Page 1 of 1
The /var/www directory is hardcoded
Published: October 21, 2026 - 10:03 AM
by Matthieu
Hello,
As part of a system hardening (CIS) project, I've partitioned the system and I want to prioritize the /opt/www directory instead of /var/www.
The wapt configuration allows me to modify the various paths (wapt_folder, waptwua_folder, etc.).
However, I've discovered two bugs:
The first is in the postconf script in /opt/wapt/waptserver/scripts/postconf.py; /var/www is hardcoded (it's used to generate the nginx template).
The second is in the wapttaks service, which downloads WUA updates from /opt/wapt/waptserver/wsus_tasks.py; /opt/www/waptwua is also hardcoded.
Is it possible to use the variables in /opt/wapt/conf/waptserver.ini?
Thank you!
Have a good day.
WAPT Enterprise 2.7.0.19598
Debian 13 CIS Server
Re: The /var/www directory is hardcoded
Published: October 21, 2026 - 10:44 AM
by sfonteneau
Hello
, even though the folders are configurable in waptserver.ini (wapt_folder, waptwua_folder),
we don't really support changing the /var/www path.
Postinstall RPM and deb scripts also have hardcoded /var/www paths.
The simplest solution in your case is to mount an fstab file or create a symbolic link to the /opt/www folder
. I'll look into mentioning this more clearly in the documentation.
The paths in waptserver.ini:
waptwua_folder, wads_folder, wapt_folder
are primarily intended for developers.
Re: The /var/www directory is hardcoded
Published: October 21, 2026 - 11:38 AM
by Matthieu
Hello,
Okay, thank you for your feedback.
These are minor changes; why force the use of /var/www?
Personally, I manage with two simple sed commands right after the server update, and that's all there is to it.
Re: The /var/www directory is hardcoded
Published: October 21, 2026 - 12:29
by sfonteneau
Technically, we could
But for example:
Code: Select all
run('mkdir -p /var/www/wapt/icons')
run('mkdir -p /var/www/wapt-host')
run('mkdir -p /var/www/wapt')
run('mkdir -p /var/www/wapt/conf.d')
run('mkdir -p /var/www/waptwua')
run('mkdir -p /var/www/wads/pxe')
run('mkdir -p /var/www/wads/winpe/x64')
run('mkdir -p /var/www/wads/winpe/arm64')
run('mkdir -p /var/www/wads/winpe/x86')
run('mkdir -p /var/www/wads/drivers/conf')
run('mkdir -p /var/www/wads/drivers/files')
shutil.copyfile('/opt/wapt/wads/wads32.exe','/var/www/wads/wads32.exe')
shutil.copyfile('/opt/wapt/wads/wads64.exe','/var/www/wads/wads64.exe')
shutil.copyfile('/opt/wapt/wads/pxe/undionly.kpxe','/var/www/wads/pxe/undionly.kpxe')
shutil.copyfile('/opt/wapt/wads/pxe/ipxe.efi','/var/www/wads/pxe/ipxe.efi')
shutil.copyfile('/opt/wapt/wads/pxe/snponly.efi','/var/www/wads/pxe/snponly.efi')
shutil.copytree("/opt/wapt/wads/pxe/ipxe_sb", '/var/www/wads/pxe/ipxe_sb',dirs_exist_ok=True)
shutil.copyfile('/opt/wapt/wads/pxe/wimboot','/var/www/wads/winpe/x64/wimboot')
shutil.copyfile('/opt/wapt/wads/pxe/wimboot.i386','/var/www/wads/winpe/x86/wimboot')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_legacy.ipxe','/var/www/wads/winpe/x64/runinstall_legacy.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_uefi.ipxe','/var/www/wads/winpe/x64/runinstall_uefi.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_legacy.ipxe','/var/www/wads/winpe/x86/runinstall_legacy.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_uefi.ipxe','/var/www/wads/winpe/x86/runinstall_uefi.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_legacy.ipxe','/var/www/wads/winpe/arm64/runinstall_legacy.ipxe')
shutil.copyfile('/opt/wapt/wads/pxe/runinstall_uefi.ipxe','/var/www/wads/winpe/arm64/runinstall_uefi.ipxe')
run('chown -R wapt /var/www/wads')
run('chown wapt:www-data -R /var/www/wapt*')
It's in the Debian postinst directory, so it should be moved to the postconf directory
For example, you need to manage the reapplication of SELinux permissions
We'll see if we do it
Re: The /var/www directory is hardcoded
Published: October 23, 2026 - 2:39 PM
by dcardon
Hi Matthieu,
as Simon mentioned, changing directories can cause problems in many other places.
Could you point me to the CIS rule that might be requiring this directory move? If there is indeed a relevant rule, we can look into it further.
Best regards,
Denis
Re: The /var/www directory is hardcoded
Published: October 23, 2026 - 3:49 PM
by Matthieu
Hello,
Hardening requires partitioning the system and therefore involves choosing sizes for the different partitions.
So, in my case, I decided that /opt was the final partition, which is the largest and easiest to enlarge if needed.
It's not "mandatory," I could have made an exception for the Wapt VM and put /var at the end, but I want to standardize the partitioning across all VMs.
Sincerely,
Matthieu