Plesk Panel 11 for Linux (CentOS 6) & SELinux

[PriyanA]

Hi,

I'd like to use SELinux on my VPS (Plesk Panel 11, CentOS 6, Newly Built) as a extra security feature.

Came across many posting that Plesk NOT recommending to use SELinux "Enforcing"

Have anyone successfully done this?

Please post your ideas.

 

[Nikolay.]

PriyanA, there's no sense in blaming SELinux unless you post your relevant audit log file entries and 'plesk' SELinux module version. List of enabled and disabled SELinux booleans may also help track down the issue.

While it's true that there are problems with SELinux support on Plesk servers here and there, clean installation of Plesk should behave well. You may also want to run restorecon on any offending files seen in audit log first.

 

[Nikolay.]

Okay, looks like some kind of trouble with SELinux booleans used by Plesk.

Try:
# getsebool -a | grep httpd_can_bind_all_ports

If it shows that it's off, then try to re-enable nginx as a reverse proxy server:
# /usr/local/psa/admin/bin/nginxmng -d
# /usr/local/psa/admin/bin/nginxmng -e

If there is no output at all (edit: from the getsebool command above), then this most probably means that you have wrong 'plesk' SELinux module version (or none at all), hence in much more trouble than only httpd start problems.

Hope this helps.

 

[PriyanA]

thank you very much adding ports solve the problem.

also applied drweb and mailog policies

 

[Nikolay.]

Glad I could be of assistance.

So your problem is solved? Did you install appropriate version of 'plesk' SELinux module then?

 

[Nikolay.]

Unfortunately, you will have countless problems unless you install proper policy module.

To find out which version of Plesk policy module is installed:
# semodule -l | grep plesk

To manually (re)install current version of Plesk policy:
# semodule -s targeted -i /usr/local/psa/etc/plesk.pp
or maybe without "-s targeted" or with other store depending on your system.

But I recommend just running /usr/local/psa/etc/selinux_policy_upgrade_trigger instead.

 

[PriyanA]

Nikolay. thank you very much for your support.

Ive seems overcome all the problems and plesk+domains are working fine. i'll post the full steps once my VPS is re-built. hoping it will help someone looking for additional security.

 

[PriyanA]

Posted @ http://forum.parallels.com/showthread.php?287002-Plesk-11-(CentOS-6_64bit)-amp-SELinux-Working-Fine!.

Please correct me if im wrong!