>

====Create Virtual Hosts====
https://www.gonscak.sk/?p=401 \\
https://ip-life.net/configuring-an-apache-reverse-proxy-for-multiple-domains/ \\
https://stackoverflow.com/questions/25107654/how-to-configure-apache-server-to-talk-to-https-backend-server \\
Create a virtual host for each web domain that is going to sit behind this proxy.

==Setup virtual host config files==
<code>
sudo vim /etc/httpd/conf.d/site1.your_domain.conf
</code>
Add the following content.
<code>
<VirtualHost *:80>
    ServerName subdomain.domain.com
    SSLProxyEngine On
    ProxyPreserveHost On
    ProxyPass / http://subdomain.domain.com/
    ProxyPassReverse / http://subdomain.domain.com/
</VirtualHost>
</code>

If you're back end servers have SSL/TLS setup already then change http to https. Make sure your proxy server trusts the SSL/TLS certificates.

Save and close the file when you are finished. Then check the Apache configuration file for any syntax errors:
<code>
sudo httpd -t
</code>
You’ll see the following output:
<code>
Output
Syntax OK
</code>

==Disable Exposing Apache Server Info==
https://www.if-not-true-then-false.com/2009/howto-hide-and-modify-apache-server-information-serversignature-and-servertokens-and-hide-php-version-x-powered-by/ \\
This will help to prevent being the target of a an attack if you're running an out of date or vunerable release
<code>
sudo vim /etc/httpd/httpd.conf
</code>
Add the following:
<code>
ServerSignature Off
ServerTokens Prod
</code>

Finally, restart the Apache service to implement your changes:
<code>
sudo systemctl restart httpd
</code>

delete the welconf.conf to disable the default apache welcome page.
<code>
sudo rm /etc/httpd/conf.d/welcome.conf
</code>

==Remove Default Access from httpd.conf==
This is important as it would allow access to the /var/www/html path via HTTP.
<code>
sudo vim /etc/httpd/conf/httpd.conf
</code>
Comment out the following:
<code>
DocumentRoot "/var/www/html"

<Directory "/var/www">
    AllowOverride None
    # Allow open access:
    Require all granted
</Directory>

<Directory "/var/www/html">
Options Indexes FollowSymLinks
AllowOverride None
AllowOverride None
</Directory>

<Directory "/var/www/cgi-bin">
    AllowOverride None
    Options None
    Require all granted
</Directory>
</code>
Enable HTTPD to access network (SELinux)
<code>
sudo setsebool -P httpd_can_network_connect on
</code>
Restart Apache
<code>
sudo systemctl restart httpd
</code>

====Target Host Modification====
https://stackoverflow.com/questions/760283/apache-proxypass-how-to-preserve-original-ip-address/30784225#30784225 \\
In the logs on the target web server it will show the IP of the proxy server making the request, not the IP of the original client. To fix this you need to add a setting to Apache on the TARGET WEB SERVERS, not the proxy server.

On CentOS 7 and 8 the remote_ip module is loaded by default. You'll need to add the option to httpd.conf
<code>
sudo vim /etc/httpd/conf/httpd.conf
</code>
Add the following:
<code>
RemoteIPHeader X-Forwarded-For
</code>
Restart Apache
<code>
sudo systemctl restart httpd
</code>
Now the IP of the original client should show up in the application logs.

====Letsencrypt====

==Install certbot==
<code>
wget https://dl.eff.org/certbot-auto
sudo mv certbot-auto /usr/local/bin/certbot-auto
sudo chown root /usr/local/bin/certbot-auto
sudo chmod 0755 /usr/local/bin/certbot-auto
</code>

Generate local certificates
<code>
sudo /usr/libexec/httpd-ssl-gencerts
</code>

Request and install certificates for virtual hosts
<code>
sudo /usr/local/bin/certbot-auto --apache
</code>
When prompted enabled Redirect so all requests go over https

Enable autorenew via crontab
<code>
echo "0 0,12 * * * root python3 -c 'import random; import time; time.sleep(random.random() * 3600)' && /usr/local/bin/certbot-auto renew -q" | sudo tee -a /etc/crontab > /dev/null
</code>

====OR... Certificate manually via CA====
Enable SSL Apache

https://www.thesslstore.com/knowledgebase/ssl-generate/generate-csr-apache-web-server-using-openssl-v-2/
https://forums.centos.org/viewtopic.php?t=43230
https://www.getpagespeed.com/server-setup/ssl-directory

Install Mod SSL
<code>
sudo dnf install mod_ssl
</code>

==Create Private Key and CSR==
<code>
openssl req -new -newkey rsa:4096 -nodes -keyout clientdata.haddentech.com.key -out clientdata.haddentech.com.csr
</code>

Move the files to your PKI folder
<code>
sudo mv clientdata.haddentech.com.* /etc/pki/tls/private/
</code>

Set permissions on private key
<code>
sudo chown root:root /etc/pki/tls/private/clientdata.haddentech.com.key
sudo chmod 600 /etc/pki/tls/private/clientdata.haddentech.com.key
sudo restorecon -RvF /etc/pki/tls/private/
</code>

Submit the CSR to your CA (public or private)

Copy the BASE64 certificate from your CA to your cert folder
<code>
sudo vim /etc/pki/tls/certs/clientdata.haddentech.com.crt
</code>

Create the CA bundle associated with your certificate
<code>
vim /etc/pki/tls/certs/clientdata.haddentech.com.ca-bundle
</code>

Paste the subordinate followed by the root BASE64 certificates

Edit the conf file for you website and change
<code>
<VirtualHost *:443>
    ServerName clientdata.haddentech.com
        SSLEngine on
        SSLCertificateFile /etc/pki/tls/certs/clientdata.haddentech.com.crt
        SSLCertificateKeyFile /etc/pki/tls/private/clientdata.haddentech.com.key
        SSLCertificateChainFile /etc/pki/tls/certs/clientdata.haddentech.com.ca-bundle
        ....
        ....
        ....
    </VirtualHost>
</code>

Restart Apache
<code>
sudo systemctl restart httpd
</code>

Note: if you are using your own internal CA you'll need to import the root and any intermediate certificates into your browsers/etc.

====Automatic Updates for CentOS====

https://www.tecmint.com/dnf-automatic-install-security-updates-automatically-in-centos-8/
<code>
sudo dnf install dnf-automatic
sudo vim /etc/dnf/automatic.conf
</code>

Set:
<code>
upgrade_type = security
download_updates = yes
system_name = (your system name)
emit_via = motd
</code>

Enable the auto-update timer
<code>
sudo systemctl enable --now dnf-automatic.timer
</code>

====fail2ban====

https://idroot.us/install-fail2ban-centos-8/
https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04
<code>
sudo dnf install fail2ban
</code>

==Create a Jail for SSHd==
<code>sudo vim /etc/fail2ban/jail.d/sshd.local</code>
Add the following:
<code>
[sshd]
enabled = true
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

[selinux-ssh]
enabled  = true
port     = ssh
logpath  = %(auditd_log)s
</code>

==Create a Jail for Apache==
<code>sudo vim /etc/fail2ban/jail.d/apache.local</code>
Add the following:
<code>
[apache-auth]
enabled  = true
port     = http,https
logpath  = %(apache_error_log)s

[apache-badbots]
enabled  = true
port     = http,https
logpath  = %(apache_access_log)s
bantime  = 48h
maxretry = 1

[apache-noscript]
enabled  = true
port     = http,https
logpath  = %(apache_error_log)s

[apache-overflows]
enabled  = true
port     = http,https
logpath  = %(apache_error_log)s
maxretry = 2

[apache-nohome]
enabled  = true
port     = http,https
logpath  = %(apache_error_log)s
maxretry = 2

[apache-botsearch]
enabled  = true
port     = http,https
logpath  = %(apache_error_log)s
maxretry = 2

[apache-fakegooglebot]
enabled  = true
port     = http,https
logpath  = %(apache_access_log)s
maxretry = 1
ignorecommand = %(ignorecommands_dir)s/apache-fakegooglebot <ip>

[apache-modsecurity]
enabled  = true
port     = http,https
logpath  = %(apache_error_log)s
maxretry = 2

[apache-shellshock]
enabled = true
port    = http,https
logpath = %(apache_error_log)s
maxretry = 1
</code>

<code>
sudo systemctl start fail2ban
sudo systemctl enable fail2ban
sudo fail2ban-client status sshd
</code>