Tag Info

New answers tagged

0

I faced same problem like you, when i read your post i didn't have a clue to solve that, but now i solve my problem. Here's my solution's : Install nss-pam-ldapd if you didn't install it previously : [root@www ~]# yum -y install nss-pam-ldapd Disable selinux and reboot : [root@ldap ~]# vi /etc/selinux/config Change this line : selinux=disabled ...


2

ssh tunneling is configured by the ssh-daemon itself. If the SSH daemon does not permit tunneling, you'll need to re-configure it. Typically, it's just running openssh server... and you can edit the /etc/ssh/sshd_config and add AllowTcpForwarding yes (remove AllowTcpForwarding no) and reload sshd config. As far as sftp goes, this is a slightly different ...


1

if you compare the default value of the boolean, you can see if that was changed. semanage boolean -l | grep http SELinux boolean State Default Description httpd_can_network_relay (off , off) Allow httpd to act as a relay httpd_can_network_connect_db (off , off) Allow HTTPD scripts and modules to connect to databases over the ...


0

The common SELinux security policy for webservers provides a set of types that can be used by normal users to tell SELinux how the webserver can operate on specified files. Users can use the chcon command to associate these types with specified files and directories. Each of these types have specific properties, designed for specific purposes. The ...


0

Using chcon works, but you lose the selinux label when you reboot the server, the more clear way is to use semange and restorecon example: semanage fcontext -a -t httpd_user_script_exec_t '/home/pippo/file.bash' restorecon -v /home/pippo/file.bash restorecon reset /home/pippo/file.bash context ...


0

You could run that process as unconfined so it would have the same rights as if SELinux was disabled. # This will setup the executable to be unconfined. Temporarily chcon -t unconfined_exec_t /opt/pixar/Tractor-2.1/bin/tractor-blade # This command will make that permanent semanage fcontext -a -t unconfined_exec_t /opt/pixar/Tractor-2.1/bin/tractor-blade ...


0

Try to use the semanage fcontext command semanage fcontext -a -t <YourLabel> -f f <YourPath> should work. -a = add a record for the fcontext object type -t = SELinux type for the object -f = file type


-1

Security-Enhanced_Linux-Systemd_Access_Control (https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/SELinux_Users_and_Administrators_Guide/chap-Security-Enhanced_Linux-Systemd_Access_Control.html) Also you can update selinux status as permissive setenforce 0 getenforce or sestatus


0

Adding to this question for future people who may come across it. If you are putting home directories on an NFS share, you will need to set the correct SELinux context. Assuming your nfs home directory is /nfshome, do the following: [root@host /]# semanage fcontext -a -t home_root_t /nfshome [root@host /]# semanage fcontext -a -e /home /nfshome [root@host ...


0

Everyone needs to be able to read /etc/passwd and write to /var/tmp. So these are not an issue. The kernel version is not really an issue either, provided you're actually installing updates, using Ksplice, etc. As for making outbound network connections, you can restrict this, as some web sites do not need to make such connections. But sometimes they do, ...


0

From my point of view /etc/passwd need to be readable from every users of the system. Your php script run with apache user, so it's normal the script can read /etc/passwd In apache virtualhost I use "php_admin_value open_basedir /var/www/example.com" you can do the same thing for upload_tmp_dir and session.save_path


0

You need block system command in php? Check php directive disable_functions = This?



Top 50 recent answers are included