Hide Forgot
Description of problem: When logging into openssh running on an non-standard port I fail to login as any user. I used semanage to add the non-standard port to selinux. The denial I see: time->Sat Mar 26 08:05:09 2011 type=SYSCALL msg=audit(1301141109.143:418): arch=c000003e syscall=59 success=yes exit=0 a0=7f5e74e90c78 a1=7fffe01b4310 a2=7f5e75096e88 a3=7 items=0 ppid=4960 pid=4962 auid=0 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=2 comm="unix_chkpwd" exe="/sbin/unix_chkpwd" subj=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 key=(null) type=AVC msg=audit(1301141109.143:418): avc: denied { noatsecure } for pid=4962 comm="unix_chkpwd" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1301141109.143:418): avc: denied { siginh } for pid=4962 comm="unix_chkpwd" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process type=AVC msg=audit(1301141109.143:418): avc: denied { rlimitinh } for pid=4962 comm="unix_chkpwd" scontext=unconfined_u:system_r:sshd_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:chkpwd_t:s0-s0:c0.c1023 tclass=process Version-Release number of selected component (if applicable): selinux-policy-targeted-3.7.19-78.el6.noarch How reproducible: 100% Steps to Reproduce: # semanage port -a -t ssh_port_t -p tcp 133 # /usr/sbin/sshd -p133 # ssh -p133 tester@localhost Connection closed # ssh -p133 root@localhost Connection closed Actual results: Cannot connect Expected results: Connection succeeds as with disabled selinux Additional info: I think this worked without issues a few releases back. When connecting to port 22 this works just fine.
> Additional info: > I think this worked without issues a few releases back. When connecting to port > 22 this works just fine. Are you sure? # /usr/sbin/sshd -p133 causes the sshd service is running in the bad domain. You can check /var/log/secure and you will see "Unable to get valid context for root" So if you want to test it this way (without using a service script), you need to start the sshd service using # runcon -r system_r -t initrc_t -- runcon -t sshd_t -- /usr/sbin/sshd -p133