mirror of
https://github.com/Yubico/yubico-pam.git
synced 2024-11-29 00:24:11 +01:00
24 lines
1.4 KiB
Plaintext
24 lines
1.4 KiB
Plaintext
== Enable HTTP connection for sshd
|
|
|
|
Starting with Fedora 17, SELinux prevents sshd to initiate connections to remote HTTP ports (80 and 443). In SELinux terms: sshd_t is not allowed to name_connect to http_port_t. This broke YubiKey authentication on a system with SELinux in enforcing mode, unless a custom SELinux policy was written and enabled.
|
|
|
|
Based on a https://bugzilla.redhat.com/show_bug.cgi?id=841693[bugreport] in Red Hat Bugzilla, a boolean was added to the SELinux policy for Fedora 18 and up, that can be toggled to allow sshd (and some other SELinux types) to connect to remote HTTP ports.
|
|
|
|
To make a long story short, if you want to use a YubiKey on a system running Fedora 18 or higher (and probably RHEL7, eventually), you'll need to toggle the 'authlogin_yubikey' SELinux boolean, like so:
|
|
|
|
setsebool -P authlogin_yubikey 1
|
|
|
|
If you are using your own server via `urllist`/`url` in the pam conf file and using a non-standard http port, you will need to add that port to the `http_port_t` port list. For example, port `12345`:
|
|
|
|
semanage port -a -t http_port_t -p tcp 12345
|
|
|
|
== Enable debug_file support for sshd
|
|
|
|
By default, SELinux prevents sshd from opening local files other than SSH configuration files. If you would like to debug this module using `debug` and `debug_file` parameters, you may need to temporarily relax your SELinux confinement:
|
|
|
|
setenforce permissive
|
|
|
|
Don't forget to re-enable SELinux once you're done:
|
|
|
|
setenforce enforcing
|