Linux：SElinux導致網站無法訪問

通過更改SElinux狀態可以判斷出，當SElinux處于關閉狀態時，網站內容訪問正常。
[root@master1-192-168-117-18 ~]# setenforce 0
[root@master1-192-168-117-18 ~]# getenforce
Permissive
[root@master1-192-168-117-18 ~]# setenforce 1
[root@master1-192-168-117-18 ~]# getenforce 0
Enforcing

查看網站的主目錄的SElinux安全上下文值：
[root@master1-192-168-117-18 ~]# ls -Zd /var/www/html/
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /var/www/html/
[root@master1-192-168-117-18 ~]# ls -Zd /home/wwwroot/
drwxr-xr-x. root root system_u:object_r:user_home_dir_t:s0 /home/wwwroot/

將新添加的主目錄SElinux上下文值與系統默認主目錄保持一致：
[root@master1-192-168-117-18 ~]# semanage fcontext -a -t httpd_sys_content_t /home/wwwroot/*

注意，執行上述設置之后，還無法立即訪問網站，還需要使用restorecon命令將設置好的SELinux安全上下文立即生效。在使用restorecon命令時，可以加上-Rv參數對指定的目錄進行遞歸操作，以及顯示SELinux安全上下文的修改過程。

[root@master1-192-168-117-18 ~]# restorecon -Rv /home/wwwroot/
restorecon reset /home/wwwroot context system_u:object_r:user_home_dir_t:s0->system_u:object_r:httpd_sys_content_t:s0
restorecon reset /home/wwwroot/index.html context system_u:object_r:user_home_t:s0->system_u:object_r:httpd_sys_content_t:s0
[root@master1-192-168-117-18 ~]# ls -Zd /home/wwwroot/
drwxr-xr-x. root root system_u:object_r:httpd_sys_content_t:s0 /home/wwwroot/
[root@master1-192-168-117-18 ~]# ^C

個人用戶主頁功能

第1步：在httpd服務程序中，默認沒有開啟個人用戶主頁功能。為此，我們需要編輯下面的配置文件，然后在第17行的UserDir disabled參數前面加上井號（#），表示讓httpd服務程序開啟個人用戶主頁功能；同時再把第24行的UserDir public_html參數前面的井號（#）去掉（UserDir參數表示網站數據在用戶家目錄中的保存目錄名稱，即public_html目錄）。最后，在修改完畢后記得保存。
[root@master1-192-168-117-18 ~]# vim /etc/httpd/conf.d/userdir.conf
1 #
2 # UserDir: The name of the directory that is appended onto a user's home
3 # directory if a ~user request is received.
4 #
5 # The path to the end user account 'public_html' directory must be
6 # accessible to the webserver userid. This usually means that ~userid
7 # must have permissions of 711, ~userid/public_html must have permissions
8 # of 755, and documents contained therein must be world-readable.
9 # Otherwise, the client will only receive a "403 Forbidden" message.
10 #
11 <IfModule mod_userdir.c>
12 #
13 # UserDir is disabled by default since it can confirm the presence
14 # of a username on the system (depending on home directory
15 # permissions).
16 #
17 # UserDir disabled
18
19 #
20 # To enable requests to /~user/ to serve the user's public_html
21 # directory, remove the "UserDir disabled" line above, and uncomment
22 # the following line instead:
23 #
24 UserDir public_html
25 </IfModule>
26
27 #
28 # Control access to UserDir directories. The following is an example
29 # for a site where these directories are restricted to read-only.
30 #
31 <Directory "/home/*/public_html">
32 AllowOverride FileInfo AuthConfig Limit Indexes
33 Options MultiViews Indexes SymLinksIfOwnerMatch IncludesNoExec
34 Require method GET POST OPTIONS
35 </Directory>

"/etc/httpd/conf.d/userdir.conf" 36L, 1254C 已寫入

第2步：在用戶家目錄中建立用于保存網站數據的目錄及首頁面文件。另外，還需要把家目錄的權限修改為755，保證其他人也有權限讀取里面的內容。
[aa@master1-192-168-117-18 ~]$ mkdir public_html
[aa@master1-192-168-117-18 ~]$ echo "世界那么大，我出去看看！" > public_html/index.html
[aa@master1-192-168-117-18 ~]$ chmod -Rf 755 /home/aa/

第3步：重新啟動httpd服務程序，在瀏覽器的地址欄中輸入網址，其格式為“網址/~用戶名”（其中的波浪號是必需的，而且網址、波浪號、用戶名之間沒有空格），從理論上來講就可以看到用戶的個人網站了。不出所料的是，系統顯示報錯頁面，如圖10-9所示。這一定還是SELinux惹的禍。

第4步：使用getsebool命令查詢并過濾出所有與HTTP協議相關的安全策略。其中，off為禁止狀態，on為允許狀態。
[root@master1-192-168-117-18 ~]# getsebool -a | grep http
httpd_anon_write --> off
httpd_builtin_scripting --> on
httpd_can_check_spam --> off
httpd_can_connect_ftp --> off
httpd_can_connect_ldap --> off
httpd_can_connect_mythtv --> off
httpd_can_connect_zabbix --> off
httpd_can_network_connect --> off
httpd_can_network_connect_cobbler --> off
httpd_can_network_connect_db --> off
httpd_can_network_memcache --> off
httpd_can_network_relay --> off
httpd_can_sendmail --> off
httpd_dbus_avahi --> off
httpd_dbus_sssd --> off
httpd_dontaudit_search_dirs --> off
httpd_enable_cgi --> on
httpd_enable_ftp_server --> off
httpd_enable_homedirs --> off
httpd_execmem --> off
httpd_graceful_shutdown --> on
httpd_manage_ipa --> off
httpd_mod_auth_ntlm_winbind --> off
httpd_mod_auth_pam --> off
httpd_read_user_content --> off
httpd_run_ipa --> off
httpd_run_preupgrade --> off
httpd_run_stickshift --> off
httpd_serve_cobbler_files --> off
httpd_setrlimit --> off
httpd_ssi_exec --> off
httpd_sys_script_anon_write --> off
httpd_tmp_exec --> off
httpd_tty_comm --> off
httpd_unified --> off
httpd_use_cifs --> off
httpd_use_fusefs --> off
httpd_use_gpg --> off
httpd_use_nfs --> off
httpd_use_openstack --> off
httpd_use_sasl --> off
httpd_verify_dns --> off
named_tcp_bind_http_port --> off
prosody_bind_http_port --> off

[root@master1-192-168-117-18 ~]# setsebool -P httpd_enable_homedirs=on

通過身份驗證訪問網頁

第1步：先使用htpasswd命令生成密碼數據庫。-c參數表示第一次生成；后面再分別添加密碼數據庫的存放文件，以及驗證要用到的用戶名稱（該用戶不必是系統中已有的本地賬戶）。
[root@master1-192-168-117-18 ~]# htpasswd -c /etc/httpd/passwd aa
New password:
Re-type new password:
Adding password for user aa
第2步：第2步：編輯個人用戶主頁功能的配置文件。隨后保存并退出配置文件，重啟httpd服務程序即可生效。
[root@master1-192-168-117-18 ~]# vim /etc/httpd/conf.d/userdir.conf

1 #
2 # UserDir: The name of the directory that is appended onto a user's home
3 # directory if a ~user request is received.
4 #
5 # The path to the end user account 'public_html' directory must be
6 # accessible to the webserver userid. This usually means that ~userid
7 # must have permissions of 711, ~userid/public_html must have permissions
8 # of 755, and documents contained therein must be world-readable.
9 # Otherwise, the client will only receive a "403 Forbidden" message.
10 #
11 <IfModule mod_userdir.c>
12 #
13 # UserDir is disabled by default since it can confirm the presence
14 # of a username on the system (depending on home directory
15 # permissions).
16 #
17 # UserDir disabled
18
19 #
20 # To enable requests to /~user/ to serve the user's public_html
21 # directory, remove the "UserDir disabled" line above, and uncomment
22 # the following line instead:
23 #
24 UserDir public_html
25 </IfModule>
26
27 #
28 # Control access to UserDir directories. The following is an example
29 # for a site where these directories are restricted to read-only.
30 #
31 <Directory "/home/*/public_html">
32 AllowOverride all
33 authuserfile "/etc/httpd/passwd"
34 authname "My privately website"
35 authtype basic
36 require user aa
37 </Directory>
38

"/etc/httpd/conf.d/userdir.conf" 38L, 1217C 已寫入