On Mon, 2008-09-29 at 21:17 -0500, Arthur Pemberton wrote:
On Mon, Sep 29, 2008 at 3:40 PM, Stephen Smalley
> On Mon, 2008-09-29 at 15:31 -0500, Arthur Pemberton wrote:
>> I'm getting an denial when I attempt o use port 23 as an additional
>> port for sshd. That makes sense. What's the best way to define
>> alternate SSHd ports?
> semanage port -m -t ssh_port_t -p tcp 23
When trying this, I get:
sealert -l 819f882a-3d08-41da-bc19-4168c9b8b4cb
Even after doing that, I get this on `service sshd restart`:
sealert -l 82267d8b-d557-4891-bdb0-26e0feb1e986
A workaround until semanage is fixed to correctly support the above
would be to add a local policy module that allows sshd to bind to the
telnetd port, e.g.
$ cat myssh.te
allow sshd_t telnetd_port_t:tcp_socket name_bind;
$ make -f /usr/share/selinux/devel/Makefile myssh.pp
$ semodule -i myssh.pp
audit2allow should have yielded a similar result.
National Security Agency