Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

We run a site with big traffic surges and, because of that, SELinux usually thinks that the traffic is a SYN flood attack. We have this same problem on many different CentOS servers.

Despite /etc/selinux/config being set with disabled or permissive, when the servers boot, selinux is in enforcing mode again.

The only way to disable SELinux is by doing echo 0 > /proc/sys/net/ipv4/tcp_syncookies every time the servers boot.

I know that one solution could be to do a cron job with the abovementioned command on every boot but I wonder if anyone has some idea of what could be the reason why the modification of /etc/selinux/config is not enough (maybe it is enabled somewhere else; any idea on where to look or how to find it?).

share|improve this question

migrated from stackoverflow.com Jan 29 '12 at 21:18

This question came from our site for professional and enthusiast programmers.

2 Answers 2

In /etc/sysconfig/selinux you want to have SELINUX=disabled and reboot.

Source: http://www.centos.org/docs/5/html/5.2/Deployment_Guide/sec-sel-enable-disable.html

share|improve this answer
    
You are right, there is also /etc/sysconfig/selinux but both /etc/selinux/config and /etc/sysconfig/selinux are set as SELINUX=disabled and despite of that cat /proc/sys/net/ipv4/tcp_syncookies still says 1 after reboot. –  Zillo Jan 28 '12 at 20:11
    
Just found the solution. No need to disable selinux, just to edit /etc/sysctl.conf where it says net.ipv4.tcp_syncookies = 1 to net.ipv4.tcp_syncookies = 0 –  Zillo Jan 28 '12 at 20:29
    
@Zilo could you post that as an answer please for posterity? –  Kyle Jones Jan 31 '12 at 6:10

While I would rather keep SELinux on and make a policy to allow whatever is braking your server you can always try this to disable SELinux.

$: sudo echo 0 > /selinux/enforce
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.