[freetds] PHP PDO object not working with freetds/unixODBC
fdsubs at t-online.hu
Tue Dec 23 17:02:47 EST 2008
On Dec 23, 2008, at 21:49, Craig Metrolis wrote:
> Thank you SOOOOOO much Daniel. "The setsebool -P
> httpd_can_network_connect 1" fixed it. So the problem is SELinux im
Thinking of SELinux as a problem is what leads people to give up on it
and disable it entirely. :)
You just have to remember it's not some evil scheme to make the life
of administering your own system more difficult, it does very
effectively frustrate hostile hacking attempts as well. It's worth the
extra effort required to live with it enabled.
In this case, everything was working as designed. The majority of
systems don't need their web apps connecting to remote machines, the
most common scenario being the database server running on the same
system as the web server, which is allowed by default.
In return, with remote connections refused, even if your system is
hacked and somebody could execute their own arbitrary script inside
your web server, they wouldn't be able to use it to launch an attack
on a remote server, as SELinux would still stop it.
Of course, with the database servers FreeTDS supports, the most common
set-up is quite the opposite: the database server is almost always on
a separate machine.
Thus you have to relax this part of the SELinux restrictions and give
up on this one layer of extra protection.
> I just want to be sure so I can fix this if it happens again. Im
> running RHEL 5. Is there a way to
> configure this during the OS install?
During an interactive installation, I think the only question
regarding SELinux is to turn it off entirely, which, again, is not
something I'd recommend.
If you build a kickstart automated installation, you can tell it to
execute any command you wish at the end of it, including the setsebool
command you just used.
More information about the FreeTDS