FreeTDS Development Group

[Daniel Fazekas <fdsubs AT t-online.hu>]

On Dec 23, 2008, at 21:49, Craig Metrolis wrote:

> Thank you SOOOOOO much Daniel. "The setsebool -P  
> httpd_can_network_connect 1" fixed it. So the problem is SELinux im  
> guessing?

Thinking of SELinux as a problem is what leads people to give up on it  
and disable it entirely. :)
You just have to remember it's not some evil scheme to make the life  
of administering your own system more difficult, it does very  
effectively frustrate hostile hacking attempts as well. It's worth the  
extra effort required to live with it enabled.

In this case, everything was working as designed. The majority of  
systems don't need their web apps connecting to remote machines, the  
most common scenario being the database server running on the same  
system as the web server, which is allowed by default.
In return, with remote connections refused, even if your system is  
hacked and somebody could execute their own arbitrary script inside  
your web server, they wouldn't be able to use it to launch an attack  
on a remote server, as SELinux would still stop it.

Of course, with the database servers FreeTDS supports, the most common  
set-up is quite the opposite: the database server is almost always on  
a separate machine.
Thus you have to relax this part of the SELinux restrictions and give  
up on this one layer of extra protection.

> I just want to be sure so I can fix this if it happens again. Im  
> running RHEL 5. Is there a way to
> configure this during the OS install?

During an interactive installation, I think the only question  
regarding SELinux is to turn it off entirely, which, again, is not  
something I'd recommend.
If you build a kickstart automated installation, you can tell it to  
execute any command you wish at the end of it, including the setsebool  
command you just used.