SELinux alerts

[Tim]

On Sun, 2008-01-27 at 08:23 +0000, Colin Paul Adams wrote:
> The boolean for squid reads:
> 
> Allow squid to connect to all ports, not just HTTP, FTP and Gopher.
> 
> It is not checked. I'm not sure that I want to check it. I would first
> like to know what squid was trying to connect to. The alert did not
> tell me that (at least, if it did, i didn't understand it).
> 
> Is there a way I can find out which port was being accessed?
> Hm. It doesn't mention HTTPS, but maybe that is subsumed by HTTP. 

HTTPS isn't generally cached, that'd introduce a security weakness,
though it can be proxied.  That, too, has issues, but not as bad.

I'm still on FC7, and there's a different description for the boolean
option.  It just says "Allow Squid daemon to connect to network,"
without mentioning how much it allows.

Unless there's further options, you will need to check the option to
allow Squid to have HTTP access, at least.  What Squid can actually do,
you'd configure within the Squid configuration file.

-- 
(This computer runs FC7, my others run FC4, FC5 & FC6, in case that's
 important to the thread.)

Don't send private replies to my address, the mailbox is ignored.
I read messages from the public lists.