Setting Up an HTTP Distribution Point on Jamf Pro

Technical Articles

Solution

Application

Content Type

Technical Documentation

Utilities & Services

ft:locale

en-US

Install httpd (Apache) to allow for distribution over HTTP by executing the following command:
```
$ sudo yum -y install httpd
```
To secure the web share. install mod_ssl (for sharing over HTTPS) by executing the following command:
```
$ sudo yum -y install mod_ssl
```
Create a configuration file that will be used to generate a certificate request by executing the following command:
```
$ vi req.conf
```

Enter information similar to the following, and adjust the settings as needed for your environment:

[ req ]
default_bits = 4096
prompt = no
encrypt_key = no
default_md = sha256
distinguished_name = dn
req_extensions = req_ext
[ dn ]
CN = fqdn.of.server
emailAddress = admin@your.domain
O = Corp
OU = IT
L = Minneapolis
ST = Minnesota
C = US
[ req_ext ]
subjectAltName = DNS: fqdn.of.server, DNS: cname.of.server

Create the certificate signing request by executing the following command:

$ openssl req -new -config req.conf -keyout sslkey.pem -out ssl.csr
Generating a 4096 bit RSA private key
.....................................................................++
...++
writing new private key to 'sslkey.pem'
-----

Note:

This command also creates the private key file (sslkey.pem). Store the private key file in a secure location.

Copy the contents of the ssl.csr file.
Note: When copying, be sure to include the first (-----BEGIN CERTIFICATE REQUEST-----) and last (-----END CERTIFICATE REQUEST-----) lines.

Use cat to display the file contents by executing the following command:

$ cat ssl.csr
-----BEGIN CERTIFICATE REQUEST-----
MIIFETCCAvkCAQAwgY4xFzAVBgNVBAMMDmZxZG4ub2Yuc2VydmVyMSAwHgYJKoZI
hvcNAQkBFhFhZG1pbkB5b3VyLmRvbWFpbjENMAsGA1UECgwEQ29ycDELMAkGA1UE
.
.
.
gMDxBCeRhg2uctDYH4z7DXkA9facd+Ij0Ws73p75Jz7gCFE9D1BtCeF7RZhniBUl
jvi93tjtXNUseQQRy4TfheQneeF8hoRqCm7/Tzju2+Yxvv9ew4gsvCmVu/GQqlea
vR/veW4=
-----END CERTIFICATE REQUEST-----

In Jamf Pro, navigate to Settings > Global > PKI Certificates.
Click on the Management Certificate Template tab, and then click the Create Certificate from CSR button:
Click the Certificate Type pop-up menu, choose Web Server Certificate, and then paste the CSR into the text field:
Click Create and the certificate will download to the Downloads folder. (If prompted about permitting the download, click Allow).
Copy the certificate (.pem file) to the Red Hat Enterprise Linux server by executing the following command.
```
$ scp ~/Downloads/C\=US\,ST\=Minnesota\,L\=Minneapolis\,OU\=IT\,O\=Corp\,E\=admin@your.domain\,CN\=fqdn.of.server.pem jssadmin@fqdn.of.server:webshareSSL.pem
```
Note:
Rename the certificate file while copying it to make the name more manageable.
Move the certificate and private key .pem files to their respective default directories by executing the following commands:
```
$ sudo mv /home/jssadmin/webshareSSL.pem /etc/pki/tls/certs/
$ sudo mv /home/jssadmin/sslkey.pem /etc/pki/tls/private/
```

Set the owner and permissions on the certificate and private key files by executing the following commands:

$ sudo chown root:root /etc/pki/tls/certs/webshareSSL.pem
$ sudo chown root:root /etc/pki/tls/private/sslkey.pem
$ sudo chmod 600 /etc/pki/tls/certs/webshareSSL.pem
$ sudo chmod 600 /etc/pki/tls/private/sslkey.pem

Modify the ssl.conf file so it will use the certificate and private key that you created. Change the lines ssl.conf as indicated in the table below after executing the following command:

$ sudo vi /etc/httpd/conf.d/ssl.conf


Original Lines	Change to the Following
`Listen 443 https`	`Listen 0.0.0.0:443 https`
`#DocumentRoot "/var/www/html"`	`DocumentRoot "/usr/local/jamf"`
`#ServerName www.example.com:443`	`ServerName fqdn.of.server:443`
`SSLCertificateFile /etc/pki/tls/certs/localhost.crt`	`SSLCertificateFile /etc/pki/tls/certs/webshareSSL.pem`
`SSLCertificateKeyFile /etc/pki/tls/private/localhost.key`	`SSLCertificateKeyFile /etc/pki/tls/private/sslkey.pem`
`<Directory "/var/www/cgi-bin"> SSLOptions +StdEnvVars </Directory> # SSL Protocol Adjustments:`	`<Directory "/var/www/cgi-bin"> SSLOptions +StdEnvVars </Directory> <Directory "/usr/local/jamf"> AuthType Basic AuthName "Authorization Required" AuthUserFile /etc/httpd/.htpasswd Require valid-user </Directory> # SSL Protocol Adjustments:`

Modify the document root in the httpd.conf file by executing the following command and changing the line as indicated in the table below:
```
$ sudo vi /etc/httpd/conf/httpd.conf
```
Original Line Change to the Following
DocumentRoot "/var/www/html"
DocumentRoot "/usr/local/jamf"
Create the password file and configure the Samba read-only user to have access to the HTTPS share by executing the following command:
Important:
The -c option will delete and recreate the password file if one exists. If you have an existing configuration do not use the -c option.
```
$ sudo htpasswd -c /etc/httpd/.htpasswd jamfR
New password:
Re-type new password:
Adding password for user jamfR
```

Original Line	Change to the Following
`DocumentRoot "/var/www/html"`	`DocumentRoot "/usr/local/jamf"`

Set owner and permissions on the password file by executing the following command:

$ sudo chown apache:root /etc/httpd/.htpasswd
$ sudo chmod 0460 /etc/httpd/.htpasswd

Configure the firewall to allow HTTPS traffic. List the currently active zones by executing the following command:
```
$ sudo firewall-cmd --get-active-zones
```
Add the zone and the service to the firewall configuration by executing the following command:
```
$ sudo firewall-cmd --zone=public --add-service=https --permanent
```
Activate the new configuration by reloading the firewall by executing the following command:
```
$ sudo firewall-cmd --reload
```
Configure SELinux policies to allow read access to the web share by executing the following command:
```
$ sudo semanage fcontext -a -t httpd_sys_content_t "/usr/local/jamf(/.*)?"
```
Apply the new configuration by executing the following command:
```
$ sudo restorecon -Rv /usr/local/jamf
```

Configure SELinux to allow access to the certificate and private key:

Allow access to the certificate by executing the following commands:

$ sudo semanage fcontext -a -t cert_t /etc/pki/tls/certs/webshareSSL.pem
$ sudo restorecon -v /etc/pki/tls/certs/webshareSSL.pem

Allow access to the private key by executing the following commands:

$ sudo semanage fcontext -a -t cert_t /etc/pki/tls/private/sslkey.pem 
$ sudo restorecon -v /etc/pki/tls/private/sslkey.pem

Disable the default web page by executing the following command:

$ sudo mv /etc/httpd/conf.d/welcome.conf /etc/httpd/conf.d/welcome.conf.backup

Start the web server (httpd) by executing the following command:
```
$ sudo systemctl start httpd
```
Enable the service at startup by executing the following command:
```
$ sudo systemctl enable httpd
```
Add the web share to the Jamf Pro server:
1. Navigate to the SMB share that you created earlier, and click the HTTP/HTTPS tab.
2. Select Use HTTP downloads to enable the service.
3. Complete the configuration and click Save.
You should now be able to add packages to the new distribution point. After files have been added to the share, the HTTPS distribution point can quickly be tested by directing your web browser to a URL similar to the following:
```
https://fqdn.of.server/jamfShare/Packages/<somePackage.pkg>
```
When prompted for credentials, enter the read-only (JamfR) account credentials and click Log In.
If prompted about permitting the download, click Allow, and the package should successfully download.