Apache on RedHat Fedora Core: proxy runs afoul of SELinux defaults

My Linux distro of choice is Debian, including its progeny.  I hadn’t used RedHat since version 6.  Unfortunately, RedHat’s installer kernel has better support for modern hardware, or at least Dell server hardware.  I had no desire to muck around with kernels anymore (time and opportunity cost issue), so I was “forced” to give RedHat another spin.  As you’ll read, I don’t much care for RedHat for vanilla server installs, and particularly I had trouble (admittedly born out of ignorance) setting up Apache to run as a proxy server.

I didn’t like that a minimal install of RedHat (Fedora Core 5) still has a lot of services and applications installed.  I don’t think it’s wrong to do so; I can see they were aiming for a Windows-like install and user experience.  However, like Windows, its good until you run into a problem, at which point one needs to figure out which of many services is the culprit.  It’s also wasteful (CPU, memory, administrative time) if you know exactly what you want, but that’s the Debian-on-obsolete-hardware veteran talking.

For me, the main stumbling block going to RedHat again is that RedHat follows the SELinux guidelines out of the box.  This means that it’s been somewhat hardened and uses ACLs.  It’s a fine idea, but clearly the default setup was configured with workstations in mind.  I wanted to do was set up Apache as a proxy server, but it wasn’t as easy as running yum.

The Apache error log showed a message every time someone external accessed the site, but it wasn’t helpful at all: [error] (13)Permission denied: proxy: HTTP: attempt to connect to 127.0.0.1:11235 (localhost) failed

It took me awhile to realize what was going on; when I started I wasn’t even aware of the use of ACLs.  Eventually, I’d read enough on semi-related SELinux and RedHat issues, including a newsgroup post in German, and figured that I needed to setsebool httpd_can_network_connect true to permit the Apache process to connect to other machines.  There’s some additional steps to make it “sticky” between reboots.

Knowing that string, httpd_can_network_connect, it’s easy to find references to the problem/solution.  Starting from the problem, however, was very frustrating.  So for the search engines: if you’re using RedHat Fedora Core, running Apache as a proxy server, and getting Permission denied: proxy errors, you may need to run setsebool httpd_can_network_connect true.

Perhaps an uncalled for comment, but if this was Debian, I’d have gotten a screen explaining the trade-offs during the installation process.  Surely making use of Apache’s fantastic proxy capabilities isn’t that uncommon, is it?

Somce nice cars

I’m not a car person.  I appreciate a nice ride, and being in an expensive car is mildly interesting, but I barely know how combustion engines work, much less model numbers, designs, etc.

It’s an unfair coincidence then that my former employer once gave me the opportunity to see his impressive car collection while I was vacationing in his home city.  The following pictures are from his garage from that visit awhile ago.  I hope it’s not inappropriate for me to post them.  I’d forgotten about them, but it came up in conversation recently. Since it’s mostly friends and acquaintances that visit this blog, some of whom appreciate cars, I’ll post a few.


Some kind of Ferrari (I told you I don’t appreciate cars).


Readers will have to recognize this one on their own.  I wonder if this was the one that he told me ran on some strange fuel blend… alcohol or something like that?  Some of these cars were decades old yet went at speeds that would put many modern sports cars to shame.


An Aston Martin.  Being cautioned not to lean on the aluminium (?) chassis, because it dented easily, is probably why I remember it better.  The owner was kind enough to “pop the hood” (carefully removing a metal sheet) for a picture of the engine.


I think this is the guts of one of the older Ferrari models.  I was impressed by how unusual (for my experience) it was designed, e.g. engine in the back.


Another older Ferrari of some sort.


The “cockpit” of of one of the Ferrari race cars.  I got to sit in this one; it was incredibly difficult to get in and out, particularly with my boots – the inch of rubber heel caught on the edges of the tiny “doorway” (more of a chute).  The funny thing is that I was told these were considered “two seaters” (condition for the classification of cars being raced), yet you could only fit a baby or perhaps small child in the makeshift “passenger” seat.


Yet another Ferrari (notice a pattern?).  I thought this one looked particularly nice, but I’m biased by my limited experience seeing only modern race cars while channel flipping.

You can see all the pictures I took at Flickr, under “nicecars”.  Ignore the last one of the car on the street – that was just some random car.

Follow

Get every new post delivered to your Inbox.