3

I have a Centos VM running with SELinux enabled. I wish to have sshd listen to another port --- says, 993. I've modified the sshd_config file to listen to another port, but SELinux is getting in the way. I don't want to disable SELinux. How do I tell SELinux that it's okay for sshd to be reading TCP connections on port 993?

The correct command to use is semanage port -a -t ssh_port_t -p tcp 993 but I cannot use that command because port 993 is already in use in another policy:

[centos@timedb ~]$ semanage port -a -t ssh_port_t -p tcp 993
ValueError: SELinux policy is not managed or store cannot be accessed.
[centos@timedb ~]$

But I cannot delete that port in the policy because it is part of the base policy:

[centos@timedb ~]$ sudo semanage port -l|grep 993
pop_port_t                     tcp      106, 109, 110, 143, 220, 993, 995, 1109, 10993
[centos@timedb ~]$ sudo semanage port -d -t pop_port_t -p tcp 993
ValueError: Port tcp/993 is defined in policy, cannot be deleted
[centos@timedb ~]$

I need to use a port that is already defined becasue I am upstream from a middlebox that only allows connections on ports allocated to specified services, and port 22 is blocked.

vy32
  • 2,088
  • 2
  • 17
  • 21

1 Answers1

4

Use semanage(8) to allow it.

# semanage port -a -t ssh_port_t -p tcp 993
Ignacio Vazquez-Abrams
  • 45,939
  • 6
  • 79
  • 84