linuxexpert-practice-labs/labs/rhcsa/10-6-selinux-ports/README.md

RHCSA 10.6: SELinux port labels

Letting httpd and sshd listen on ports SELinux doesn't expect them on.

Before you start

SELinux must be enforcing; keep it that way. The lab installs and starts httpd on port 80, installs policycoreutils-python-utils (for semanage), and adds a second machine, peer (10.99.0.2), on the lab network 10.99.0.0/24 (this VM is 10.99.0.1 there), to test from. Get a shell there with sudo ip netns exec lepeer bash. Keep a console or a second session open while you change sshd.

Tasks

1. Make httpd listen on port 8888 as well as 80, with SELinux enforcing, reachable from other systems: from the peer, curl http://10.99.0.1:8888/ gets an answer. Open the firewall if it's running.
2. Move sshd to port 2222, keeping port 22 working until you've tested it: add Port 22 and Port 2222 in a file in /etc/ssh/sshd_config.d/. ssh -p 2222 localhost works.

Hints

• Listen 8888 in a file in /etc/httpd/conf.d/; systemctl restart httpd fails until semanage port -a -t http_port_t -p tcp 8888; semanage port -l -C; ss -tln. If firewall-cmd --state says running: firewall-cmd --permanent --add-port=8888/tcp, --reload.
• semanage port -a -t ssh_port_t -p tcp 2222, sshd -t, systemctl restart sshd.