Install ToutWAF on Red Hat, Rocky and Alma
The commands for AlmaLinux, Rocky Linux, RHEL and Oracle Linux 8 to 10: prerequisites, installer, firewalld, SELinux in enforcing mode, check, upgrade and uninstall.
Which version you install
The public version is a development version, named 0.3.0-dev. Its name stays the same: each publication replaces the previous one, and a build identifier tells two builds apart. No stable version exists yet: it will only be published once every system and package has been tested end to end. The commands on this page therefore install from the dev channel. A development version can contain bugs: try it on a test site before relying on it.
At a glance
- AlmaLinux, Rocky Linux, Oracle Linux and RHEL 8, 9 and 10 use the same installer and the same steps. It detects the family in /etc/os-release and refuses a version below 8.
- Keep SELinux enforcing: the installer labels the binaries, configuration, data and logs, labels ports 9443 and 9444 and turns on the httpd_can_network_connect boolean.
- firewalld is the default firewall: open 80 and 443, and port 9443 for your admin network only.
- No subscription is needed for ToutWAF itself, but dnf needs access to BaseOS and AppStream to install the prerequisites; on an isolated host, use the offline procedure.
The commands, step by step
Update the system and install prerequisites
sudo dnf -y update
sudo dnf -y install curl tar ca-certificates firewalld policycoreutils-python-utilsInstall with the one-line installer
The script downloads the native binaries for your architecture, creates a dedicated unprivileged user and installs the hardened systemd services toutwaf-dp (data plane, ports 80 and 443) and toutwaf-cp (control plane and console, port 9443), then prints your first-login information.
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bashPrefer to read the script first?
Download it, review it, then run it. Recommended for production servers.
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh -o install.sh
less install.sh
sudo bash install.shInstaller options
A new installation lives in a single home, /var/toutwaf (bin, conf, data and logs; change it with --home DIR or TOUTWAF_HOME), and the command-line tools are linked in /usr/local/bin. An installation made earlier keeps its own paths (/etc/toutwaf, /var/lib/toutwaf) and is never moved.
# only let your admin network reach the console (port 9443)
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --console-from 203.0.113.0/24
# do not touch the host firewall / choose the installation home
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --no-firewall
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --home /opt/toutwaf
# name the channel explicitly (the installer of the dev branch already takes the dev channel; no stable version exists yet)
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --channel devOpen the firewall
The installer opens these ports by default when firewalld or ufw is active: 80 and 443, and the console port 9443 (restrict it to your admin network with --console-from). The agent port 9444 is never opened publicly. These commands are only needed with --no-firewall, with another firewall, or to do it by hand.
sudo systemctl enable --now firewalld
sudo firewall-cmd --permanent --add-service=http --add-service=https
sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="203.0.113.0/24" port port="9443" protocol="tcp" accept'
sudo firewall-cmd --reload
sudo firewall-cmd --list-allSELinux
Keep SELinux enforcing. Label the ToutWAF directories and make sure no AVC denial is logged.
getenforce
sudo restorecon -Rv /var/toutwaf
sudo ausearch -m avc -ts recentManage the services
Both services start at boot. Use these commands to start, stop or restart them.
sudo systemctl enable --now toutwaf-cp toutwaf-dp
sudo systemctl restart toutwaf-cp toutwaf-dp
sudo systemctl stop toutwaf-dp toutwaf-cpCheck the services
sudo systemctl status toutwaf-cp toutwaf-dp --no-pager
toutwafctl doctor
curl -kI https://127.0.0.1:9443/
curl -s http://127.0.0.1:9101/healthz
sudo journalctl -u toutwaf-dp -u toutwaf-cp -n 50 --no-pagerUpgrade
Back up the configuration and the data, then run the installer again: it keeps your settings and rolls back by itself if the new version does not become healthy. The paths shown are those of a new installation (/var/toutwaf); an older installation keeps /etc/toutwaf and /var/lib/toutwaf. You can also update from the console, on the Updates page.
sudo mkdir -p /var/toutwaf.bak
sudo cp -a /var/toutwaf/conf /var/toutwaf/data /var/toutwaf.bak/
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh | sudo bash -s -- --update --yes
curl -s http://127.0.0.1:9101/healthzUninstall
The first block removes the services, the binaries and the firewall rules added by ToutWAF, and keeps your data. The second one also deletes configuration, data and logs.
curl -fsSL https://repo.qu3ntin.com/toutwaf/toutwaf/-/raw/dev/install.sh -o install.sh
sudo bash install.sh --uninstallsudo bash install.sh --uninstall --purgeWhat is not verified
We prefer to say it plainly.
- “Tested” means the full installation passed in a container with systemd; real SELinux enforcement was not exercised, and RHEL was validated on Red Hat UBI images.
- No stable version exists yet: the public version is the development version 0.3.0-dev.