eth0: 10.10.10.12 and 10.10.10.13
eth1: 192.168.200.12 and 192.168.200.13
Here are the netlabel rules on each host:
map del default
map add default address:0.0.0.0/0 protocol:unlbl
cipsov4 add pass doi:5 tags:5
map add default address:127.0.0.0/8 protocol:cipsov4,5
map add default address:10.10.10.12 protocol:cipsov4,5
# or map add default address:10.10.10.13 protocol:cipsov4,5
# Trusted Network
map add default address:192.168.200.0/24 protocol:cipsov4,5
unlbl accept on
unlbl add interface:eth0 address:10.10.10.0/24 label:system_u:object_r:netlabel_peer_t:s0 -s15:c0.c1023
I have sshd configured to be served out from xinetd with the LABELED flags setting. This has been tested and works for unlbl rules assigned to eth1. If I have the rules configured as above with cipsov4 pass through, the attempt to ssh hangs with no meaningful data on either side of the connection. I've turned off the SELinux dontaudit rules, but don't see any meaningful data there.
Hi Paul,
Yes, I've been able to assign Netlabel labeled networks in RHEL 6.8+. I've tried on these hoses in both enforcing and permissive mode, but don't see any AVC denials. I have turned off the dontaudit rules as well and don't see anything beyond { rlimitinh siginh noatsecure } for ssh.
I've run tcpdump on the interfaces.
Sending host:
# tcpdump -nvv -i eth4
tcpdump: listening on eth4, link-type EN10MB (Ethernet), capture size 65535 bytes
07:22:43.520591 IP (tos 0x0, ttl 64, id 65251, offset 0, flags [DF], proto TCP (6), length 76, options (unknown 134,EOL))
192.168.200.8.33774 > 192.168.200.7.ssh: Flags [S], cksum 0x1190 (incorrect -> 0x200c), seq 184895250, win 27200, options [mss 1360,sackOK,TS val 480885233 ecr 0,nop,wscale 7], length 0
07:22:44.523315 IP (tos 0x0, ttl 64, id 65252, offset 0, flags [DF], proto TCP (6), length 76, options (unknown 134,EOL))
192.168.200.8.33774 > 192.168.200.7.ssh: Flags [S], cksum 0x1190 (incorrect -> 0x1c21), seq 184895250, win 27200, options [mss 1360,sackOK,TS val 480886236 ecr 0,nop,wscale 7], length 0
07:22:46.527317 IP (tos 0x0, ttl 64, id 65253, offset 0, flags [DF], proto TCP (6), length 76, options (unknown 134,EOL))
192.168.200.8.33774 > 192.168.200.7.ssh: Flags [S], cksum 0x1190 (incorrect -> 0x144d), seq 184895250, win 27200, options [mss 1360,sackOK,TS val 480888240 ecr 0,nop,wscale 7], length 0
07:22:48.527309 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.200.7 tell 192.168.200.8, length 28
07:22:48.528058 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.200.7 is-at fa:16:3e:b9:b5:f1, length 28
07:22:50.535313 IP (tos 0x0, ttl 64, id 65254, offset 0, flags [DF], proto TCP (6), length 76, options (unknown 134,EOL))
192.168.200.8.33774 > 192.168.200.7.ssh: Flags [S], cksum 0x1190 (incorrect -> 0x04a5), seq 184895250, win 27200, options [mss 1360,sackOK,TS val 480892248 ecr 0,nop,wscale 7], length 0
07:22:58.543321 IP (tos 0x0, ttl 64, id 65255, offset 0, flags [DF], proto TCP (6), length 76, options (unknown 134,EOL))
192.168.200.8.33774 > 192.168.200.7.ssh: Flags [S], cksum 0x1190 (incorrect -> 0xe55c), seq 184895250, win 27200, options [mss 1360,sackOK,TS val 480900256 ecr 0,nop,wscale 7], length 0
^C
7 packets captured
7 packets received by filter
0 packets dropped by kernel
Receiving host:
# tcpdump -nvv -i eth4
tcpdump: listening on eth4, link-type EN10MB (Ethernet), capture size 65535 bytes
07:22:48.243301 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.200.7 tell 192.168.200.8, length 28
07:22:48.243313 ARP, Ethernet (len 6), IPv4 (len 4), Reply 192.168.200.7 is-at fa:16:3e:b9:b5:f1, length 28
^C
2 packets captured
2 packets received by filter
0 packets dropped by kernel
## ssh attempt ###
$ ssh -vv 192.168.200.7
OpenSSH_6.6.1, OpenSSL 1.0.1e-fips 11 Feb 2013
debug1: Reading configuration data /etc/ssh/ssh_config
debug1: /etc/ssh/ssh_config line 56: Applying options for *
debug2: ssh_connect: needpriv 0
debug1: Connecting to 192.168.200.7 [192.168.200.7] port 22.
^C
Is there a better network sniffer you would recommend that would be show the label on the packets?
Thanks
Josh
--
You received this message because you are subscribed to a topic in the Google Groups "netlabel" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/netlabel/yOk2z8LSRac/unsubscribe.
To unsubscribe from this group and all its topics, send an email to netlabel+unsubscribe@googlegroups.com.
To post to this group, send email to netl...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.