We have CentOS 6 configured with SELinux to host a number of websites.

Unfortunately SELinux is preventing websites from accessing (outbound) sites, such as download.wordpress.com to update wordpress or Joomla installation.

We would like to have both SELinux enabled and the ability for these sites to do such connections.

Our fear is that we do

# setsebool -P httpd_can_network_connect 1

and some 'developer' will create a php script to start outbound spamming resulting in our IP being black listed.

Is there a way to enable outbound connections and limit restrict such outbound issues at the same time?



If you tell SELinux to allow outbound connections, you can no longer use it to block abusive php scripts. You can however use iptables rules in its place.

iptables -I OUTPUT -m state --state new -m owner --uid-owner httpd -j REJECT
iptables -I OUTPUT -m state --state new -m owner --uid-owner httpd -p tcp --dport 80 -j ACCEPT
iptables -I OUTPUT -m state --state new -m owner --uid-owner httpd -p tcp --dport 443 -j ACCEPT
service iptables save

This will allow the user httpd to connect to ports 80 and 443 only. All other connection attempts will be rejected. (change 'httpd' to the user apache httpd runs as).

You can even limit the number of allowed parallel connections using the conlimit module of iptables. See http://www.cyberciti.biz/faq/iptables-connection-limits-howto/ for an example on how to do this.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.