starred/netbox
1
0
Fork 0
mirror of https://github.com/netbox-community/netbox.git synced 2026-01-11 21:10:29 +01:00
Code Issues 273 Packages Projects Releases 10 Wiki Activity

RHEL7 netbox fips compliant install #2066

New Issue
Closed
opened 2025-12-29 17:21:57 +01:00 by adam · 1 comment
adam commented 2025-12-29 17:21:57 +01:00
Owner
Copy Link

Originally created by @ghost on GitHub (Oct 12, 2018).

Change Type

[x ] Addition
[ ] Correction
[ ] Deprecation
[ ] Cleanup (formatting, typos, etc.)

Proposed Changes

I get that the official documentation is light on purpose but for those looking to run Netbox on RHEL7 in a secure environment I would suggest the following steps; this should also work on CentOS 7. Hopefully someone else finds this useful I burnt up a few hours racking my brain to get it to work without negating SELinux.

  • SELinux mode must be set to enforcing

    # sestatus

    SELinux status: enabled
    SELinuxfs mount: /sys/fs/selinux
    SELinux root directory: /etc/selinux
    Loaded policy name: targeted
    Current mode: enforcing
    Mode from config file: enforcing
    Policy MLS status: enabled
    Policy deny_unknown status: allowed
    Max kernel policy version: 31

  • Prior to running migrate...
    # python3 /opt/netbox/netbox/manage.py migrate
    Check md5 is not being used for security
    # grep md5 /usr/lib/python3.4/site-packages/django/db/backends/base/schema.py
    # vim /usr/lib/python3.4/site-packages/django/db/backends/base/schema.py

    h = hashlib.md5()
    h = hashlib.md5(usedforsecurity=False)

  • Set listen to 8080 or greater than 1024 that's not currently being used
    vi /etc/nginx/conf.d/netbox.conf

  • nginx should be able to access netbox
    chown root:nginx /opt/netbox/ -R

  • Check for denials and SElinux file context
    tail /var/log/nginx/error.log
    ls -lZ /opt/netbox

  • Check nginx user name is what's being used by gunicorn if you're still seeing 502

Again, I wouldn't expect this to be adopted but if you're looking for an install that doesn't negate SELinux and is FIPS mode complaint here maybe this is useful. Other than that the official install guide works great for Red Hat; just follow the CentOS steps.

Originally created by @ghost on GitHub (Oct 12, 2018). <!-- Please indicate the nature of the change by placing an X in one of the boxes below. --> ### Change Type [x ] Addition [ ] Correction [ ] Deprecation [ ] Cleanup (formatting, typos, etc.) <!-- Describe the proposed change(s). --> ### Proposed Changes I get that the official documentation is light on purpose but for those looking to run Netbox on RHEL7 in a secure environment I would suggest the following steps; this should also work on CentOS 7. Hopefully someone else finds this useful I burnt up a few hours racking my brain to get it to work without negating SELinux. * SELinux mode must be set to enforcing `# sestatus` > SELinux status: enabled > SELinuxfs mount: /sys/fs/selinux > SELinux root directory: /etc/selinux > Loaded policy name: targeted > Current mode: enforcing > Mode from config file: enforcing > Policy MLS status: enabled > Policy deny_unknown status: allowed > Max kernel policy version: 31 * Prior to running migrate... `# python3 /opt/netbox/netbox/manage.py migrate` Check md5 is **not** being used for security `# grep md5 /usr/lib/python3.4/site-packages/django/db/backends/base/schema.py` `# vim /usr/lib/python3.4/site-packages/django/db/backends/base/schema.py` > _h = hashlib.md5()_ > _h = hashlib.md5(usedforsecurity=False)_ * Set listen to 8080 or greater than 1024 that's not currently being used `vi /etc/nginx/conf.d/netbox.conf` * nginx should be able to access netbox `chown root:nginx /opt/netbox/ -R` * Check for denials and SElinux file context `tail /var/log/nginx/error.log` `ls -lZ /opt/netbox` * Check nginx user name is what's being used by gunicorn if you're still seeing 502 Again, I wouldn't expect this to be adopted but if you're looking for an install that doesn't negate SELinux and is FIPS mode complaint here maybe this is useful. Other than that the official install guide works great for Red Hat; just follow the CentOS steps.
adam closed this issue 2025-12-29 17:21:57 +01:00
adam commented 2025-12-29 17:21:58 +01:00
Author
Owner
Copy Link

@lampwins commented on GitHub (Oct 15, 2018):

While I appreciate the information sharing, you are correct that this cannot be adopted in the docs, simply because these procedures are not unique to NetBox. We must be careful not become just another place on the internet for such information.

@lampwins commented on GitHub (Oct 15, 2018): While I appreciate the information sharing, you are correct that this cannot be adopted in the docs, simply because these procedures are not unique to NetBox. We must be careful not become just another place on the internet for such information.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
beta
breaking change
complexity: high
complexity: low
complexity: medium
needs milestone
netbox
pending closure
plugin candidate
pull-request
Mirrored from GitHub Pull Request
 severity: high
severity: low
severity: medium
status: accepted
status: backlog
status: blocked
status: duplicate
status: needs owner
status: needs triage
status: revisions needed
status: under review
topic: GraphQL
topic: Internationalization
topic: OpenAPI
topic: UI/UX
topic: cabling
topic: event rules
topic: htmx navigation
topic: industrialization
topic: migrations
topic: plugins
topic: scripts
topic: templating
topic: testing
type: bug
type: deprecation
type: documentation
type: feature
type: housekeeping
type: translation
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
adam
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/netbox#2066
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?