在開啟selinux的情況下,如何修改httpd的端口且服務能正常使用

來源:本站原創 網絡技術 超過4,171 views圍觀 0條評論

 

本次測試將原有httpd的port 80 修改為801

[[email protected] ~]# systemctl restart httpd
Job for httpd.service failed. See ‘systemctl status httpd.service’ and ‘journalctl -xn’ for details.
[[email protected] ~]# systemctl stop httpd
[[email protected] ~]# systemctl start httpd
Job for httpd.service failed. See ‘systemctl status httpd.service’ and ‘journalctl -xn’ for details.
[[email protected] ~]# !v
vim /etc/httpd/conf/httpd.conf

#
# Change this to Listen on specific IP addresses as shown below to
# prevent Apache from glomming onto all bound IP addresses.
#
#Listen 12.34.56.78:80
Listen 801? 修改為801 違返selinux

[[email protected] ~]# semanage port -l |grep http
http_cache_port_t????????????? tcp????? 8080, 8118, 8123, 10001-10010
http_cache_port_t????????????? udp????? 3130
http_port_t??????????????????? tcp????? 80, 81, 443, 488, 8008, 8009, 8443, 9000? 沒有801所以不能接管httpd
pegasus_http_port_t??????????? tcp????? 5988
pegasus_https_port_t?????????? tcp????? 5989

[[email protected] ~]#systemctl status -l httpd

10月 19 14:46:02 localhost.localdomain httpd[1452]: AH00558: httpd: Could not reliably determine the server’s fully qualified domain name, using localhost.localdomain. Set the ‘ServerName’ directive globally to suppress this message
10月 19 14:46:02 localhost.localdomain httpd[1452]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:801
10月 19 14:46:02 localhost.localdomain httpd[1452]: (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:801

[[email protected] ~]# journalctl -xn

*****? Plugin catchall (1.49 confidence) suggests

10月 19 14:46:02 localhost.localdomain httpd[1452]: (13)Permission denied: AH00072: make_sock: could not bind to address [::]:801
10月 19 14:46:02 localhost.localdomain httpd[1452]: (13)Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:801 ? //不允許801調用本地sock

If you believe that httpd should be allowed name_bin
Then you should report this as a bug.
You can generate a local policy module to allow this
Do
allow this access for now by executing:
# grep httpd /var/log/audit/audit.log | audit2allow
# semodule -i mypol.pp??? *********//selinux報錯
解決方案

semanage port -a -t http_port_t -p tcp 801? 將801加入selinux

http_cache_port_t????????????? tcp????? 8080, 8118, 8123, 10001-10010
http_cache_port_t????????????? udp????? 3130
http_port_t??????????????????? tcp????? 801, 80, 81, 443, 488, 8008, 8009, 8443, 9000?? ///801已加入

[[email protected] ~]# systemctl status httpd.service
httpd.service – The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled)
Active: active (running) since 二 2016-10-18 18:18:25 CST; 6min ago????? //啟動正常
Process: 49005 ExecStop=/bin/kill -WINCH ${MAINPID} (code=exited, status=0/SUCCESS)
Main PID: 49231 (httpd)
Status: “Total requests: 0; Current requests/sec: 0; Current traffic:?? 0 B/sec”
CGroup: /system.slice/httpd.service

[[email protected] ~]# netstat -ntlp |grep http
tcp6?????? 0????? 0 :::801????????????????? :::*??????????????????? LISTEN????? 49231/httpd

本地測試
[[email protected] ~]# curl http://localhost:801
test1
t2
艇3
dfdfdfdf

外部測試完成

擴展
senamage 端口 增加 類型 [] 協議 TCP/UDP 端口
semanage port -a -t http_port_t -p tcp 801
senamage 端口 修改 類型 [] 協議 TCP/UDP 端口
semanage port -m -t http_port_t -p tcp 801
senamage 端口 刪除 類型 [] 協議 TCP/UDP 端口
semanage port -d -t http_port_t -p tcp 801

image

文章出自:CCIE那點事 http://www.qdxgqk.live/ 版權所有。本站文章除注明出處外,皆為作者原創文章,可自由引用,但請注明來源。 禁止全文轉載。
本文鏈接:http://www.qdxgqk.live/?p=3548轉載請注明轉自CCIE那點事
如果喜歡:點此訂閱本站
  • 相關文章
  • 為您推薦
  • 各種觀點
?
暫時還木有人評論,坐等沙發!
發表評論

您必須 [ 登錄 ] 才能發表留言!

?
?
萌宠夺宝游戏