I run a Apache2 (httpd) server for Dokuwiki. Dokuwiki cannot use its upgrade or install plugin feature (see Question here).

It seems that the user apache is not able to access the network/internet.


As root e.g. curl works fine:

root @alpha:~$ curl https://download.dokuwiki.org -L
<html lang="en">
<meta charset="utf-8" />
<title>Download DokuWiki</title> ...

but when I try the same as user apache:

root @alpha:~$ sudo -H -u apache bash -c 'curl https://download.dokuwiki.org -L'
curl: (7) Failed to connect to 2a01:4f8:172:3483::2: Network is unreachable

or with wget as root:

root @alpha:~$ wget https://download.dokuwiki.org
--2016-12-05 17:01:57--  https://download.dokuwiki.org/
Connecting to <proxy>:3128.... connected.
Proxy request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

    [ <=>                    ] 25,350      --.-K/s   in 0.02s

2016-12-05 17:01:57 (1.40 MB/s) - ‘index.html’ saved [25350]

vs as user apache:

root @alpha:~$ sudo -H -u apache bash -c 'wget https://download.dokuwiki.org'
--2016-12-05 17:02:26--  https://download.dokuwiki.org/
Resolving download.dokuwiki.org (download.dokuwiki.org)..., 2a01:4f8:172:3483::2
Connecting to download.dokuwiki.org (download.dokuwiki.org)||:443... failed: No route to host.
Connecting to download.dokuwiki.org (download.dokuwiki.org)|2a01:4f8:172:3483::2|:443... failed: Network is unreachable.


The server is behind a proxy. For root it seems to know that, but not for the user apache.

The proxy settings are set in /etc/profile.d/proxy.sh (proxy is a place holder):



export http_proxy https_proxy ftp_proxy

I also tried setting the proxy in /etc/profile (with the same code as above) and did restart the server, but that didn't help.

For root the vars are set: root @alpha:~$ echo $http_proxy http:// but not for apache: root @alpha:~$ sudo -H -u apache bash -c 'echo $http_proxy' /no output/ (del, because was a wrong way to test)

There is nothing special in /root/.bash_profile or /root/.bashrc.(not important)


It seems SELinux is the cause. When I try to use "Wiki Upgrade" from Dokuwiki there are two new entries in /var/log/audit/audit.log:

type=AVC msg=audit(1481032251.392:768): avc:  denied  { name_connect } for  pid=1368 comm="httpd" dest=3128 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:squid_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1481032251.394:769): avc:  denied  { name_connect } for  pid=1368 comm="httpd" dest=3128 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:squid_port_t:s0 tclass=tcp_socket

What is the problem here? The service httpd is not allowed to connect to a port 3128?

  • Please add to the post how you are defining your PROXY configurations. Shell vars? Dec 5, 2016 at 16:36
  • Added it above @Rui
    – dice
    Dec 6, 2016 at 8:37
  • root@alpha:~$ sudo -H -u apache bash -c 'echo $http_proxy' is perhaps the wrong command to check because sudo bash -c 'echo $http_proxy' also has no output. But echo "$USER $HTTP_PROXY" prints both, whereas sudo bash -c 'echo "$USER $HTTP_PROXY"' only prints "root". I'm confused.
    – dice
    Dec 6, 2016 at 9:35

2 Answers 2


The Fix

The problem was with SELinux. Check the settings with:

 getsebool -a | grep httpd_can_network_connect

I got:

 httpd_can_network_connect --> off
 httpd_can_network_connect_cobbler --> off
 httpd_can_network_connect_db --> off


setsebool -P httpd_can_network_connect on

you switch the network access for the httpd process on. (I had to install policycoreutils-python first, rpm -qa | grep selinux shows if you already have it.)


I am not familiar with SELinux (yet) and there may be side effects to this change that compromise the security of your system!


I was confused how to test commands as the apache user (see deleted stuff in the question) so I will show a way here: Simply start a new shell for the user apache :) :

sudo -u apache /bin/bash

Please note: After the change in SELinux, curl will still not work for the apache user, because it only allows the process httpd to access the network.


Centos use SElinux by default, did you review any of the rules of this IDS for apache?

Please forgive my english, it´s not my native language

  • The only thing I did was chcon -Rv --type=httpd_sys_rw_content_t /var/www/html/wiki/ so the wiki could write files. But I found new entries in the audit.log when I try to use the dokuwiki feature (see question).
    – dice
    Dec 6, 2016 at 14:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .