Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm setting up net-snmp on CentOS and I'm getting an issue setting up non-default port. Basically, if I set it up as 161 or port 32768 or greater, it works fine, but it doesn't work for anything between 10000 and 32767.

Any ideas what might be causing this? It's particular to one server only, and it's working fine on other similarly configured servers.

Here are the logs in /var/log/messages:

May  3 11:15:27 oninfra01 snmpd[27709]: Error opening specified endpoint "5161"
May  3 11:15:27 oninfra01 kernel: type=1400 audit(1336058127.584:57070): avc:  denied  { name_bind } for  pid=27709 comm="snmpd" src=5161 scontext=unconfined_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket
May  3 11:15:27 oninfra01 kernel: type=1400 audit(1336058127.584:57071): avc:  denied  { name_bind } for  pid=27709 comm="snmpd" src=5161 scontext=unconfined_u:system_r:snmpd_t:s0 tcontext=system_u:object_r:port_t:s0 tclass=udp_socket
May  3 11:15:27 oninfra01 snmpd[27709]: Server Exiting with code 1
share|improve this question
    
You say it doesn't work. What happens? Anything in the logs or something? –  Oliver May 3 '12 at 15:01
    
when I do 'sudo service snmpd restart', it just doesn't start. I see a start FAILED message. –  ashvagan May 3 '12 at 15:08
    
Did you check the logs for any messages? –  Oliver May 3 '12 at 15:09
    
I don't see any logs in /var/log for snmpd. Is there any other place I can find logs? –  ashvagan May 3 '12 at 15:10
    
Check /var/log/messages. You can also do lsof -i <port number> to see if anything else is using the port you're trying to use. –  Matthew May 3 '12 at 15:17

2 Answers 2

up vote 1 down vote accepted

SELINUX strikes again.

Add a rule allowing it or disable selinux.

#getenforce

#setenforce permissive

This might work as far as creating a new rule for selinux, but better to disable it if you don't understand it, it will bite again.

# grep snmp /var/log/audit/audit.log | audit2allow -M mypol
# semodule -i mypol.pp
share|improve this answer
    
[admin snmp]$ getenforce Enforcing [admin snmp]$ setenforce permissive setenforce: setenforce() failed –  ashvagan May 3 '12 at 15:21
    
I don't think selinux is enabled on the server. –  ashvagan May 3 '12 at 15:22
    
getenforce Enforcing <- yeah its enabled. –  foocorpluser May 3 '12 at 15:22
    
It worked! awesome! Thanks. –  ashvagan May 3 '12 at 15:24
    
Great. WHERES MY UPBOAT? I'm not doing this out of the goodness of my heart you know. –  foocorpluser May 3 '12 at 15:26

One way to allow more ports for snmp in SELinux is

semanage port -a -t snmp_port_t -p tcp 10000-32767
semanage port -a -t snmp_port_t -p udp 10000-32767

(commands might take a while to run, that's normal because SELinux compiles its rulesets)

Check if it went OK:

semanage port -l | grep snmp
share|improve this answer
    
bash: semanage: command not found. Awesome! –  ashvagan May 4 '12 at 18:41
    
yum -y install policycoreutils-python did the trick! –  ashvagan May 4 '12 at 19:28

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.