Security-Enhanced Linux secures the ssh processes via flexible mandatory access control.
If you want to allow ssh with chroot env to read and write files in the user home directories, you must turn on the ssh_chroot_rw_homedirs boolean.
setsebool -P ssh_chroot_rw_homedirs 1
If you want to allow internal-sftp to read and write files in the user ssh home directories, you must turn on the sftpd_write_ssh_home boolean.
setsebool -P sftpd_write_ssh_home 1
If you want to allow ssh logins as sysadm_r:sysadm_t, you must turn on the ssh_sysadm_login boolean.
setsebool -P ssh_sysadm_login 1
If you want to allow host key based authentication, you must turn on the ssh_keysign boolean.
setsebool -P ssh_keysign 1
If you want to allow fenced domain to execute ssh, you must turn on the fenced_can_ssh boolean.
setsebool -P fenced_can_ssh 1
If you want to allow users to resolve user passwd entries directly from ldap rather then using a sssd serve for the ssh_keygen_t, sshd_t, ssh_t, you must turn on the authlogin_nsswitch_use_ldap boolean.
setsebool -P authlogin_nsswitch_use_ldap 1
If you want to allow confined applications to run with kerberos for the ssh_keygen_t, sshd_t, ssh_t, you must turn on the kerberos_enabled boolean.
setsebool -P kerberos_enabled 1
You can see the context of a file using the -Z option to lsP Policy governs the access confined processes have to these files. SELinux ssh policy is very flexible allowing users to setup their ssh processes in as secure a method as possible.
The following file types are defined for ssh:
ssh_agent_exec_t
- Set files with the ssh_agent_exec_t type, if you want to transition an executable to the ssh_agent_t domain.
ssh_agent_tmp_t
- Set files with the ssh_agent_tmp_t type, if you want to store ssh agent temporary files in the /tmp directories.
ssh_exec_t
- Set files with the ssh_exec_t type, if you want to transition an executable to the ssh_t domain.
ssh_home_t
- Set files with the ssh_home_t type, if you want to store ssh files in the users home directory.
ssh_keygen_exec_t
- Set files with the ssh_keygen_exec_t type, if you want to transition an executable to the ssh_keygen_t domain.
ssh_keysign_exec_t
- Set files with the ssh_keysign_exec_t type, if you want to transition an executable to the ssh_keysign_t domain.
ssh_tmpfs_t
- Set files with the ssh_tmpfs_t type, if you want to store ssh files on a tmpfs file system.
sshd_exec_t
- Set files with the sshd_exec_t type, if you want to transition an executable to the sshd_t domain.
sshd_initrc_exec_t
- Set files with the sshd_initrc_exec_t type, if you want to transition an executable to the sshd_initrc_t domain.
sshd_key_t
- Set files with the sshd_key_t type, if you want to treat the files as sshd key data.
sshd_keytab_t
- Set files with the sshd_keytab_t type, i