2

I run a Apache2 (httpd) server for Dokuwiki. Dokuwiki cannot use its upgrade or install plugin feature (see Question here).

It seems that the user apache is not able to access the network/internet.

Tests

As root e.g. curl works fine:

root @alpha:~$ curl https://download.dokuwiki.org -L
<html lang="en">
<head>
<meta charset="utf-8" />
<title>Download DokuWiki</title> ...

but when I try the same as user apache:

root @alpha:~$ sudo -H -u apache bash -c 'curl https://download.dokuwiki.org -L'
curl: (7) Failed to connect to 2a01:4f8:172:3483::2: Network is unreachable

or with wget as root:

root @alpha:~$ wget https://download.dokuwiki.org
--2016-12-05 17:01:57--  https://download.dokuwiki.org/
Connecting to <proxy>:3128.... connected.
Proxy request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

    [ <=>                    ] 25,350      --.-K/s   in 0.02s

2016-12-05 17:01:57 (1.40 MB/s) - ‘index.html’ saved [25350]

vs as user apache:

root @alpha:~$ sudo -H -u apache bash -c 'wget https://download.dokuwiki.org'
--2016-12-05 17:02:26--  https://download.dokuwiki.org/
Resolving download.dokuwiki.org (download.dokuwiki.org)...    138.201.137.132, 2a01:4f8:172:3483::2
Connecting to download.dokuwiki.org (download.dokuwiki.org)|138.201.137.132|:443... failed: No route to host.
Connecting to download.dokuwiki.org (download.dokuwiki.org)|2a01:4f8:172:3483::2|:443... failed: Network is unreachable.

Proxy

The server is behind a proxy. For root it seems to know that, but not for the user apache.

The proxy settings are set in /etc/profile.d/proxy.sh (proxy is a place holder):

MY_PROXY_URL="http://<proxy>:3128"

HTTP_PROXY=$MY_PROXY_URL
HTTPS_PROXY=$MY_PROXY_URL
FTP_PROXY=$MY_PROXY_URL
http_proxy=$MY_PROXY_URL
https_proxy=$MY_PROXY_URL
ftp_proxy=$MY_PROXY_URL

export HTTP_PROXY HTTPS_PROXY FTP_PROXY
export http_proxy https_proxy ftp_proxy

I also tried setting the proxy in /etc/profile (with the same code as above) and did restart the server, but that didn't help.

For root the vars are set: root @alpha:~$ echo $http_proxy http:// but not for apache: root @alpha:~$ sudo -H -u apache bash -c 'echo $http_proxy' /no output/ (del, because was a wrong way to test)

There is nothing special in /root/.bash_profile or /root/.bashrc.(not important)

SELinux

It seems SELinux is the cause. When I try to use "Wiki Upgrade" from Dokuwiki there are two new entries in /var/log/audit/audit.log:

type=AVC msg=audit(1481032251.392:768): avc:  denied  { name_connect } for  pid=1368 comm="httpd" dest=3128 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:squid_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1481032251.394:769): avc:  denied  { name_connect } for  pid=1368 comm="httpd" dest=3128 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:squid_port_t:s0 tclass=tcp_socket

What is the problem here? The service httpd is not allowed to connect to a port 3128?

3
  • Please add to the post how you are defining your PROXY configurations. Shell vars? Dec 5, 2016 at 16:36
  • Added it above @Rui
    – dice
    Dec 6, 2016 at 8:37
  • root@alpha:~$ sudo -H -u apache bash -c 'echo $http_proxy' is perhaps the wrong command to check because sudo bash -c 'echo $http_proxy' also has no output. But echo "$USER $HTTP_PROXY" prints both, whereas sudo bash -c 'echo "$USER $HTTP_PROXY"' only prints "root". I'm confused.
    – dice
    Dec 6, 2016 at 9:35

2 Answers 2

2

The Fix

The problem was with SELinux. Check the settings with:

 getsebool -a | grep httpd_can_network_connect

I got:

 httpd_can_network_connect --> off
 httpd_can_network_connect_cobbler --> off
 httpd_can_network_connect_db --> off

With:

setsebool -P httpd_can_network_connect on

you switch the network access for the httpd process on. (I had to install policycoreutils-python first, rpm -qa | grep selinux shows if you already have it.)

Warning!

I am not familiar with SELinux (yet) and there may be side effects to this change that compromise the security of your system!

Sidenote

I was confused how to test commands as the apache user (see deleted stuff in the question) so I will show a way here: Simply start a new shell for the user apache :) :

sudo -u apache /bin/bash

Please note: After the change in SELinux, curl will still not work for the apache user, because it only allows the process httpd to access the network.

0

Centos use SElinux by default, did you review any of the rules of this IDS for apache?

Please forgive my english, it´s not my native language

1
  • The only thing I did was chcon -Rv --type=httpd_sys_rw_content_t /var/www/html/wiki/ so the wiki could write files. But I found new entries in the audit.log when I try to use the dokuwiki feature (see question).
    – dice
    Dec 6, 2016 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .