selinux - Security-Enhanced Linux, Kernel security module with policies.
semanage port -l).sshd_t), preventing privilege escalation.getsebool -a | grep ssh).When enabled, SELinux it enhances SSH security, making it harder for attackers to compromise the system.
sestatus Shows whether SELinux is enabled, enforcing, or permissive.
setenforce 0 Switches SELinux to permissive mode (logs but does not enforce policies).
setenforce 1 Switches SELinux back to enforcing mode.
This is set in the file: /etc/selinux/config it will set SELinux to Enforce mode when booting automatically.
SELINUX=enforcing # This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
# See also:
#
# NOTE: Up to RHEL 8 release included, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
#
# grubby --update-kernel ALL --args selinux=0
#
# To revert back to SELinux enabled:
#
# grubby --update-kernel ALL --remove-args selinux
#
SELINUX=enforcing
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targetedThis is set in the file: /etc/selinux/config it will set SELinux to Permissive mode when booting automatically.
SELINUX=Permissive
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
#
# NOTE: Up to RHEL 8 release included, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
#
# grubby --update-kernel ALL --args selinux=0
#
# To revert back to SELinux enabled:
#
# grubby --update-kernel ALL --remove-args selinux
#
SELINUX=Permissive
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
This is set in the file: /etc/selinux/config it will Disable SELinux at boot automatically.
SELINUX=disabled
# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
# enforcing - SELinux security policy is enforced.
# permissive - SELinux prints warnings instead of enforcing.
# disabled - No SELinux policy is loaded.
# See also:
#
# NOTE: Up to RHEL 8 release included, SELINUX=disabled would also
# fully disable SELinux during boot. If you need a system with SELinux
# fully disabled instead of SELinux running with no policy loaded, you
# need to pass selinux=0 to the kernel command line. You can use grubby
# to persistently set the bootloader to boot with selinux=0:
#
# grubby --update-kernel ALL --args selinux=0
#
# To revert back to SELinux enabled:
#
# grubby --update-kernel ALL --remove-args selinux
#
SELINUX=disabled
# SELINUXTYPE= can take one of these three values:
# targeted - Targeted processes are protected,
# minimum - Modification of targeted policy. Only selected processes are protected.
# mls - Multi Level Security protection.
SELINUXTYPE=targeted
List and Manage SELinux Ports
semanage port -l | grep ssh semanage port -a -t ssh_port_t -p tcp 2222 The term "sebool" is not a standard or official name but rather shorthand sometimes used informally to refer to SELinux booleans or the tools (`getsebool`/`setsebool`) that manage them.
SELinux booleans are on/off switches that modify policy behavior at runtime, allowing flexible security adjustments without policy rewriting.
getsebool -a | grep ssh setsebool -P allow_ssh_keysign off Turning off allow_ssh_keysign disables host-based authentication that uses the server’s host keys for signing data, reducing potential attack vectors.
It doesn’t impact authorized_keys, which store individual user keys.
SELinux file security assigns unique labels to every file—including individual user files, home directories, and web server content—to enforce granular access permissions under defined policies.
ls -Z /path/to/file Displays SELinux security context for files.
restorecon -Rv /path/to/directory Resets files to correct SELinux labels.
chcon -R -t httpd_sys_content_t /custom/path If SELinux blocks a service like Apache or SSH from accessing /custom/path, this should solve it.
This example is for httpd, seein in the httpd* part
SELinux Labels for User Home Directories and SSH/sshd
Typically, these labels include:
.ssh directories and related files.Note: These labels can vary slightly depending on the distribution and SELinux policy version.
chcon -R -t ssh_home_t /home/youruser/.ssh Check Permanent SELinux Booleans
semanage boolean -l | grep ssh Everything should look like this, unless you have specific needs.
Check So SSH is only allowed to run 22
semanage port -a -t ssh_port_t -p tcp 2222 It should look like this: