Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

We have CentOS 6 configured with SELinux to host a number of websites.

Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update wordpress or Joomla installation.

We would like to have both SELinux enabled and the ability for these sites to do such connections.

Our fear is that we do

# setsebool -P httpd_can_network_connect 1

and some 'developer' will create a php script to start outbound spamming resulting in our IP being black listed.

Is there a way to enable outbound connections and limit restrict such outbound issues at the same time?

Thanks.

share|improve this question
add comment

1 Answer 1

If you tell SELinux to allow outbound connections, you can no longer use it to block abusive php scripts. You can however use iptables rules in its place.

iptables -I OUTPUT -m state --state new -m owner --uid-owner httpd -j REJECT
iptables -I OUTPUT -m state --state new -m owner --uid-owner httpd -p tcp --dport 80 -j ACCEPT
iptables -I OUTPUT -m state --state new -m owner --uid-owner httpd -p tcp --dport 443 -j ACCEPT
service iptables save

This will allow the user httpd to connect to ports 80 and 443 only. All other connection attempts will be rejected. (change 'httpd' to the user apache httpd runs as).

You can even limit the number of allowed parallel connections using the conlimit module of iptables. See http://www.cyberciti.biz/faq/iptables-connection-limits-howto/ for an example on how to do this.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.