7. Apache and Nginx: Install and Understand
7.7 Everyday Management Commands and SELinux Basics
| Task | Nginx | Apache (AL2023/CentOS) | Apache (Ubuntu) |
|---|---|---|---|
| Test config | sudo nginx -t |
sudo apachectl configtest |
sudo apache2ctl configtest |
| Reload (no downtime) | sudo service nginx reload |
sudo service httpd reload |
sudo service apache2 reload |
| Restart | sudo service nginx restart |
sudo service httpd restart |
sudo service apache2 restart |
| Error log | sudo tail -f /var/log/nginx/error.log |
sudo tail -f /var/log/httpd/error_log |
sudo tail -f /var/log/apache2/error.log |
| Access log | /var/log/nginx/access.log |
/var/log/httpd/access_log |
/var/log/apache2/access.log |
| Version | nginx -v |
httpd -v |
apache2 -v |
| Loaded modules | nginx -V |
httpd -M |
apache2ctl -M |
Always test before reload
Use sudo nginx -t && sudo service nginx reload. The reload runs only if the test passes, so a typo never takes your site down.
SELinux (on CentOS/RHEL and optional on Amazon Linux): SELinux (सुरक्षा-वर्धित लिनक्स नियंत्रण) labels every file and process. A web server may only read files labelled httpd_sys_content_t. Amazon Linux 2023 ships SELinux in permissive mode by default (it logs but does not block); CentOS/RHEL run it enforcing.
getenforce # Enforcing / Permissive / Disabled
ls -Z /usr/share/nginx/html /var/www/html # view SELinux labels
sudo restorecon -Rv /var/www/html # fix labels after copying/moving files
sudo setsebool -P httpd_can_network_connect 1 # allow reverse proxy to apps (Node/Flask)
sudo setsebool -P httpd_can_network_connect_db 1 # allow web server/PHP to reach a remote DB
sudo ausearch -m avc -ts recent # see recent SELinux denials (package audit)
Do not simply disable SELinux
Turning SELinux off (setenforce 0) "fixes" 403/502 errors but removes an important security layer. Fix the label or boolean instead. Temporarily using sudo setenforce 0 only to confirm that SELinux is the cause is fine — then set it back with sudo setenforce 1.
Why this matters for security
SELinux is mandatory access control (अनिवार्य प्रवेश नियंत्रण): even if an attacker takes over the web server process, SELinux limits which files and ports it can touch. Disabling it to "fix" an error throws away a real defence layer.
Ravindra Bagale's Tip
Many students don't know the difference between restart and reload. reload re-reads the config without dropping connections – use this for a live site. And always chain it with &&, like sudo nginx -t && sudo service nginx reload – if the test fails, the reload doesn't happen.
Ravindra Bagale's Tip – मराठी
restart आणि reload मधला फरक बऱ्याच students ना माहीत नसतो. reload connections न तोडता config पुन्हा वाचतो – live site साठी हेच वापरा. आणि नेहमी sudo nginx -t && sudo service nginx reload असं && सोबत – test fail झाला तर reload होतच नाही.
Ravindra Bagale's Tip – हिंदी
restart और reload का फ़र्क बहुत से students को नहीं पता होता. reload connections तोड़े बिना config दोबारा पढ़ता है – live site के लिए यही इस्तेमाल करो. और हमेशा sudo nginx -t && sudo service nginx reload जैसा && के साथ – test fail हुआ तो reload होगा ही नहीं.
Practice task
On your server, run getenforce, view labels with ls -Z /var/www/html, then follow the Nginx error log with tail -f while you request a missing page with curl.
Thodkyaat sangaycha tar
- Nginx: event-driven, great for static files and reverse proxy. Apache: modules,
.htaccess, easy for PHP apps. - Amazon Linux:
httpd,/etc/httpd/, Nginx root/usr/share/nginx/html. Ubuntu:apache2,/etc/apache2/, root/var/www/html. - Start with
sudo service <name> start, boot withsudo systemctl enable <name>. - Always
sudo nginx -t/sudo apachectl configtestbeforereload. - Nginx:
listen,server_name,root,index,location. Apache:VirtualHost,ServerName,DocumentRoot,<Directory>. - SELinux labels protect files; fix labels, don't disable it.
Samjla ka? Nasel tar config block punha vacha – pratyek line cha arth sangta aala pahije. Aata pudhe jaauya aapli pahili website host karayla.