diff --git a/content/includes/installation/add-ports-agent-selinux.md b/content/includes/installation/add-ports-agent-selinux.md new file mode 100644 index 000000000..27c8e3429 --- /dev/null +++ b/content/includes/installation/add-ports-agent-selinux.md @@ -0,0 +1,17 @@ +--- +docs: +files: + - content/nginx-one/agent/configure-instance-reporting/configure-selinux.md + - content/nim/system-configuration/configure-selinux.md + - content/nms/nginx-agent/install-nginx-agent.md +--- + +Make sure to add external ports to the firewall exception list. + +To allow external ports outside the HTTPD context, run: + +```bash +sudo setsebool -P httpd_can_network_connect 1 +``` + +{{}}For more information, see [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/).{{}} \ No newline at end of file diff --git a/content/includes/installation/agent-selinux.md b/content/includes/installation/agent-selinux.md deleted file mode 100644 index 4a8cf0741..000000000 --- a/content/includes/installation/agent-selinux.md +++ /dev/null @@ -1,11 +0,0 @@ ---- -docs: DOCS-1403 ---- - -```bash -sudo semodule -n -i /usr/share/selinux/packages/nginx_agent.pp -sudo /usr/sbin/load_policy -sudo restorecon -R /usr/bin/nginx-agent -sudo restorecon -R /var/log/nginx-agent -sudo restorecon -R /etc/nginx-agent -``` diff --git a/content/includes/installation/enable-agent-selinux.md b/content/includes/installation/enable-agent-selinux.md new file mode 100644 index 000000000..482ee61c1 --- /dev/null +++ b/content/includes/installation/enable-agent-selinux.md @@ -0,0 +1,23 @@ +--- +docs: +files: + - content/nginx-one/agent/configure-instance-reporting/configure-selinux.md + - content/nim/system-configuration/configure-selinux.md + - content/nms/nginx-agent/install-nginx-agent.md +--- + +The following SELinux files are added when you install the NGINX Agent package: + +- `/usr/share/selinux/packages/nginx_agent.pp` - loadable binary policy module +- `/usr/share/selinux/devel/include/contrib/nginx_agent.if` - interface definitions file +- `/usr/share/man/man8/nginx_agent_selinux.8.gz` - policy man page + +To load the NGINX Agent policy, run the following commands as root: + +```bash +sudo semodule -n -i /usr/share/selinux/packages/nginx_agent.pp +sudo /usr/sbin/load_policy +sudo restorecon -R /usr/bin/nginx-agent +sudo restorecon -R /var/log/nginx-agent +sudo restorecon -R /etc/nginx-agent +``` diff --git a/content/nginx-one/agent/configure-instance-reporting/configure-selinux.md b/content/nginx-one/agent/configure-instance-reporting/configure-selinux.md new file mode 100644 index 000000000..c954a7e42 --- /dev/null +++ b/content/nginx-one/agent/configure-instance-reporting/configure-selinux.md @@ -0,0 +1,43 @@ +--- +title: Configure SELinux +weight: 600 +toc: true +--- + +## Overview + +You can use the optional SELinux policy module included in the package to secure F5 NGINX Agent operations with flexible, mandatory access control that follows the principle of least privilege. + +{{< important >}}The SELinux policy module is optional. It is not loaded automatically during installation, even on SELinux-enabled systems. You must manually load the policy module using the steps below.{{< /important >}} + +## Before you begin + +Take these preparatory steps before configuring SELinux: + +1. Enable SELinux on your system. +2. Install the tools `load_policy`, `semodule`, and `restorecon`. +3. [Install NGINX Agent]({{< ref "/nginx-one/agent/install-upgrade/_index.md" >}}) with SELinux module files in place. + +{{< important >}}SELinux can use `permissive` mode, where policy violations are logged instead of enforced. Verify which mode your configuration uses.{{< /important >}} + +--- + +## Enable SELinux for NGINX Agent {#selinux-agent} + +{{< include "/installation/enable-agent-selinux.md" >}} + +### Add ports to NGINX Agent SELinux context + +{{< include "/installation/add-ports-agent-selinux.md" >}} + +--- + +## Recommended Resources + +- +- +- +- +- +- +- \ No newline at end of file diff --git a/content/nim/system-configuration/configure-selinux.md b/content/nim/system-configuration/configure-selinux.md index b9aa07184..9c906a3ad 100644 --- a/content/nim/system-configuration/configure-selinux.md +++ b/content/nim/system-configuration/configure-selinux.md @@ -118,27 +118,11 @@ sudo semanage port -d -t nms_t 11000 ## Enable SELinux for NGINX Agent {#selinux-agent} -The following SELinux files are added when you install the NGINX Agent package: - -- `/usr/share/selinux/packages/nginx_agent.pp` - loadable binary policy module -- `/usr/share/selinux/devel/include/contrib/nginx_agent.if` - interface definitions file -- `/usr/share/man/man8/nginx_agent_selinux.8.gz` - policy man page - -To load the NGINX Agent policy, run: - -{{< include "installation/agent-selinux.md" >}} +{{< include "/installation/enable-agent-selinux.md" >}} ### Add ports to NGINX Agent SELinux context -Make sure to add external ports to the firewall exception list. - -To allow external ports outside the HTTPD context, run: - -```bash -sudo setsebool -P httpd_can_network_connect 1 -``` - -{{}}For more information, see [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/).{{}} +{{< include "/installation/add-ports-agent-selinux.md" >}} --- diff --git a/content/nms/nginx-agent/install-nginx-agent.md b/content/nms/nginx-agent/install-nginx-agent.md index 0660ed391..e9a7552ec 100644 --- a/content/nms/nginx-agent/install-nginx-agent.md +++ b/content/nms/nginx-agent/install-nginx-agent.md @@ -400,31 +400,11 @@ Additionally, you can use the agent installation script to add these fields: ## SELinux for NGINX Agent -This section explains how to install and configure the SELinux policy for NGINX Agent. +{{< include "/installation/enable-agent-selinux.md" >}} -### Installing NGINX Agent SELinux Policy Module +### Add ports to NGINX Agent SELinux context -The NGINX Agent package includes the following SELinux files: - -- `/usr/share/man/man8/nginx_agent_selinux.8.gz` -- `/usr/share/selinux/devel/include/contrib/nginx_agent.if` -- `/usr/share/selinux/packages/nginx_agent.pp` - -To load the NGINX Agent policy, run the following commands: - -{{< include "installation/agent-selinux.md" >}} - -### Adding Ports for NGINX Agent SELinux Context - -You can configure NGINX Agent to work with SELinux. Make sure you add external ports to the firewall exception list. - -The following example shows how to allow external ports outside the HTTPD context. You may need to enable NGINX to connect to these ports. - -```bash -sudo setsebool -P httpd_can_network_connect 1 -``` - -For additional information on using NGINX with SELinux, refer to the guide [Using NGINX and NGINX Plus with SELinux](https://www.nginx.com/blog/using-nginx-plus-with-selinux/). +{{< include "/installation/add-ports-agent-selinux.md" >}} ---