My Linux distro of choice is Debian, including its progeny. I hadn’t used RedHat since version 6. Unfortunately, RedHat’s installer kernel has better support for modern hardware, or at least Dell server hardware. I had no desire to muck around with kernels anymore (time and opportunity cost issue), so I was “forced” to give RedHat another spin. As you’ll read, I don’t much care for RedHat for vanilla server installs, and particularly I had trouble (admittedly born out of ignorance) setting up Apache to run as a proxy server.
I didn’t like that a minimal install of RedHat (Fedora Core 5) still has a lot of services and applications installed. I don’t think it’s wrong to do so; I can see they were aiming for a Windows-like install and user experience. However, like Windows, its good until you run into a problem, at which point one needs to figure out which of many services is the culprit. It’s also wasteful (CPU, memory, administrative time) if you know exactly what you want, but that’s the Debian-on-obsolete-hardware veteran talking.
For me, the main stumbling block going to RedHat again is that RedHat follows the SELinux guidelines out of the box. This means that it’s been somewhat hardened and uses ACLs. It’s a fine idea, but clearly the default setup was configured with workstations in mind. I wanted to do was set up Apache as a proxy server, but it wasn’t as easy as running yum.
The Apache error log showed a message every time someone external accessed the site, but it wasn’t helpful at all: [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:11235 (localhost) failed
It took me awhile to realize what was going on; when I started I wasn’t even aware of the use of ACLs. Eventually, I’d read enough on semi-related SELinux and RedHat issues, including a newsgroup post in German, and figured that I needed to setsebool httpd_can_network_connect true to permit the Apache process to connect to other machines. There’s some additional steps to make it “sticky” between reboots.
Knowing that string, httpd_can_network_connect, it’s easy to find references to the problem/solution. Starting from the problem, however, was very frustrating. So for the search engines: if you’re using RedHat Fedora Core, running Apache as a proxy server, and getting Permission denied: proxy errors, you may need to run setsebool httpd_can_network_connect true.
Perhaps an uncalled for comment, but if this was Debian, I’d have gotten a screen explaining the trade-offs during the installation process. Surely making use of Apache’s fantastic proxy capabilities isn’t that uncommon, is it?






