Installing Enterprise Passwork + Nginx Password Manager on Centos 8 / Rocky Linux

Passwork stores passwords in a structured form with flexible user access control and is suitable for both corporate collaboration and personal use.


Install software

$ sudo dnf makecache
$ sudo dnf -y install epel-release
$ sudo dnf -y install wget traceroute net-tools nano bind-utils telnet htop rsync policycoreutils-python-utils
$ sudo dnf-y install git avahi

Install Nginx, configure Firewall

Add the Nginx repository

$ sudo nano /etc/yum.repos.d/nginx.repo

name=nginx stable repo

name=nginx mainline repo

Install Nginx, add it to startup and run

$ sudo dnf -y install nginx
$ sudo systemctl enable --now nginx

Configuring Firewall

$ sudo firewall-cmd --permanent --add-service=http
$ sudo firewall-cmd --permanent --add-service=https
$ sudo firewall-cmd --permanent --add-port=5353/udp
$ sudo firewall-cmd --reload

Restarting the avahi service

$ sudo systemctl restart avahi-daemon

Installing MongoDB 4.2 Database

Add MongoDB repository

$ sudo nano /etc/yum.repos.d/mongodb-org-4.2.repo

name=MongoDB Repository

Install MongoDB

$ sudo dnf -y install mongodb-org

Disable SELinux

$ sudo nano /etc/selinux/config

In order not to reboot, execute the command

$ sudo setenforce 0

Add MongoDB to autoload, run, check

$ sudo systemctl enable --now mongod
$ systemctl status mongod

Install PHP-fpm 7.3

Add Remi repository

$ sudo dnf -y install

Install php-fpm 7.3 and required modules

$ sudo dnf module list php
$ sudo dnf module enable php:remi-7.3
$ sudo dnf -y install php-fpm php-json php-ldap php-xml php-bcmath php-mbstring

Configuring php-fpm

$ sudo nano /etc/php-fpm.d/www.conf
user = nginx
group = nginx
listen = /run/php-fpm/www.sock

Editing php.ini

$ sudo nano /etc/php.ini
date.timezone = Europe/Moscow
short_open_tag = On

Change directory owner

$ sudo chown -R nginx. /var/lib/php/session

Add php-fpm to autoload, run, check

$ sudo systemctl enable --now php-fpm
$ systemctl status php-fpm

Installing PHP Mongo Driver

Installing the necessary components

$ sudo dnf -y install gcc php-pear openssl-devel

On Centos 8 to install php-devel you must first install the package libedit-devel from the PowerTools repository, otherwise there will be an installation error in the console

$ sudo dnf -y install
$ sudo dnf -y install php-devel

Putting the driver together

$ sudo pecl install mongodb

Add it to php

$ echo "" | sudo tee /etc/php.d/20-mongodb.ini

Restart php-fpm service

$ sudo systemctl restart php-fpm

Installing PHP framework Phalcon version 3.4.5

Installing the necessary components

$ sudo yum -y install php-mysql libtool pcre-devel

Clone the repository and install the framework

$ cd /opt/
$ sudo git clone --branch 3.4.x  --depth=1 ""
$ cd cphalcon/build
$ sudo ./install

Add it to php

$ echo "" | sudo tee /etc/php.d/50-phalcon.ini

Restart php-fpm service

$ sudo systemctl restart php-fpm

Check if modules are loaded into php

$ php -m | egrep 'phalcon|mongodb'

Downloading and installing Passwork

Create a directory and go to it

$ sudo mkdir /opt/passwork
$ cd /opt/passwork

Clone the repository

$ sudo git init
$ sudo git remote add origin
$ sudo git fetch

$ sudo git checkout v4

Login, password and certificate can be requested at for testing

Copy the configuration file and change the rights to files / directories

$ sudo cp /opt/passwork/app/config/config.example.ini /opt/passwork/app/config/config.ini
$ sudo find /opt/passwork/ -type d -exec chmod 755 {} ;
$ sudo find /opt/passwork/ -type f -exec chmod 644 {} ;
$ sudo chown -R nginx. /opt/passwork/

Editing the configuration file

$ sudo nano /opt/passwork/app/config/config.ini
domain =

Recovering MongoDB Database

$ sudo mongorestore --drop /opt/passwork/dump/

Configuring Nginx. Disable the default nginx config

$ sudo mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/default.conf_disabled

Copying the repository config

$ sudo cp /opt/passwork/nginx.conf.example /etc/nginx/conf.d/nginx.conf


$ sudo nano /etc/nginx/conf.d/nginx.conf
    server unix:/run/php-fpm/www.sock;

    root /opt/passwork/public/;

Restarting services

$ sudo systemctl restart nginx php-fpm

We connect an SSL certificate for the browser extension to work

We generate a self-signed certificate, or use a ready-made one

$ sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 -subj '/' -addext 'subjectAltName=DNS:' -keyout /etc/ssl/certs/passwork.key -out /etc/ssl/certs/passwork.crt

How to create a Diffie-Hellman group

$ sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Add it to our generated certificate

$ cat /etc/ssl/certs/dhparam.pem | sudo tee -a /etc/ssl/certs/passwork.crt

When working over an SSL connection (HTTPS), the browser Chrome requires the Secure and SameSite flags in the cookie. We turn them on

$ sudo nano /etc/php.ini
session.cookie_secure = On

Disable the disableSameSiteCookie parameter in the passwork configuration file config.ini

$ sudo nano /opt/passwork/app/config/config.ini

disableSameSiteCookie = Off

Restarting services php-fpm and nginx

$ sudo systemctl restart php-fpm nginx

Configuring the Nginx config

$ sudo nano /etc/nginx/conf.d/nginx.conf

server {
    listen 80;
    rewrite ^ https://$http_host$request_uri? permanent;        # force redirect http to https
    server_tokens off;

server {
    listen 443 ssl;
    server_name pass.gge.local;
#    ssl on;
    ssl_certificate /etc/ssl/certs/passwork.crt;        # path to your cacert.pem
    ssl_certificate_key /etc/ssl/certs/passwork.key;      # path to your privkey.pem
    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:5m;

    # Diffie-Hellman parameter for DHE ciphersuites, recommended 2048 bits
    ssl_dhparam /etc/ssl/certs/dhparam.pem;

    # secure settings (A+ at SSL Labs ssltest at time of writing)
    # see
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

Done, now you can connect the browser extension