Обсуждение: problem connecting to postgres via apache

On 01/23/2014 02:55 PM, Susan Cassidy wrote:
> I'm having a problem connecting to postgres via a CGI program.  I can
> connect just fine using the same connect string in a non-cgi perl
> program as in the perl cgi program.  The error I get is this:
>
>
>         ERROR: Unable to connect to dbname testdb2, err: could not
>         connect to server: Permission denied
>         Is the server running on host "jacensolo.red.dsic.com
>         <http://jacensolo.red.dsic.com>" (192.168.10.16) and accepting
>         TCP/IP connections on port 5432?

FYI, in the future you might want to anonymize your host information.
For example   xxx.yyy.zzz.com

Well from the above it looks like you where trying to connect using
TCP/IP not a socket.

What is your connection string?

>
> I tried adding postgres to the apache user's groups, because I saw
> something on google that said that that is needed for the socket
> connection to work, but it didn't help.
>
> I just tried stopping and restarting apache, and when I try to start I
> get this:
>
>
> apachectl start
> (13)Permission denied: make_sock: could not bind to address [::]:80
> (13)Permission denied: make_sock: could not bind to address 0.0.0.0:80
> <http://0.0.0.0:80>
> no listening sockets available, shutting down
> Unable to open logs
>
> I took away the group permission for postgres, just in case that had
> messed up something, but it didn't help.  Now I can't even start apache.

To me it looks like it is already running.

>
>
> Susan
>
>


--
Adrian Klaver
adrian.klaver@gmail.com

Susan Cassidy <susan.cassidy@decisionsciencescorp.com> writes:
> $dbh = DBI->connect("dbi:Pg:dbname=$dbname;host=${dbserver};port=$dbport;",
> $dbuser, $dbpasswd) or
>  errexit( "Unable to connect to dbname $dbname, err: $DBI::errstr");

> The exact same connection string works fine in a standalone perl program.

Given the permissions errors you mentioned upthread, I'm wondering whether
you're running on Red Hat/CentOS, and if so whether SELinux is preventing
apache from connecting to unexpected port numbers.  I seem to recall
that there's a SELinux boolean specifically intended to allow or disallow
database connections from webservers, but I couldn't tell you the name
offhand.

            regards, tom lane

On 01/24/2014 09:35 AM, Susan Cassidy wrote:
> I've already checked that.  It is enabled.  I am running Scientific Linux.

SELinux is enabled?
The database connection value is enabled to allow or disallow webserver
connections?

>
>
> On Fri, Jan 24, 2014 at 8:28 AM, Tom Lane <tgl@sss.pgh.pa.us
> <mailto:tgl@sss.pgh.pa.us>> wrote:
>
>     Susan Cassidy <susan.cassidy@decisionsciencescorp.com
>     <mailto:susan.cassidy@decisionsciencescorp.com>> writes:
>      > $dbh =
>     DBI->connect("dbi:Pg:dbname=$dbname;host=${dbserver};port=$dbport;",
>      > $dbuser, $dbpasswd) or
>      >  errexit( "Unable to connect to dbname $dbname, err: $DBI::errstr");
>
>      > The exact same connection string works fine in a standalone perl
>     program.
>
>     Given the permissions errors you mentioned upthread, I'm wondering
>     whether
>     you're running on Red Hat/CentOS, and if so whether SELinux is
>     preventing
>     apache from connecting to unexpected port numbers.  I seem to recall
>     that there's a SELinux boolean specifically intended to allow or
>     disallow
>     database connections from webservers, but I couldn't tell you the name
>     offhand.
>
>                              regards, tom lane
>
>


--
Adrian Klaver
adrian.klaver@gmail.com

Are you calling the perl from apache (assuming yes)..? Does the web
user have the rights to execute the perl code?

Try disabling SELinux..
You'll get it..

On Fri, 2014-01-24 at 09:35 -0800, Susan Cassidy wrote:
> I've already checked that.  It is enabled.  I am running Scientific
> Linux.
>
>
>
> On Fri, Jan 24, 2014 at 8:28 AM, Tom Lane <tgl@sss.pgh.pa.us> wrote:
>         Susan Cassidy <susan.cassidy@decisionsciencescorp.com> writes:
>         > $dbh = DBI->connect("dbi:Pg:dbname=$dbname;host=
>         ${dbserver};port=$dbport;",
>         > $dbuser, $dbpasswd) or
>         >  errexit( "Unable to connect to dbname $dbname, err:
>         $DBI::errstr");
>
>         > The exact same connection string works fine in a standalone
>         perl program.
>
>         Given the permissions errors you mentioned upthread, I'm
>         wondering whether
>         you're running on Red Hat/CentOS, and if so whether SELinux is
>         preventing
>         apache from connecting to unexpected port numbers.  I seem to
>         recall
>         that there's a SELinux boolean specifically intended to allow
>         or disallow
>         database connections from webservers, but I couldn't tell you
>         the name
>         offhand.
>
>                                 regards, tom lane
>
>

    Susan Cassidy wrote:

> [scassidy@jacensolo ~]$ /usr/sbin/sestatus | grep SELinux
> SELinux status:                 enabled
> SELinuxfs mount:                /selinux
>
> I have yet to find what to do to enable webserver connections.

setsebool -P httpd_can_network_connect_db 1


Best regards,
--
Daniel
PostgreSQL-powered mail user agent and storage: http://www.manitou-mail.org

    Susan Cassidy wrote:

> Cannot set persistent booleans without managed policy.
> Could not change policy booleans
>
> I don't know what that means.

It probably means you're not root when issuing that command.
Become root or use sudo.

Best regards,
--
Daniel
PostgreSQL-powered mail user agent and storage: http://www.manitou-mail.org

On 1/24/2014 11:55 AM, Susan Cassidy wrote:
> I don't actually know what SELinux is.  What else will happen if I
> (find out how to) disable it?

your system will be less secure.



--
john r pierce                                      37N 122W
somewhere on the middle of the left coast

SELINUX is a bunch of settings to control security.

If you are able to find it, I was suggesting you disable it
only to see if the Apache problem goes away.

Then to turn it back on.

If it stops working, then there is a setting which is preventing
Apache from being accessed. Locating the specific setting
would be the next step.





On Fri, 2014-01-24 at 11:55 -0800, Susan Cassidy wrote:
> I don't actually know what SELinux is.  What else will happen if I
> (find out how to) disable it?
>
>
> Susan
>
>
>
> On Fri, Jan 24, 2014 at 9:47 AM, Bret Stern
> <bret_stern@machinemanagement.com> wrote:
>         Are you calling the perl from apache (assuming yes)..? Does
>         the web
>         user have the rights to execute the perl code?
>
>         Try disabling SELinux..
>         You'll get it..
>
>         On Fri, 2014-01-24 at 09:35 -0800, Susan Cassidy wrote:
>         > I've already checked that.  It is enabled.  I am running
>         Scientific
>         > Linux.
>         >
>         >
>         >
>         > On Fri, Jan 24, 2014 at 8:28 AM, Tom Lane
>         <tgl@sss.pgh.pa.us> wrote:
>         >         Susan Cassidy
>         <susan.cassidy@decisionsciencescorp.com> writes:
>         >         > $dbh = DBI->connect("dbi:Pg:dbname=$dbname;host=
>         >         ${dbserver};port=$dbport;",
>         >         > $dbuser, $dbpasswd) or
>         >         >  errexit( "Unable to connect to dbname $dbname,
>         err:
>         >         $DBI::errstr");
>         >
>         >         > The exact same connection string works fine in a
>         standalone
>         >         perl program.
>         >
>         >         Given the permissions errors you mentioned upthread,
>         I'm
>         >         wondering whether
>         >         you're running on Red Hat/CentOS, and if so whether
>         SELinux is
>         >         preventing
>         >         apache from connecting to unexpected port numbers.
>          I seem to
>         >         recall
>         >         that there's a SELinux boolean specifically intended
>         to allow
>         >         or disallow
>         >         database connections from webservers, but I couldn't
>         tell you
>         >         the name
>         >         offhand.
>         >
>         >                                 regards, tom lane
>         >
>         >
>
>
>
>

On 1/24/2014 12:19 PM, Bret Stern wrote:
> SELINUX is a bunch of settings to control security.
>
> If you are able to find it, I was suggesting you disable it
> only to see if the Apache problem goes away.

do NOT disable it.  set the selinux policy to 'permissive'.    this
causes it to log exceptions but allow them


--
john r pierce                                      37N 122W
somewhere on the middle of the left coast