How Do You Secure A Website Hosted On CentOS So On A Windows Domain

[Fazza]

I've have a CentOS server hosting an internal only website that I want to restrict access to so that only members of the Staff OU in Active Directory can access it.

 

I'm going to guess that I need to somehow join or link this server to our windows domain by installing something and then I'll need to do some jiggery-pokery with some files somewhere so that only users that are a member of the Staff OU can access it?

 

I've been using Linux (CentOS 7) for a total of 5 days now, mostly of which has been reinstalling it over and over again correcting previous mistakes and copying and pasting commands from installation guides in to a command line! I'm on a very sharp learning curve at the moment!

 

[computer_expert]

I know this is for Debian based distros (which centos isn't) but the process is similar assuming you are using apache rather than nginx. You'll need to find out what the package manager on centos is called (yum?) and replace the 'apt-get install' steps with the centos equivalent.

 

Following the guide below should enable SSO too

https://active-directory-wp.com/docs/Networking/Single_Sign_On/Kerberos_SSO_with_Apache_on_Linux.html

[cpjitservices]

CentOS... Love CentOS!

 

Boing..... here ya go:

 

https://www.rootusers.com/how-to-join-centos-linux-to-an-active-directory-domain/

[Marci]

Or add mod_rewrite and mod_authnz_ldap to apache, and just knock up a .htaccess dropped into web root defining the AD usergroups / OUs allowed access... no need to add the server itself to AD at the OS level (as that will then usually grant each user SSH / FTP logon rights as well depending how you've got the server set up, which the majority of web hosts wouldn't want).

 

First lump forces https, second lump handles ldap auth.

 

    
RewriteEngine On    
RewriteCond %{SERVER_PORT} 80    
RewriteRule ^(.*)$ https://%{SERVER_HOST}/$1 [R,L]    
RewriteCond %{HTTP_HOST} ^[^.]+\.[^.]+$    
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}/$1 [L,R=301]

    
AuthType Basic    
AuthBasicProvider ldap    
AuthName "Staff"    
AuthLDAPURL "ldap://domain.controller:389/OU=Staff,OU=School Users,DC=school,DC=co,DC=uk?sAMAccountName?sub?(objectClass=user)" NONE    
AuthLDAPBindDN "DOMAIN\binduser"    
AuthLDAPBindPassword "bindpass"    
Require valid-user

 

Ideally you want to be using an ldaps:// URI on whatever port it's running on on your DC. Bind user needs to have read-only access to AD.

 

You can also skip ALL of the above, recompile php --with-ldap and just integrate ADLDAP into your website: https://github.com/adldap/adLDAP

 

Or if you're using Azure / Office365, you can secure it using any of the MS Graph SDKs...

- Javascript: microsoftgraph/msgraph-sdk-javascript

- PHP: microsoftgraph/msgraph-sdk-php

 

 

And if it's a frameworked website then you can usually just install a plugin that handles it all:

eg - wordpress: https://en-gb.wordpress.org/plugins/next-active-directory-integration/

- codeigniter: https://github.com/kathmann/Auth_AD

 

 

Lots of options that don't require joining the server itself to AD.

Edited December 15, 2017 by Marci