CentOS 6.3. SSH. Bind to port xxx on 0.0.0.0 failed: Permission denied - ssh

CentOS 6.3 Minimal Configuration. Installed SSH Server, port 22. All works correctly.
I change port 22 on 777 and restart sshd and see in logs:
Jul 26 01:01:07 myserver sshd[1590]: error: Bind to port 777 on 0.0.0.0 failed: Permission denied.
Jul 26 01:01:07 myserver sshd[1590]: error: Bind to port 777 on :: failed: Permission denied.
Jul 26 01:01:07 myserver sshd[1590]: fatal: Cannot bind any address.
/etc/sysconfig/iptables contains:
-A INPUT -m state --state NEW -m tcp -p tcp --dport 777 -j ACCEPT
netstat -tulpn | grep :22 and netstat -tulpn | grep :777 return nothing


Centos uses SELinux by default and I don't think Ubuntu does (or least I've not seen it). Have a look for SElinux permission errors in your logs too.


SELinux does not allow sshd to be run on another port on a default install of CentOS 6.3. Follow -> https://blog.tinned-software.net/change-ssh-port-in-centos-with-selinux/ :
dig a hole into your firewall (you already did that)
add a rule for SELinux to allow sshd to be run on port 777: sudo semanage port -a -t ssh_port_t -p tcp 777


you can disable selinux with command sudo setenforce 0.
sudo setenforce 0
firewall-cmd --add-port=777/tcp --permanent
firewall-cmd --reload


Port 777 is dedicated for Multiling HTTP and even though not in use you can't bind to it. If you try for example to bind to port 8777 it will work just fine.


The problem is informing SELinux, but I think there are two cases:
the port is not already allocated for a built-in service, in such case, this may work:
sudo semanage port -a -t ssh_port_t -p tcp 22777
the port is overwriting some existing service (don't ask me why); in this case this slightly different syntax is necessary:
sudo semanage port --modify -t ssh_port_t -p tcp 777
Of course, such ports should be then made available by updating the firewall:
sudo firewall-cmd --add-port=22777/tcp --permanent
or
sudo firewall-cmd --add-port=777/tcp --permanent
and then:
sudo firewal-cmd --reload

Related

How to configure ssh to listen to private network IP address?

I have a system with centOS 7 installed. And on the second system I have windows 10. Both the machines are connected to private network. Now, I want to access the centOS machine remotely over ssh.
I checked the IP address of my windows machine, and then I edited the
/etc/ssh/sshd_config
file on the centOS system, With the following entries
ListenAddress <Ip_address_of_window_machine>
But when I restart the ssh service using the following command
systemctl restart sshd.service
I get the following error
bind to port 22 on <ip-address> failed. cannot assign requested address
But when I configure entries like this
ListenAddress 0.0.0.0
ListenAddress [::]
it works fine. But I want to bound my ssh to just particular iP-address

The ListenAddress configuration options tells sshd process to bind to a specific network interface on the server. If you want restrict access to a CentOS host then you need to use firewall. Though firewalld is the proper way to go (with zones and so on), old good iptables will do the job:
sudo iptables -A INPUT -p tcp -s a.b.c.d --dport ssh -j ACCEPT
sudo iptables -A INPUT -p tcp --dport ssh -j REJECT
Where a.b.c.d is the ip address of windows hosts.
NOTICE: By configuring firewall over the networks you can easily lock yourself out!

Redis: Creating Server TCP listening socket *:6388: bind: Permission denied

I have fresh ContOS 7 and redis (Redis 3.2.12) on it. Redis work great on default port 6379, but when I change the port in redis.conf I have Error msg in logs: # Creating Server TCP listening socket *:6388: bind: Permission denied. My firewall is disable (sudo firewall-cmd --state not running) and I don't know who can block it.

By default the SELinux is enable in your CentOS. Check it sudo vi /etc/selinux/config and you need to change SELINUX enforcing to disabled.

I had same problem, As Gabriel Pereira mentioned, configuring SELinux to accept port for redis fixed my problem.
semanage port -a -t redis_port_t -p tcp 6388
remember to change 6388 to your specified port number.

Iptables on centos 7 rejects SSH and WHM connection

I installed centos 7 and cPanel; disabled/masked firewalld and installed and enabled iptables. As soon as I enabled iptables, I disconnected from WHM and SSH. When I disable iptables in rescue mode, I can connect to server via SSH and WHM.
I checked the rules in /etc/sysconfig/iptables, but there is no any rule that rejects access to SSH or WHM ports.
My next step was to install CSF.
Any idea how to fix it?

The quick solution to get rid of the issue is flushing all the Iptables rules with the command
iptables -F
However since you want to keep the Iptables running you will have to configure it to open the required ports with the command
iptables -A INPUT -p tcp --dport 22 -j ACCEPT --- 22 is for SSH , same way you will have to open other ports.

httpd Server not started: (13)Permission denied: make_sock: could not bind to address [::]:88

I am trying to start httpd server on centos 6. It throws following error :
[root#machine ~]# service httpd start
Starting httpd: (13)Permission denied: make_sock: could not bind to address [::]:88
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:88
no listening sockets available, shutting down
Unable to open logs
[FAILED]
I have also checked for port 88, It is not is use.
I also checked with semanage, but it didn't help.
Any help will be appreciated.

I happened to run into this problem because of missing SELinux permissions. By default, SELinux only allowed apache/httpd to bind to the following ports:
80, 81, 443, 488, 8008, 8009, 8443, 9000
So binding to my httpd.conf-configured Listen 88 HTTP port and config.d/ssl.conf-configured Listen 8445 TLS/SSL port would fail with that default SELinux configuration.
To fix my problem, I had to add ports 88 and 8445 to my system's SELinux configuration:
Install semanage tools: sudo yum -y install policycoreutils-python
Allow port 88 for httpd: sudo semanage port -a -t http_port_t -p tcp 88
Allow port 8445 for httpd: sudo semanage port -a -t http_port_t -p tcp 8445

Seems like you are running it not as "root". Only root can bind to this port (80).
Check your configuration in the conf/httpd.conf file, Listen line and change the port to higher one.

This is an addition to the answer by Abdull somewhere in this thread:
I had to modify instead of adding a port
semanage port -m -t http_port_t -p tcp 5000
because I get this error on adding the port
ValueError: Port tcp/5000 already defined

At terminal run this command with root permission:
sudo /etc/init.d/apache2 start
You must be root for starting a webserver otherwise you would get similar error.

With my centos 6.7 installation, not only did I have the problem starting httpd with root but also with xauth (getting /usr/bin/xauth: timeout in locking authority file /.Xauthority with underlying permission denied errors)
# setenforce 0
Fixed both issues.

Disable SELinux
Disable SELinux temporarily
sudo setenforce 0
Restart httpd service
service httpd restart
Disable SELinux persistently (after reboot)
vi /etc/selinux/config
Add line and save
SELINUX=disabled

In my case, I tried to first use port 88 instead, and even then the httpd won't start.
I used the below command, i.e. modify instead of add, as suggested by one of users, and was able to run httpd.
semanage port -a -t http_port_t -p tcp 88

after disable SELINUX, any port is aviable.
sudo -s;
setenforce 0;
sed -i 's/SELINUX=enforcing/SELINUX=disabled/g' /etc/selinux/config;

In Linux(Centos 6 or higher) ports from 0 to 1024 are reserved for system use.
you can force the system to bind to address any port lower than 1024 if you use root or privileged user.
I installed Apache-2.4 from source with non-root user and I solved this problem by allowing port higher than 1024(ex:8080) and modified http.conf file. chang Listen 80 to Listen 8080

I had similar error while trying to start httpd service for openstack train installation in RHEL 7.5 too.
-- Unit httpd.service has begun starting up.
Jan 31 10:11:16 controller httpd[1631]: (13)Permission denied: AH00072: make_sock: could not bind to address 10.0.0.11:5000
Jan 31 10:11:16 controller httpd[1631]: no listening sockets available, shutting down
Jan 31 10:11:16 controller httpd[1631]: AH00015: Unable to open logs
Jan 31 10:11:16 controller systemd[1]: httpd.service: main process exited, code=exited, status=1/FAILURE
Jan 31 10:11:16 controller kill[1632]: kill: cannot find process ""
Jan 31 10:11:16 controller systemd[1]: httpd.service: control process exited, code=exited status=1
Jan 31 10:11:16 controller systemd[1]: Failed to start The Apache HTTP Server.
-- Subject: Unit httpd.service has failed
Solution: It got resolved by disabling SElinux.

I edited /etc/selinux/config, set SELINUX=disabled, then reboot; then it worked.
Alternately, you can run setenforce 0; you don't need reboot, but this is once used.

Just to add more info about this error, I had the similar error on CentOS 8.2:
sudo journalctl -xe
Error:
Permission denied: AH00072: make_sock: could not bind to address 0.0.0.0:8081
So, I used the commands from Abdull and Ulrich-Lorenz Schlüter as a follow:
Install semanage tools for CentOS 8.2: sudo yum -y install policycoreutils-python-utils
(For more info: https://www.cyberciti.biz/faq/redhat-install-semanage-selinux-command-rpm )
Allow port 8081 for httpd: sudo semanage port -a -t http_port_t -p tcp 8081
I got the following output: ValueError: Port tcp/8081 already defined
So, I ran:
sudo semanage port -m -t http_port_t -p tcp 8081
As Ulrich-Lorenz Schlüter mentioned.
Then: sudo systemctl start httpd
Now it is working fine.

The actual solution here is to modify the existing port if it exists. For instance, when:
semanage port -a -t http_port_t -p tcp 88
ends up with:
ValueError: Port tcp/88 already defined
then it's very likely the port is having a different type, and to modify it, simply use:
semanage port -m -t http_port_t -p tcp 88
and then, you need to open that port via firewall-cmd if has been closed in your zone.
Also: disabling SELinux is a potential security vulnerability, don't do this on production instances!

Start with root user or with sudo, it works fine, here is sample output:
[ec2-user#ip-172-31-12-164 ~]$ service httpd start
Starting httpd: (13)Permission denied: make_sock: could not bind to address [::]:80
(13)Permission denied: make_sock: could not bind to address 0.0.0.0:80
no listening sockets available, shutting down
Unable to open logs
**[FAILED]**
[ec2-user#ip-172-31-12-164 ~]$ sudo service httpd start
Starting httpd: [ OK ]
[ec2-user#ip-172-31-12-164 ~]$ sudo service httpd status
httpd (pid 3077) is running...

First kill all the hanged instances of httpd, and then try restarting Apache:
service httpd restart

Run Apache on port 81 with SeLinux Off

I have done "semanage port -a -t http_port_t -p tcp 81" and modified httpd.conf to listen on port 81. After restart httpd service it is not working. but it is working with default port 80. I have checked my SeLinux and it is in fact disabled. Can some one get me out of it?

Any chance you have iptables blocking port 81?
iptables -L