0

We have a service mapped to the web application.

So, we need to allow 80 port and 16700 for its backend service.

During login, it will connect to this service for authentication and other parts of data.

in firewall, we allow these two using

firewall-cmd --permanent --add-port=16700/tcp firewall-cmd --permanent --add-port=80/tcp

If I disable selinux or set to permissive it is working. If I set enforcing, it is not working.

So, I added below for 80 port. setsebool -P httpd_can_network_connect on

But, it is dailing the login attempt still, because of 16700 port. And adding this 16700 to the http_port_t also doesn't work. semanage port -a -t http_port_t -p tcp 16700

And this 16700 is not there in bool also.

Any suggestion, how to enable this port in selinux?

OS: Redhat 7.4

2
  • Doesn't selinux log the command required to enable an action when run in permissive mode?
    – hardillb
    Jun 23 '20 at 13:03
  • No it doesn't I tried this grep <servicename> /var/log/audit/audit.log | audit2allow But didn't output anything Jun 23 '20 at 13:08
1

semanage port -a -t http_port_t -p tcp 16700 is the correct action to allow the port in SELinux. If it "doesn't work" then you need to figure out why. Check the error messages you may have received, check the audit log, check the rest of the logs just to be sure.

Of course, you also need to open the port in the firewall, and you don't seem to have done that. You changed the configuration on disk, but not the actual running firewall. Open the port with:

firewall-cmd --add-port=16700/tcp

It's best practice to not use --permanent except for commands which actually require it, such as adding and removing zones. If you make a mistake adding a port, and lock yourself out, you can simply restart the firewall (or the VM) to recover. If you added a wrong rule as a permanent rule, then as soon as the firewall restarts, you will be locked out and have great difficulty recovering. Once you are sure the running firewall works correctly, you can save it with firewall-cmd --runtime-to-permanent.

11
  • I added that port in selinux but still not working. THis port 16700 is not using directly by http, it is used by our application to access. So I think, it should be created on a separate type. But there is no type related to our service. Jun 23 '20 at 13:39
  • @UdayKiranReddy You still need to open the port in the firewall. Jun 23 '20 at 13:46
  • Yeah I already done that before also for both 80 and 16700 Jun 23 '20 at 13:52
  • @UdayKiranReddy If you did, it is not present in your question. See above. Jun 23 '20 at 13:56
  • It is already present..please check line 5 Jun 23 '20 at 14:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.