On Thu, 2005-01-09 at 07:53 +0100, Paul Howarth wrote: > On Wed, 2005-08-31 at 22:23 -0700, CHAT KHODA wrote: > > Dear friends, > > As you know new versions of fedora are comming with > > SELinux feature.I wonder to know whether it is a good > > idea to enable this feature on a web-mail server or > > not? .Somebody advised me ;this feature will cause > > disturbing circumstances,but I wish to know if you > > have any comment. > > A web/mail server is exactly the type of application that SELinux works > well with. You may have difficulty at first understanding it (read > http://fedora.redhat.com/docs/selinux-apache-fc3/ for a good start) but > it's worth the effort. Beware that SELinux is designed to provide a higher level of security than the standard file system and access controls built in to the applications. More specifically if you have anything that uses sendmail directly rather than using SMTP you will have problems. If possible configure you PHP, PERL or other software to use SMTP on localhost rather than using sendmail directly, it will save you some headaches. Overall I have only had few problems with RHEL4 and FC3 with SELinux enabled, and most were simple to work around, and left the system more secure in the process.
