So, I was tasked to install OpenEMR (https://www.open-emr.org/) on Oracle Linux 8.
First things first, when installing Oracle Linux 8, it has a number of differences from CentOS 8 and RHEL 8. Nothing major, but different. I might post about it later if I feel like it.
Once your minimal install is ready, you log in with SSH and run everything as listed below.
Install Oracle's EPEL repo
sudo dnf install -y oracle-epel-release-el8
Enable Oracle's CodeReadyBuilder repo
sudo dnf config-manager --enable ol8_codeready_builder
Update the system to current (also forces dnf makecache)
sudo dnf upgrade -y --refresh
Install all of the required system packages
sudo dnf install -y wget httpd mod_ssl mariadb-server tar @php:7.4 php-mbstring php-xml php-json php-pdo php-gd php-pecl-zip php-soap php-mysqlnd php-ldap ImageMagick ImageMagick-devel php-devel php-pear make
Install the imagick PHP plugin
- This is interactive, you ill need to hit enter once
sudo pecl install imagick
Set the module to load with PHP
echo "extension=imagick.so" | sudo tee -a /etc/php.d/20-imagick.ini
Modify some PHP settings base don the OpenEMR wiki
- Only changing things different than default in OEL8)
# https://www.open-emr.org/wiki/index.php/FAQ#What_are_the_correct_PHP_settings_.28can_be_found_in_the_php.ini_file.29.3F
sudo sed -i 's/^#\?\(max_execution_time\).*$/\1 = 60/' /etc/php.ini
sudo sed -i 's/^#\?\(max_input_time\).*$/\1 = -1/' /etc/php.ini
sudo sed -i 's/^;#\?\(max_input_vars\).*$/\1 = 3000/' /etc/php.ini
sudo sed -i 's/^#\?\(memory_limit\).*$/\1 = 512M/' /etc/php.ini
sudo sed -i 's/^#\?\(post_max_size\).*$/\1 = 30M/' /etc/php.ini
sudo sed -i 's/^#\?\(upload_max_filesize\).*$/\1 = 30M/' /etc/php.ini
sudo sed -i 's/^#\?\(error_reporting\).*$/\1 = E_ALL \& ~E_NOTICE \& ~E_STRICT \& ~E_DEPRECATED/' /etc/php.ini
sudo sed -i 's/^;#\?\(mysqli.allow_local_infile\).*$/\1 = On/' /etc/php.ini
Open the firewall to HTTPS and HTTP
- hardening will be a separate post
sudo firewall-cmd --add-service=http --permanent
sudo firewall-cmd --add-service=https --permanent
sudo firewall-cmd --reload
Start and enable mariadb
sudo systemctl enable --now mariadb
Secure mariadb.
- These commands do what mysql_secure_installation does interactively
sudo mysql -e "UPDATE mysql.user SET Password=PASSWORD('SomeSecure30CharacterPassword') WHERE User='root';"
sudo mysql -e "DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');"
sudo mysql -e "DELETE FROM mysql.user WHERE User='';"
sudo mysql -e "DROP DATABASE test;"
sudo mysql -e "FLUSH PRIVILEGES;"
Start and enable Apache
sudo systemctl enable --now httpd
Change to the web directory
cd /var/www/html
Download OpenEMR
sudo wget https://gigenet.dl.sourceforge.net/project/openemr/OpenEMR%20Current/6.0.0/openemr-6.0.0.tar.gz
Extract OpenEMR
sudo tar -pxvzf openemr-6.0.0.tar.gz
Remove the downloaded file
sudo rm openemr-6.0.0.tar.gz
Rename the extracted directory to remove the version number
sudo mv openemr-6.0.0/ openemr
Set apache as the owner of everything.
sudo chown -R apache:apache /var/www/html
Recursively set the folder httpd_sys_rw for SELinux
sudo semanage fcontext -a -t httpd_sys_rw_content_t "/var/www/html/openemr(/.*)?"
sudo restorecon -FR /var/www/html/openemr/
Create an Apache conf file for the instance
sudo nano /etc/httpd/conf.d/openemr.conf
And paste this in.
LoadModule rewrite_module modules/mod_rewrite.so
LoadModule allowmethods_module modules/mod_allowmethods.so
## Security Options
# Strong HTTP Protocol
HTTPProtocolOptions Strict
Protocols http/1.1
# Don't Reveal Server
ServerSignature off
ServerTokens Prod
Header unset Server
# No ETag
FileETag None
Header unset ETag
# Set HSTS and X-XSS protection
Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
Header set X-XSS-Protection "1; mode=block"
# Narrow document root
DocumentRoot /var/www/html/openemr
ErrorLog /var/log/httpd/emr.domain.com_error_log
CustomLog /var/log/httpd/emr.domain.com_access_log combined
<Directory /var/www/html/openemr>
# Only allow these HTTP Methods
AllowMethods GET POST PUT DELETE HEAD OPTIONS
# No indexes anywhere
Options -Indexes
AllowOverride FileInfo
Require all granted
</Directory>
<Directory "/var/www/html/openemr/sites">
AllowOverride None
</Directory>
<Directory "/var/www/html/openemr/sites/*/documents">
Require all denied
</Directory>
#######################################
### Uncomment the following 3 lines ###
### with #'s below to enable HTTPS ###
### redirection & require HTTPS only ##
#######################################
<VirtualHost *:80>
#RewriteEngine On
#RewriteCond %{HTTPS} off
#RewriteRule (.*) https://%{HTTP_HOST}/$1 [R,L]
</VirtualHost>
<VirtualHost _default_:443>
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
SSLHonorCipherOrder on
# Used following tool to produce below ciphers: https://mozilla.github.io/server-side-tls/ssl-config-generator/?server=apache-2.4.39&openssl=1.1.1&hsts=yes&profile=modern
SSLCipherSuite ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256
SSLProtocol -ALL +TLSv1.2
SSLCertificateFile /etc/pki/tls/certs/localhost.crt
SSLCertificateKeyFile /etc/pki/tls/private/localhost.key
</VirtualHost>
Reboot your system
sudo reboot
Open your web browser and go to the installed location
- Use IP address until you get SSL setup
https://12.34.56.78
Run the initial configuration wizard
