Re: [CentOS] SELinux context for ssh host keys?

2015-02-10 Thread James B. Byrne
On Tue, February 10, 2015 04:18, Andrew Holway wrote: On 10 February 2015 at 06:32, Mark Tinberg mark.tinb...@wisc.edu wrote: On Feb 9, 2015, at 12:27 PM, Robert Nichols rnicholsnos...@comcast.net wrote: On 02/09/2015 11:14 AM, James B. Byrne wrote: So, I decided to run restorecon

Re: [CentOS] SELinux context for ssh host keys?

2015-02-10 Thread Jonathan Billings
On Tue, Feb 10, 2015 at 09:34:13AM -0500, James B. Byrne wrote: I am startled to learn, if it is a fact, that existing SELinux policy is tied to the default file names. Given that the host key file names are user configurable in in sshd_config one would think that a slightly more flexible

Re: [CentOS] SELinux context for ssh host keys?

2015-02-10 Thread James B. Byrne
On Tue, February 10, 2015 09:25, James B. Byrne wrote: By mistake. Sorry for the otherwise empty quoted reply. I have no idea what I pressed that sent it off while I was reading. And, since I am committed to writing anyway, recall that a host key goes into /etc/ssh. Personal keys go into

Re: [CentOS] SELinux context for ssh host keys?

2015-02-10 Thread Andrew Holway
On 10 February 2015 at 06:32, Mark Tinberg mark.tinb...@wisc.edu wrote: On Feb 9, 2015, at 12:27 PM, Robert Nichols rnicholsnos...@comcast.net wrote: On 02/09/2015 11:14 AM, James B. Byrne wrote: So, I decided to run restorecon -v to ... restorecon reset

Re: [CentOS] SELinux context for ssh host keys?

2015-02-09 Thread Mark Tinberg
On Feb 9, 2015, at 12:27 PM, Robert Nichols rnicholsnos...@comcast.net wrote: On 02/09/2015 11:14 AM, James B. Byrne wrote: So, I decided to run restorecon -v to ... restorecon reset /etc/ssh/ssh_host_rsa_key_4096 context

[CentOS] SELinux context for ssh host keys?

2015-02-09 Thread James B. Byrne
I generated a new host key for one of our systems using: ssh-keygen -t rsa -b 4096 -f ssh_host_rsa_key_4096 I then ran 'ls -Z on the keys' ll -Z *key* -rw---. root root system_u:object_r:sshd_key_t:s0 ssh_host_dsa_key -rw-r--r--. root root system_u:object_r:sshd_key_t:s0

Re: [CentOS] SELinux context for ssh host keys?

2015-02-09 Thread Robert Nichols
On 02/09/2015 11:14 AM, James B. Byrne wrote: So, I decided to run restorecon -v to presumably set the SELinux user correctly for the new keys: But that is not what happened: restorecon -v * restorecon reset /etc/ssh/ssh_host_rsa_key_4096 context