1

I run a Apache2 (httpd) server for Dokuwiki. Dokuwiki cannot use its upgrade or install plugin feature (see Question here).

It seems that the user apache is not able to access the network/internet.

Tests

As root e.g. curl works fine:

root @alpha:~$ curl https://download.dokuwiki.org -L
<html lang="en">
<head>
<meta charset="utf-8" />
<title>Download DokuWiki</title> ...

but when I try the same as user apache:

root @alpha:~$ sudo -H -u apache bash -c 'curl https://download.dokuwiki.org -L'
curl: (7) Failed to connect to 2a01:4f8:172:3483::2: Network is unreachable

or with wget as root:

root @alpha:~$ wget https://download.dokuwiki.org
--2016-12-05 17:01:57--  https://download.dokuwiki.org/
Connecting to <proxy>:3128.... connected.
Proxy request sent, awaiting response... 200 OK
Length: unspecified [text/html]
Saving to: ‘index.html’

    [ <=>                    ] 25,350      --.-K/s   in 0.02s

2016-12-05 17:01:57 (1.40 MB/s) - ‘index.html’ saved [25350]

vs as user apache:

root @alpha:~$ sudo -H -u apache bash -c 'wget https://download.dokuwiki.org'
--2016-12-05 17:02:26--  https://download.dokuwiki.org/
Resolving download.dokuwiki.org (download.dokuwiki.org)...    138.201.137.132, 2a01:4f8:172:3483::2
Connecting to download.dokuwiki.org (download.dokuwiki.org)|138.201.137.132|:443... failed: No route to host.
Connecting to download.dokuwiki.org (download.dokuwiki.org)|2a01:4f8:172:3483::2|:443... failed: Network is unreachable.

Proxy

The server is behind a proxy. For root it seems to know that, but not for the user apache.

The proxy settings are set in /etc/profile.d/proxy.sh (proxy is a place holder):

MY_PROXY_URL="http://<proxy>:3128"

HTTP_PROXY=$MY_PROXY_URL
HTTPS_PROXY=$MY_PROXY_URL
FTP_PROXY=$MY_PROXY_URL
http_proxy=$MY_PROXY_URL
https_proxy=$MY_PROXY_URL
ftp_proxy=$MY_PROXY_URL

export HTTP_PROXY HTTPS_PROXY FTP_PROXY
export http_proxy https_proxy ftp_proxy

I also tried setting the proxy in /etc/profile (with the same code as above) and did restart the server, but that didn't help.

For root the vars are set: root @alpha:~$ echo $http_proxy http:// but not for apache: root @alpha:~$ sudo -H -u apache bash -c 'echo $http_proxy' /no output/ (del, because was a wrong way to test)

There is nothing special in /root/.bash_profile or /root/.bashrc.(not important)

SELinux

It seems SELinux is the cause. When I try to use "Wiki Upgrade" from Dokuwiki there are two new entries in /var/log/audit/audit.log:

type=AVC msg=audit(1481032251.392:768): avc:  denied  { name_connect } for  pid=1368 comm="httpd" dest=3128 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:squid_port_t:s0 tclass=tcp_socket
type=AVC msg=audit(1481032251.394:769): avc:  denied  { name_connect } for  pid=1368 comm="httpd" dest=3128 scontext=system_u:system_r:httpd_t:s0 tcontext=system_u:object_r:squid_port_t:s0 tclass=tcp_socket

What is the problem here? The service httpd is not allowed to connect to a port 3128?

  • Please add to the post how you are defining your PROXY configurations. Shell vars? – Rui F Ribeiro Dec 5 '16 at 16:36
  • Added it above @Rui – dice Dec 6 '16 at 8:37
  • root@alpha:~$ sudo -H -u apache bash -c 'echo $http_proxy' is perhaps the wrong command to check because sudo bash -c 'echo $http_proxy' also has no output. But echo "$USER $HTTP_PROXY" prints both, whereas sudo bash -c 'echo "$USER $HTTP_PROXY"' only prints "root". I'm confused. – dice Dec 6 '16 at 9:35
0

Centos use SElinux by default, did you review any of the rules of this IDS for apache?

Please forgive my english, it´s not my native language

  • The only thing I did was chcon -Rv --type=httpd_sys_rw_content_t /var/www/html/wiki/ so the wiki could write files. But I found new entries in the audit.log when I try to use the dokuwiki feature (see question). – dice Dec 6 '16 at 14:04
0

The Fix

The problem was with SELinux. Check the settings with:

 getsebool -a | grep httpd_can_network_connect

I got:

 httpd_can_network_connect --> off
 httpd_can_network_connect_cobbler --> off
 httpd_can_network_connect_db --> off

With:

setsebool -P httpd_can_network_connect on

you switch the network access for the httpd process on. (I had to install policycoreutils-python first, rpm -qa | grep selinux shows if you already have it.)

Warning!

I am not familiar with SELinux (yet) and there may be side effects to this change that compromise the security of your system!

Sidenote

I was confused how to test commands as the apache user (see deleted stuff in the question) so I will show a way here: Simply start a new shell for the user apache :) :

sudo -u apache /bin/bash

Please note: After the change in SELinux, curl will still not work for the apache user, because it only allows the process httpd to access the network.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.