1
00:00:00,000 --> 00:00:08,240
So what are we going to do?

2
00:00:08,240 --> 00:00:11,920
Well, I'm going to start with the VIM on ETC SSH,

3
00:00:11,920 --> 00:00:14,480
SSHD underscore config.

4
00:00:14,480 --> 00:00:18,680
And there I'm looking up the port parameter.

5
00:00:18,680 --> 00:00:20,840
Here is the port parameter.

6
00:00:20,840 --> 00:00:22,799
If you look closely, two lines above,

7
00:00:22,799 --> 00:00:25,719
you can see exactly what to do, SCManagePort.

8
00:00:25,719 --> 00:00:29,360
But I want to show you what is going on.

9
00:00:29,360 --> 00:00:31,320
If you don't do that, then I would

10
00:00:31,320 --> 00:00:35,200
use systemctl restart SSHD.

11
00:00:35,200 --> 00:00:38,320
And oh, boy, I'm getting a message.

12
00:00:38,320 --> 00:00:42,840
So systemctl status on SSHD might give me

13
00:00:42,840 --> 00:00:44,840
more interesting information.

14
00:00:44,840 --> 00:00:46,119
In fact, it does not.

15
00:00:46,119 --> 00:00:47,480
That's disappointing.

16
00:00:47,480 --> 00:00:50,799
Journalctl minus U SSHD.

17
00:00:50,799 --> 00:00:52,200
Is that bringing me anything?

18
00:00:52,200 --> 00:00:53,959
Yeah, there we can see error.

19
00:00:53,959 --> 00:00:56,400
Bind to port 2022.

20
00:00:56,400 --> 00:00:58,560
Permission denied.

21
00:00:58,560 --> 00:01:00,880
Now, in normal troubleshooting, you

22
00:01:00,880 --> 00:01:04,120
would use set and force permissive try again.

23
00:01:04,120 --> 00:01:06,919
But I can tell you it will work in permissive mode.

24
00:01:06,919 --> 00:01:09,040
So I'm going to skip that step because I'm

25
00:01:09,040 --> 00:01:10,760
pretty sure about myself.

26
00:01:10,760 --> 00:01:13,160
And I'm going directly for the understanding.

27
00:01:13,160 --> 00:01:18,400
Grab AVC on var log audit audit.log.

28
00:01:18,400 --> 00:01:19,879
And what do we see?

29
00:01:19,879 --> 00:01:24,440
We see denied name bind for command SSHD.

30
00:01:24,440 --> 00:01:27,559
The source context is SSHD underscore T.

31
00:01:27,559 --> 00:01:31,720
And the target context is unreserved port underscore T.

32
00:01:31,720 --> 00:01:34,480
I can imagine that in the SELinux policy,

33
00:01:34,480 --> 00:01:39,160
there is no policy at all that allows this source context

34
00:01:39,160 --> 00:01:42,199
to go to this unknown target context.

35
00:01:42,199 --> 00:01:44,480
So we need to figure out what to do.

36
00:01:44,480 --> 00:01:50,080
One way would be to do man SEManagePort.

37
00:01:50,080 --> 00:01:53,760
Use uppercase G to go to the end and check

38
00:01:53,760 --> 00:01:57,000
if the help is useful.

39
00:01:57,000 --> 00:01:59,360
And in fact, the help is very useful.

40
00:01:59,360 --> 00:02:01,400
So you could copy this as well.

41
00:02:01,400 --> 00:02:02,000
You know what?

42
00:02:02,000 --> 00:02:04,519
I'm going to copy it so that it is done.

43
00:02:04,519 --> 00:02:06,959
We don't have the right port here.

44
00:02:06,959 --> 00:02:10,440
But if I paste it, the only thing I need to do

45
00:02:10,440 --> 00:02:12,320
is change the port.

46
00:02:12,320 --> 00:02:14,479
And that should be doing it.

47
00:02:14,479 --> 00:02:19,639
But just for fun, I'm going to use journal CTL pipe

48
00:02:19,639 --> 00:02:22,279
grab SCAlert as well.

49
00:02:22,279 --> 00:02:24,759
I want to see what SCAlert is doing.

50
00:02:24,759 --> 00:02:26,839
So here is the SCAlert message.

51
00:02:26,839 --> 00:02:31,039
And I'm going to copy this SCAlert message,

52
00:02:31,039 --> 00:02:36,080
including the ID in the SELinux event database

53
00:02:36,080 --> 00:02:37,559
so that we can look it up.

54
00:02:37,559 --> 00:02:39,199
And then I'm going to paste.

55
00:02:39,199 --> 00:02:40,919
And I'm pasting it through LES.

56
00:02:40,919 --> 00:02:42,320
And what do we see?

57
00:02:42,320 --> 00:02:46,119
It's telling us SEManagePort minus A minus C port type

58
00:02:46,119 --> 00:02:48,759
minus B TCP 2022.

59
00:02:48,759 --> 00:02:51,600
The only thing that we need to figure out for ourselves

60
00:02:51,600 --> 00:02:56,119
is from this list of three this time which port type to use.

61
00:02:56,119 --> 00:02:59,320
And hey, that is what we just did, right?

62
00:02:59,320 --> 00:03:01,360
So we should be OK.

63
00:03:01,360 --> 00:03:03,160
And oops, I already did it.

64
00:03:03,160 --> 00:03:09,399
And at this point, system CTL restart SSHD should be working.

65
00:03:09,399 --> 00:03:13,960
Don't forget that you need SSH minus B 2022

66
00:03:13,960 --> 00:03:17,839
to connect to localhost from now on.