I have a Centos VM running with SELinux enabled. I wish to have sshd listen to another port --- says, 993. I've modified the sshd_config file to listen to another port, but SELinux is getting in the way. I don't want to disable SELinux. How do I tell SELinux that it's okay for sshd to be reading TCP connections on port 993?

The correct command to use is semanage port -a -t ssh_port_t -p tcp 993 but I cannot use that command because port 993 is already in use in another policy:

[centos@timedb ~]$ semanage port -a -t ssh_port_t -p tcp 993
ValueError: SELinux policy is not managed or store cannot be accessed.
[centos@timedb ~]$

But I cannot delete that port in the policy because it is part of the base policy:

[centos@timedb ~]$ sudo semanage port -l|grep 993
pop_port_t                     tcp      106, 109, 110, 143, 220, 993, 995, 1109, 10993
[centos@timedb ~]$ sudo semanage port -d -t pop_port_t -p tcp 993
ValueError: Port tcp/993 is defined in policy, cannot be deleted
[centos@timedb ~]$

I need to use a port that is already defined becasue I am upstream from a middlebox that only allows connections on ports allocated to specified services, and port 22 is blocked.


Use semanage(8) to allow it.

# semanage port -a -t ssh_port_t -p tcp 993
  • Thanks. Does this need to be done once, or on every boot? – vy32 Dec 10 '17 at 13:05
  • I have clarified question regarding my specific problem. – vy32 Dec 10 '17 at 13:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.