Skip to Content.
Sympa Menu

freetds - Re: [freetds] PHP PDO object not working with freetds/unixODBC

freetds AT lists.ibiblio.org

Subject: FreeTDS Development Group

List archive

Chronological Thread  
  • From: "Craig Metrolis" <craigmetrolis AT medicinechestrx.com>
  • To: "'FreeTDS Development Group'" <freetds AT lists.ibiblio.org>
  • Subject: Re: [freetds] PHP PDO object not working with freetds/unixODBC
  • Date: Tue, 23 Dec 2008 16:10:51 -0600

Yeah, this is not the first time SELinux caused me headaches, and it was
about the last thing that I was thinking about causing the problem. Again, I
really appreciate the help :)

Craig


-----Original Message-----
From: freetds-bounces AT lists.ibiblio.org
[mailto:freetds-bounces AT lists.ibiblio.org] On Behalf Of Daniel Fazekas
Sent: Tuesday, December 23, 2008 4:03 PM
To: FreeTDS Development Group
Subject: Re: [freetds] PHP PDO object not working with freetds/unixODBC

On Dec 23, 2008, at 21:49, Craig Metrolis wrote:

> Thank you SOOOOOO much Daniel. "The setsebool -P
> httpd_can_network_connect 1" fixed it. So the problem is SELinux im
> guessing?

Thinking of SELinux as a problem is what leads people to give up on it
and disable it entirely. :)
You just have to remember it's not some evil scheme to make the life
of administering your own system more difficult, it does very
effectively frustrate hostile hacking attempts as well. It's worth the
extra effort required to live with it enabled.

In this case, everything was working as designed. The majority of
systems don't need their web apps connecting to remote machines, the
most common scenario being the database server running on the same
system as the web server, which is allowed by default.
In return, with remote connections refused, even if your system is
hacked and somebody could execute their own arbitrary script inside
your web server, they wouldn't be able to use it to launch an attack
on a remote server, as SELinux would still stop it.

Of course, with the database servers FreeTDS supports, the most common
set-up is quite the opposite: the database server is almost always on
a separate machine.
Thus you have to relax this part of the SELinux restrictions and give
up on this one layer of extra protection.

> I just want to be sure so I can fix this if it happens again. Im
> running RHEL 5. Is there a way to
> configure this during the OS install?

During an interactive installation, I think the only question
regarding SELinux is to turn it off entirely, which, again, is not
something I'd recommend.
If you build a kickstart automated installation, you can tell it to
execute any command you wish at the end of it, including the setsebool
command you just used.

_______________________________________________
FreeTDS mailing list
FreeTDS AT lists.ibiblio.org
http://lists.ibiblio.org/mailman/listinfo/freetds






Archive powered by MHonArc 2.6.24.

Top of Page