Webalizer and vsftpd problems.

[Vernon Brown_4]

On a new installation of Fedora Core 5 running Apache and virtual hosting 4 internet domains, I see the console full of error messages each morning. They seem to come from webalizer. The box was working without errors as a Windows workstation installed on drive hda2 before the FC 5 installation. The Windows workstation duel booted to FC 4 installed on hdb1 and hdb2.

The four domains seem to be working; serving out web pages and mysql based phpBB forums.

I see similar errors in /var/log/messages when attempting to ftp to the box; it is running vsftpd.

Can anyone interpret or offer insight to the meaning of the error messages ??


Following is output of df -h:

Filesystem Size Used Avail Use% Mounted on
/dev/hda2 72G 3.4G 65G 5% /
/dev/hda1 101M 14M 82M 15% /boot
tmpfs 252M 0 252M 0% /dev/shm
/dev/hdb1 18G 707M 17G 5% /home
/dev/hdb2 18G 600M 17G 4% /var

Example is one of hundreds of identical error messages from /var/log/messages:

Jun 13 04:02:45 veb kernel: audit(1150189358.760:66606): avc: denied { create } for pid=11642 comm="webalizer" scontext=user_u:system_r:webalizer_t:s0 tcontext=user_u:system_r:webalizer_t:s0 tclass=netlink_route_socket

Example when attempting to log in with ftp:

Jun 13 08:56:23 veb kernel: audit(1150206983.866:66608): avc: denied { search } for pid=13740 comm="vsftpd" name="/" dev=hdb1 ino=2 scontext=user_u:system_r:ftpd_t:s0 tcontext=system_u:object_r:home_root_t:s0 tclass=dir

Example of console of box attempting to ftp:

331 Please specify the password.
Password:
500 OOPS: cannot change directory:/home/veb
Login failed.
421 Service not available, remote server has closed connection
ftp> bye

When I create a user account directly under / I can ftp to that account.
Does anyone have any idea what the problem may be: permissions maybe, but where ??

[Steven E. Protter · Accepted solution]

Shalom Vernon,

Seems that the message originates from selinux.

Are your running it? If so, you may need to change the rules.

As an experiment, try turning off selinux and see if the messages stop.

If this solves the problem, it should be possible to modify selinux to permit this traffic.

SEP

[Vernon Brown_4]

Thanks Steven; you nailed it !!

I disabled selinux and ftp works. I'm guessing error messages will also go away.

I'll work on selinux policy.

Vernon