2

I'm running Redhat 7.7. I am trying to let the ssh-service accept connections on both Port 22 and Port 443. I have allready opened the firewalld with

sudo firewall-cmd --add-port=443/tcp --permanent
sudo firewall-cmd --reload

And set

Port 22
Port 443

in /etc/ssh/sshd_config and reloaded with

sudo systemctl reload sshd

But sudo journalctl -u sshd still says it can't bind to 443. What do I need to do now?

3 Answers 3

4

You don't need to generate a local policy, you can modify the SELinux port type of port 443 to something suitable using semanage(8).

semange port -l | grep ssh
ssh_port_t                     tcp      22

So we need to change the port type to ssh_port_t

semanage port -m -t ssh_port_t -p tcp 443  

and to verify

semange port -l | grep ssh
ssh_port_t                     tcp      443, 22
1

I'm a selinux newbie. But here goes. I've followed this guide SELinux - 5.6. Gathering Audit Logs In Permissive Mode

Switch to root as you will need root right for all the following commands

sudo su

First, you need to find which semodule blocks your port with:

ausearch -m avc

This will show you some recent errors. You need to look with which scontext the error happens. For me it was sshd_t

time-> <timestamp>
type=PROCTITLE msg=audit(1567419463.747:16052): proctitle=2F7573722F7362696E2F73736864002D44
type=SYSCALL msg=audit(1567419463.747:16052): arch=c000003e syscall=49 success=no exit=-13 a0=3 a1=55f0f8e1cce0 a2=10 a3=7ffee40f91a8 items=0 ppid=1 pid=1339 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="sshd" exe="/usr/sbin/sshd" subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=(null)
type=AVC msg=audit(1567419463.747:16052): avc:  denied  { name_bind } for  pid=1339 comm="sshd" src=443 scontext=system_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:http_port_t:s0 tclass=tcp_socket permissive=0

Set the module found in the scontext temporarly on permissive. Reload the sshd service and see if it works now.

semanage permissive -a sshd_t
systemctl reload sshd
journalctl -u sshd

If this works we can now create our own local semodule. In this example I call it sshdlocal.

Follwing command shows how the new rule will be looking like:

grep sshd_t /var/log/audit/audit.log | audit2allow -m sshdlocal

In my case:

module sshdlocal 1.0;

require {
        type http_port_t;
        type sshd_t;
        class tcp_socket name_bind;
}

#============= sshd_t ==============

#!!!! This avc is allowed in the current policy
allow sshd_t http_port_t:tcp_socket name_bind;

To actually generate and install the semodule. Do this:

grep sshd_t /var/log/audit/audit.log | audit2allow -M sshdlocal
semodule -i sshdlocal.pp

You can list all semodules like this:

semodule -l

Now remove the permissive sshd_t, reload the sshd_config and check with journalctl to see if the setup is still working.

semanage permissive -d sshd_t
systemctl reload sshd
journalctl -u sshd
0

Just run

semanage port -a -t ssh_port_t -p tcp 443

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .