Skip to Content.
Sympa Menu

freetds - Re: [freetds] PHP PDO object not working with freetds/unixODBC

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: Daniel Fazekas <fdsubs AT t-online.hu>
  • To: FreeTDS Development Group <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] PHP PDO object not working with freetds/unixODBC
  • Date: Tue, 23 Dec 2008 23:02:47 +0100

On Dec 23, 2008, at 21:49, Craig Metrolis wrote:

Thank you SOOOOOO much Daniel. "The setsebool -P httpd_can_network_connect 1" fixed it. So the problem is SELinux im guessing?

Thinking of SELinux as a problem is what leads people to give up on it and disable it entirely. :)
You just have to remember it's not some evil scheme to make the life of administering your own system more difficult, it does very effectively frustrate hostile hacking attempts as well. It's worth the extra effort required to live with it enabled.

In this case, everything was working as designed. The majority of systems don't need their web apps connecting to remote machines, the most common scenario being the database server running on the same system as the web server, which is allowed by default.
In return, with remote connections refused, even if your system is hacked and somebody could execute their own arbitrary script inside your web server, they wouldn't be able to use it to launch an attack on a remote server, as SELinux would still stop it.

Of course, with the database servers FreeTDS supports, the most common set-up is quite the opposite: the database server is almost always on a separate machine.
Thus you have to relax this part of the SELinux restrictions and give up on this one layer of extra protection.

I just want to be sure so I can fix this if it happens again. Im running RHEL 5. Is there a way to
configure this during the OS install?

During an interactive installation, I think the only question regarding SELinux is to turn it off entirely, which, again, is not something I'd recommend.
If you build a kickstart automated installation, you can tell it to execute any command you wish at the end of it, including the setsebool command you just used.





Archive powered by MHonArc 2.6.24.

Top of Page