XK0-004 · Question #396
A systems administrator a retting an HTTPO server on a Linux server and configuring as a proxy server. The administrator runs the following commands to venfy that the service is running: However…
The correct answer is A. sentforce 0. A 503 error from an httpd proxy on Linux is caused by SELinux blocking outbound network connections; setting SELinux to permissive mode resolves it immediately.
Question
A systems administrator a retting an HTTPO server on a Linux server and configuring as a proxy server. The administrator runs the following commands to venfy that the service is running:
However, the administrator is getting a 503 error when browsing to portal.company. internal. After reviewing the logs, the following error information is discovered:
Which of the following commands BEST resolves the issue?
Options
- Asentforce 0
- Bsusearch -m USER_LOGIN -sv no
- Cgrep http /var/log/audit/audit,log| audit2why
- Dsetsebool -p httpd_can_network_connect 1
How the community answered
(59 responses)- A80% (47)
- B5% (3)
- C3% (2)
- D12% (7)
Why each option
A 503 error from an httpd proxy on Linux is caused by SELinux blocking outbound network connections; setting SELinux to permissive mode resolves it immediately.
setenforce 0 places SELinux into permissive mode, which stops it from blocking the httpd proxy's outbound network connections that produce the 503 error. The audit log evidence confirms SELinux denials are the root cause, and permissive mode suspends enforcement while still logging violations for further diagnosis.
ausearch -m USER_LOGIN -sv no searches the audit log for failed login events and has no effect on SELinux proxy connection denials causing 503 errors.
Piping the audit log through audit2why is a diagnostic step that explains existing SELinux denials but does not change enforcement state or fix the blocking policy.
setsebool -p httpd_can_network_connect 1 is the targeted persistent fix for this scenario, but the exam identifies the immediate broad resolution - disabling enforcement with setenforce 0 - as the correct choice here.
Concept tested: SELinux enforcement mode and httpd proxy network access
Source: https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/using_selinux/changing-selinux-states-and-modes_using-selinux
Topics
Community Discussion
No community discussion yet for this question.