[Linux study notes 23] selinux kernel-level enhanced firewall management (security context, Sebool, Seport, Setrouble)

1. Selinux

SELinux is the abbreviation of "Security-Enhanced Linux", which is an extended mandatory access control security module of Linux developed by the National Security Agency "NSA=The National Security Agency" and SCC (Secure Computing Corporation). It was originally developed on Fluke and released under the GNU GPL in 2000. SELinux is a mandatory access control (MAC) security system based on the domain-type model. It was written by NSA and designed as a kernel module to be included in the kernel. The corresponding security-related applications were also hit The SELinux patch has a corresponding security policy at the end.

Status: The most outstanding new security system
in Linux history. Quality: Mandatory Access Control (MAC) security system

1.1 Selinux closed state

• Files created in /mnt are moved to /var/ftp and can be accessed by the vsftpd service
• Anonymous users can upload files
• The file created in /mnt is used to ls -Zview the corresponding attribute content of the file is empty
• ps axZAn attribute of the process is missing when viewing the vsftpd process

1.2 Selinux on state

• Files created in /mnt are moved to /var/ftp and cannot be accessed by the vsftpd service
• Anonymous users can still not upload files after setting
• ls -ZInformation will be displayed when viewing files
• ps axZView vsftpd process

1.3 Impact of Selinux

Impact on files:
When selinux is turned on, the kernel will load tags for each file and each open program, and the security context of the program and file is recorded in the tag.

Effect on program function:
When selinux is turned on, the program function loading switch will be set, and the state of this switch will be set to off.
When this function is needed, the function switch needs to be turned on manually, this switch is called sebool

2. Selinux management status

State type	Explanation
Disabled	shut down
enforcing	Failure to meet the conditions must not be allowed, and receive a warning message
permissive	Not meeting the conditions is allowed, but will receive a warning message

2.1 Check status

getenforce: View selinux status

2.2 Selinux switching state

1. vim /etc/selinux/config: Edit the configuration file ( take effect after restart )

#selinux关闭
SELINUX=disabled
#selinux开机设定为强制状态，为selinux开启
SELINUX=enforcing
#selinux开机设定为警告状态，为selinux开启
SELINUX=permissive

2. Conversion between mandatory and warning levels after selinux is turned on ( effective immediately )

setenforce 0: Warning mode permissive
setenforce 1: mandatory mode enforcing

2.3 Selinux log location

/var/log/audit/audit.log

3. Selinux security context (Content)

3.1 View security context

ls -Z: View the security context of the file: View the security context of the
ls -Zddirectory
ps axZ: View the security context of the process

3.2 Temporarily modify the security context

1. chcon -t 标签 文件或目录: Temporarily modify the security context
   chcon -Rt 标签 目录: modify the security context of the directory and all sub-files in the directory
2. touch /.autorelabel: Selinux initialization file label switch file when restarting the system
3. Will be restored after restart

3.3 Permanently modify the security context

如果需要特殊指定安全上下文，需要修改内核安全上下文列表

1. semanage fcontext -l: View the list of kernel security contexts
2. semanage fcontext -a -t 标签 ‘目录(/.*)?’: Permanently modify the security context
3. restorecon -RvvF 目录: Refresh
4. touch /.autorelabel: Selinux initialization file label switch file when restarting the system

semanage fcontext命令：
-a	增加
-d	删除
-m	修改

4. Sebool

1. getsebool -a: Query the bool value of each rule in the Selinux policy
2. setsebool -P 标签 on或off : Modify the bool value

4.1 File upload failed

1. Condition 1: The file has write permission
2. Condition 2: Virtual users can upload
3. Condition 3: Selinux is mandatory
4. Result: lftp 172.25.254.127uploading file to /var/ftp/pub/ failed

4.2 Modify Sebool solution

1. semanage fcontext -a -t public_content_rw_t ‘/var/ftp/pub(/.*)?’：Set the security context to read and write (uploadable)
2. restorecon -RvvF /var/ftp/pub/: Refresh
3. setsebool -P ftpd_anon_write on: Modify the bool value (allow anonymous users to write)
4. getsebool -a | grep ftp: Query the bool value of the ftp service

5. Seport (Selinux port label)

1. semanage port -l: View open ports
2. semanage port -a -t 标签 -p tcp 端口号: Add an open port
3. semanage port -d -t 标签 -p tcp 端口号: Delete open ports

• When the httpd service port number is changed to 6666, the httpd service fails to restart

• After adding the port, restart the httpd service successfully

• Restore the default port

6. SeTrouble (Selinux troubleshooting)

6.1 Setrouble installation and basic information

• Installed by default

Can rpm -qa | grep setroublecheck whether the installation

• Basic Information

1. /var/log/audit/audit.log: Selinux warning message
2. / var / log / messages: Selinux problem solution
3. setroubleshoot-server：The function of this software is to collect warning information and analyze the solution and store it in /var/log/messages

6.2 Setrouble experiment problem

• Problem: After moving the file to /var/ftp/, it cannot be viewed after lftp login

1. touch /mnt/file1: Create file
2. mv /mnt/file1 /var/ftp/: Move files to the default publishing directory
3. > /var/log/messages: Clear the log file (to prevent the difficulty of finding errors when viewing the log)
4. lftp 192.168.43.101: Can't view file1

6.3 Setrouble troubleshooting

• Look for solutions to the problem in the log

1. cat /var/log/messages: View log files
2. /sbin/restorecon -v /var/ftp/file1: The problem-solving command appears in the log, execute this command
3. lftp 192.168.43.101: You can view file1