The /var/www directory is hardcoded

[Matthew]

Hello,

As part of a system hardening (CIS) project, I've partitioned the system and I want to prioritize the /opt/www directory instead of /var/www.

The wapt configuration allows me to modify the various paths (wapt_folder, waptwua_folder, etc.).

However, I've discovered two bugs:

The first is in the postconf script in /opt/wapt/waptserver/scripts/postconf.py; /var/www is hardcoded (it's used to generate the nginx template).
The second is in the wapttaks service, which downloads WUA updates from /opt/wapt/waptserver/wsus_tasks.py; /opt/www/waptwua is also hardcoded.

Is it possible to use the variables in /opt/wapt/conf/waptserver.ini?

Thank you!

Have a good day.

WAPT Enterprise 2.7.0.19598
Debian 13 CIS Server

[sfonteneau]

Hello

, even though the folders are configurable in waptserver.ini (wapt_folder, waptwua_folder),

we don't really support changing the /var/www path.

Postinstall RPM and deb scripts also have hardcoded /var/www paths.

The simplest solution in your case is to mount an fstab file or create a symbolic link to the /opt/www folder

. I'll look into mentioning this more clearly in the documentation.

The paths in waptserver.ini:

waptwua_folder, wads_folder, wapt_folder

are primarily intended for developers.

[Matthew]

Hello,

Okay, thank you for your feedback.

These are minor changes; why force the use of /var/www?

Personally, I manage with two simple sed commands right after the server update, and that's all there is to it.

[sfonteneau]

Technically, we could

But for example:

Code: Select all

run('mkdir -p /var/www/wapt/icons')
run('mkdir -p /var/www/wapt-host')
run('mkdir -p /var/www/wapt')
run('mkdir -p /var/www/wapt/conf.d')
run('mkdir -p /var/www/waptwua')
run('mkdir -p /var/www/wads/pxe')
run('mkdir -p /var/www/wads/winpe/x64')
run('mkdir -p /var/www/wads/winpe/arm64')
run('mkdir -p /var/www/wads/winpe/x86')
run('mkdir -p /var/www/wads/drivers/conf')
run('mkdir -p /var/www/wads/drivers/files')
shutil.copyfile('/opt/wapt/wads/wads32.exe','/var/www/wads/wads32.exe')
shutil.copyfile('/opt/wapt/wads/wads64.exe','/var/www/wads/wads64.exe')
shutil.copyfile('/opt/wapt/wads/pxe/undionly.kpxe','/var/www/wads/pxe/undionly.kpxe')
shutil.copyfile('/opt/wapt/wads/pxe/ipxe.efi','/var/www/wads/pxe/ipxe.efi')
shutil.copyfile('/opt/wapt/wads/pxe/snponly.efi','/var/www/wads/pxe/snponly.efi')
shutil.copytree("/opt/wapt/wads/pxe/ipxe_sb", '/var/www/wads/pxe/ipxe_sb',dirs_exist_ok=True)
shutil.copyfile('/opt/wapt/wads/pxe/wimboot','/var/www/wads/winpe/x64/wimboot')
shutil.copyfile('/opt/wapt/wads/pxe/wimboot.i386','/var/www/wads/winpe/x86/wimboot')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_legacy.ipxe','/var/www/wads/winpe/x64/runinstall_legacy.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_uefi.ipxe','/var/www/wads/winpe/x64/runinstall_uefi.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_legacy.ipxe','/var/www/wads/winpe/x86/runinstall_legacy.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_uefi.ipxe','/var/www/wads/winpe/x86/runinstall_uefi.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_legacy.ipxe','/var/www/wads/winpe/arm64/runinstall_legacy.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_uefi.ipxe','/var/www/wads/winpe/arm64/runinstall_uefi.ipxe')
run('chown -R wapt /var/www/wads')
run('chown wapt:www-data -R /var/www/wapt*')

It's in the Debian postinst directory, so it should be moved to the postconf directory

For example, you need to manage the reapplication of SELinux permissions

We'll see if we do it

[dcardon]

Hi Matthieu,

as Simon mentioned, changing directories can cause problems in many other places.

Could you point me to the CIS rule that might be requiring this directory move? If there is indeed a relevant rule, we can look into it further.

Best regards,

Denis

[Matthew]

Hello,

Hardening requires partitioning the system and therefore involves choosing sizes for the different partitions.
So, in my case, I decided that /opt was the final partition, which is the largest and easiest to enlarge if needed.

It's not "mandatory," I could have made an exception for the Wapt VM and put /var at the end, but I want to standardize the partitioning across all VMs.

Sincerely,
Matthieu