LinuxQuestions.org - SELinux Adventures

SELinux Adventures

sshd chroot jails based on hostname and SELinux

Posted 04-01-2013 at 10:46 AM by sag47
Updated 04-01-2013 at 10:51 AM by sag47

Tags chroot, jenkins, security, selinux, sshd

Why chroot jails based on host name?
If you don't care about the background info just jump to Setting up sshd chroot jail and SELinux.

So I have started configuring automated deployments through my organization using a continuous integration server called Jenkins. I'll post more on Jenkins regularly so that eventually you can have a series of posts which wrap up into a nice and secure howto for Jenkins. So here's why I want chroot jails based on host names.

...

sag47

Senior Member

Posted in SELinux Adventures

Views 268 Comments 0 sag47 is offline

SELinux and Icinga

Posted 08-05-2012 at 12:39 AM by sag47
Updated 08-05-2012 at 12:57 AM by sag47

Tags icinga, security, selinux

Today I ran into an SELinux problem when installing icinga. I followed their documentation "Adjusting the SELinux settings". However my cgis still would not run. When I ran,

Code:

cat /var/log/audit/audit.log | audit2allow -v

I received the following output,

Code:

#============= httpd_sys_script_t ==============
# src="httpd_sys_script_t" tgt="initrc_tmp_t" class="file", perms="{ read getattr open }"
# comm="tac.cgi"

...

sag47

Senior Member

Posted in SELinux Adventures

Views 1318 Comments 3 sag47 is offline

SELinux, syslog-ng, and the like

Posted 06-19-2012 at 10:12 AM by sag47
Updated 08-05-2012 at 12:58 AM by sag47

Tags security, selinux, syslog

So recently in my home setup I installed a scheme for centralized logging. I use rsyslog or syslog on the client servers and syslog-ng on the central server. This is nothing new and has been done before.

rsyslog + syslog-ng = gold.

I have a script which parses the syslog-ng logs across all the servers, filters them, and then sends and email with a summary and unusual logs. Each time I got an email I would get, on average, ~200-500 log messages of SELinux errors and...

sag47

Senior Member

Posted in SELinux Adventures

Views 1855 Comments 1 sag47 is offline

SELinux and sshd

Posted 01-02-2012 at 04:55 PM by sag47
Updated 08-05-2012 at 12:58 AM by sag47

Tags security, selinux, ssh

So I've started using the new Fedora 16 on my main media server (previously F14) and decided to try something new this time. I've always set SELinux to permissive which is a bad idea normally for anything public (which this server isn't but I still want it). Anyway I believe I was testing something before I left for the holidays and ran

Code:

setenforce 0

which disables SELinux. I guess at some point it turned back on somehow and I was locked out of ssh. I dug through my logs (/var/log/messages,...

sag47

Senior Member

Posted in SELinux Adventures

Views 3385 Comments 1 sag47 is offline

SELinux and Apache ProxyPass

Posted 12-07-2011 at 12:39 PM by sag47
Updated 08-05-2012 at 12:58 AM by sag47

Tags httpd, security, selinux

Today I was having trouble getting a httpd ProxyPass and ProxyPassReverse to work. As a background I'm working in RedHat Enterprise Linux 6.1. It took me a while to figure out what was wrong (longer than it should have) and as it turns out it worked after I disabled SELinux. So my configs were correct in /etc/httpd/conf.d/* and it passed all config tests. I'm sure you don't want to read a whole post of talking so I'll just get right into the grit of the commands. For the rest of the explanation...

sag47

Senior Member

Posted in SELinux Adventures

Views 1034 Comments 0 sag47 is offline