DocumentationCommerceInstallation Guide

On-premises installation security

Last update: Tue Nov 14 2023 00:00:00 GMT+0000 (Coordinated Universal Time)

CREATED FOR:

  • Experienced
  • Admin
  • Developer

Security Enhanced Linux (SELinux) enables CentOS and Ubuntu administrators greater access control over their servers. If you are using SELinux and Apache must initiate a connection to another host, you must run the commands discussed in this section.

NOTE
Adobe has no recommendation about using SELinux; you can use it for enhanced security if you want. If you use SELinux, you must configure it properly or the Adobe Commerce and Magento Open Source can function unpredictably. If you choose to use SELinux, consult a resource like the CentOS wiki to set up rules to enable communication.

Suggestion for installing with Apache

If you choose to enable SELinux, you might have issues running the installer unless you change the security context of some directories as follows:

chcon -R --type httpd_sys_rw_content_t <magento_root>/app/etc

chcon -R --type httpd_sys_rw_content_t <magento_root>/var

chcon -R --type httpd_sys_rw_content_t <magento_root>/pub/media

chcon -R --type httpd_sys_rw_content_t <magento_root>/pub/static

chcon -R --type httpd_sys_rw_content_t <magento_root>/generated

The preceding commands work only with the Apache web server. Because of the variety of configurations and security requirements, we do not guarantee these commands work in all situations. For more information, see:

Enable inter-server communication

If Apache and the database server are on the same host, use the following command if you plan to use integrations that use curl (ex. Paypal and USPS).
To enable Apache to initiate a connection to another host with SELinux enabled:

  1. To determine if SELinux is enabled, use the following command:

    code language-bash 
    getenforce

    Enforcing displays to confirm that SELinux is running.

    • CentOS: setsebool -P httpd_can_network_connect=1
    • Ubuntu: setsebool -P apache2_can_network_connect=1

Opening ports in your firewall

Depending on your security requirements, you might find it necessary to open port 80 and other ports in your firewall. Because of the sensitive nature of networking security, Adobe strongly recommends that you consult with your IT department before proceeding. Following are some suggested references:

recommendation-more-help
0f8e7db5-0e9c-4002-a5b8-a0088077d995