Chapter 6: Web Servers — Nginx and Apache

6.6 CentOS Stream 9

By Ravindra Bagale Last updated: 27 September 2026

Friends, the install commands on CentOS are the same as on Amazon Linux, but there are two extra guards – firewalld and SELinux. Once you understand them, there is no reason to fear 403 and 502 on CentOS.

Nginx on CentOS Stream 9

sudo yum install -y nginx
sudo service nginx start
sudo systemctl enable nginx
sudo service nginx status
sudo nginx -t
curl -I http://localhost

Apache on CentOS Stream 9

sudo yum install -y httpd
sudo service httpd start
sudo systemctl enable httpd
sudo service httpd status
sudo apachectl configtest
curl -I http://localhost          # shows the CentOS test page until you add index.html

firewalld (only if it is running)

CentOS cloud images may or may not have firewalld running. Check, and if active, open HTTP/HTTPS:

sudo systemctl is-active firewalld
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
sudo firewall-cmd --list-all

If firewalld is inactive or not installed, the AWS security group alone controls access — that is fine.

SELinux basics

Pay attention – when something that works on Ubuntu gives "403 Forbidden" or "502 Bad Gateway" on CentOS, the number one reason is SELinux. It is not your enemy; it is an extra security guard. Come on, let's learn how to talk to it.

CentOS Stream runs SELinux in enforcing mode. SELinux labels every file and process; a web server may only read files labelled httpd_sys_content_t (both Nginx and Apache run in the httpd_t domain).

getenforce                                  # Enforcing / Permissive / Disabled
ls -Z /usr/share/nginx/html /var/www/html   # view SELinux labels
sudo restorecon -Rv /var/www/html           # fix labels after copying/moving files
sudo setsebool -P httpd_can_network_connect 1      # allow reverse proxy to apps (Node/Flask)
sudo setsebool -P httpd_can_network_connect_db 1   # allow web server/PHP to reach a remote DB
sudo ausearch -m avc -ts recent             # see recent SELinux denials (package audit)

Do not simply disable SELinux

Turning SELinux off (setenforce 0) "fixes" 403/502 errors but removes an important security layer. Fix the label or boolean instead. Temporarily using sudo setenforce 0 only to confirm that SELinux is the cause is fine — then set it back with sudo setenforce 1.

Ravindra Bagale's Tip

Many students bring files into /var/www/html with mv and get 403 on CentOS – because mv keeps the old SELinux label. After moving files, always run sudo restorecon -Rv /var/www/html and check with ls -Z that httpd_sys_content_t shows up.

Ravindra Bagale's Tip – मराठी

खूप students files mv ने /var/www/html मध्ये आणतात आणि CentOS वर 403 येतो – कारण mv जुनाच SELinux label ठेवून देतो. File हलवल्यावर नेहमी sudo restorecon -Rv /var/www/html चालवा आणि ls -Z ने httpd_sys_content_t दिसतो का ते बघा.

Ravindra Bagale's Tip – हिंदी

बहुत students files mv से /var/www/html में लाते हैं और CentOS पर 403 आता है – क्योंकि mv पुराना SELinux label ही रखता है. File हटाने के बाद हमेशा sudo restorecon -Rv /var/www/html चलाओ और ls -Z से देखो कि httpd_sys_content_t दिखता है या नहीं.

Lab

Chala, CentOS Stream 9 instance var getenforce aani sudo systemctl is-active firewalld chalva aani output liha. firewalld active asel tar HTTP open kara, mag ls -Z /var/www/html ne label bagha.