Bug 1156092

Document URL: https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.0/html/Installation_Guide/index.html

Section Number and Name: 3.3. Configuring LDAP Authentication for Red Hat Satellite

Describe the issue: SELinux can prevent outgoing connections in RHEL 7 of certain types.  With out the proper SEBool setting LDAP authentication will never work and debugging it is difficult due to the nature of the failure in Foreman.  This can happen by default if you do a minimal RHEL install and then expand it later to support running Satellite.

Suggestions for improvement: Add a note to section 3.3 that informs the reader that setting the SELinux SEBool will allow outgoing LDAP requests.


Additional information: The denials in the /var/log/audit/audit.log look like this:

type=AVC msg=audit(1414013923.072:498): avc:  denied  { name_connect } for  pid=3341 comm="ruby" dest=389 scontext=system_u:system_r:passenger_t:s0 tcontext=system_u:object_r:ldap_port_t:s0 tclass=tcp_socket

Dumping those through and audit2allow -m gives the following:

[root@satellite ~]# grep denied /var/log/audit/audit.log | grep ruby | audit2allow -m selinux-foreman-ldap

module selinux-foreman-ldap 1.0;

require {
        type ldap_port_t;
        type passenger_t;
        class tcp_socket name_connect;
}

#============= passenger_t ==============

#!!!! This avc can be allowed using one of the these booleans:
#     nis_enabled, authlogin_nsswitch_use_ldap, passenger_can_connect_all
allow passenger_t ldap_port_t:tcp_socket name_connect;

My suggestion would be to set authlogin_nsswitch_use_ldap = 1 by executing the following:

[root@satellite ~]# setsebool authlogin_nsswitch_use_ldap=1