Mastering Linux Security and Hardening - Second Edition

Hands-on lab – SELinux Booleans and ports

In this lab, you'll view the effects of having Apache try to listen on an unauthorized port:

1. View the ports that SELinux allows the Apache web server daemon to use:

sudo semanage port -l | grep 'http'

2. Open the /etc/httpd/conf/httpd.conf file in your favorite text editor. Find the line that says Listen 80 and change it to Listen 82. Restart Apache by entering the following:

sudo systemctl restart httpd

3. View the error message you receive by entering:

sudo tail -20 /var/log/messages

4. Add port 82 to the list of authorized ports and restart Apache:

sudo semanage port -a 82 -t http_port_t -p tcpsudo semanage port -lsudo systemctl restart httpd

5. Delete the port that you just added:

sudo semanage ...