Set up the report server

The report server is a few PHP pages on any Apache and PHP host. It checks each upload's signature and keeps one report per host for DRSM to read.

What you need

Apache with PHP 7.4 or later and the openssl extension. Shared hosting works.
An HTTPS certificate the hosts trust (or a private CA, set with ca_file on the agents).
A data folder the web server can write to, best outside the web root.
For the RHEL 10 CSAF/VEX index: PHP on the command line, cron, zstd and outgoing HTTPS to security.access.redhat.com.

The pages

Page	What it does
`register.php`	Registers an agent's certificate. With the enrollment token the agent is approved at once, otherwise it waits for an admin.
`upload.php`	Takes a report only when it is signed with the key of an approved agent, and saves it as `<host>_linux_report_agent.txt`, with the OpenSCAP HTML reports, in `reports_dir`
`hook.php`	Takes hook uploads, signed the same way, for hook IDs with a manifest, and keeps them in `[hooks] dir`
`admin.php`	Approves, revokes and deletes agents, behind a login
`vex_index.php`	Serves the RHEL 10 CSAF/VEX index to the agents
`vex_sync.php`	Builds the CSAF/VEX index (cron, not a web page)
`lra_lib.php`, `lra_auth.php`, `hook_lib.php`	Shared code, blocked from the web

Install

The pages and install_server.sh are in the source code and in /usr/share/doc/linux_reporting_agent/php on any host with the RPM. The script shows what it would do first; run it again with --apply:

$ php/install_server.sh /var/www/html/linux /var/lib/linux_reporting_agent
$ sudo php/install_server.sh --apply --admin-user admin /var/www/html/linux /var/lib/linux_reporting_agent

It puts the pages in /var/www/html/linux/upload/, writes server.ini in the data folder (never over an existing one), adds the .htaccess files, and with --admin-user makes an admin.htpasswd login. At the end it prints the commands that let the web server user write to the data folder, including the SELinux label httpd_sys_rw_content_t. Point Apache at server.ini with SetEnv LRA_SERVER_INI /var/lib/linux_reporting_agent/server.ini if it is not in /etc/linux_reporting_agent/.

server.ini

Setting	Default	What it does
`[paths] reports_dir`	`/var/www/html/linux/reports`	Where reports are written, one file per host. DRSM reads it (`LRA_REPORTS_DIR`).
`[paths] data_dir`	`/var/lib/linux_reporting_agent`	Agent registrations and replay protection data
`[registration] enrollment_token`	empty	Shared secret agents send when they register. Empty: an admin approves every agent.
`[registration] auto_approve_with_token`	1	0 still checks the token, but an admin must approve
`[upload] max_upload_bytes`	2000000	Largest report
`[upload] max_html_bytes`	20000000	Largest OpenSCAP HTML report
`[upload] max_clock_skew_seconds`	300	Largest clock difference between agent and server
`[admin] require_remote_user`	1	`admin.php` only runs behind web server authentication
`[admin] login`	basic	`basic` (web server login) or `drsm` (DRSM dashboard login)
`[admin] drsm_config`	empty	With `login = drsm`: the dashboard's `config/drsm.php`
`[hooks] enabled`	1	Take hook uploads
`[hooks] manifest_dir`	empty	DRSM's `plugins/uploads` folder; only hook IDs with a manifest are taken
`[hooks] dir`	`<data_dir>/hooks`	Where hook payloads are kept; DRSM reads it (`UPLOADS_DIR`)
`[hooks] max_bytes`	20000000	Largest hook payload

By default admin.php sits behind an Apache Basic login (admin.htpasswd). When the pages are inside the DRSM dashboard's web folder, for example /dashboard/linux/upload/, they can use the dashboard login instead:

$ sudo php/install_server.sh --apply --drsm-login ../../config/drsm.php /var/www/html/dashboard/linux /var/www/html/dashboard/linux/data

RHEL 10 CSAF/VEX index

Red Hat publishes no OVAL feed for RHEL 10. vex_sync.php builds a small index (about 2 MB) from Red Hat's CSAF/VEX files, and agents fetch it from vex_index.php when it changes. The first run downloads Red Hat's full VEX archive (about 400 MB, needs zstd) and takes a while; later runs fetch only the files that changed, in seconds. Run it daily from cron as a user that can write the data folder:

# /etc/cron.d/lra_vex_sync
30 5 * * * apache LRA_SERVER_INI=/var/lib/linux_reporting_agent/server.ini php /var/www/html/linux/upload/vex_sync.php --releases 10

Only needed when RHEL 10 hosts scan for vulnerabilities. See Vulnerability scans.

Shared hosting

On hosts with only Apache and PHP, such as HostGator, put the data folder inside the web folder: install_server.sh adds a Require all denied .htaccess to it. Copy server.ini next to it and set SetEnv LRA_SERVER_INI in the pages' .htaccess. Build the CSAF/VEX index on another machine if the host has no cron with PHP, and copy it into data/vex/.

With the Windows agent

The Windows agent uses the same protocol with its own pages. Install each in its own folder, for example /dashboard/windows/upload/ and /dashboard/linux/upload/, so the Linux and Windows registrations stay apart.