This is a beta release of documentation for Magento 2.4, published for previewing soon-to-be-released functionality. Content in this version is subject to change. Links to the v2.4 code base may not properly resolve until the code is officially released.
You must install Elasticsearch before installing Magento Commerce or Magento Open Source 2.4.0. See Elasticsearch for details.

SELinux and iptables

Edit on GitHub
Log an Issue

SELinux

Security Enhanced Linux (SELinux) enables CentOS and Ubuntu administrators greater access control over their servers. If you are using SELinux and Apache must initiate a connection to another host, you must run the commands discussed in this section.

Magento has no recommendation about using SELinux; you can use it for enhanced security if you wish. If you use SELinux, you must configure it properly or the Magento application will function unpredictably. If you choose to use SELinux, consult a resource like the CentOS wiki to set up rules to enable communication.

Suggestion for installing the Magento software with Apache

If you choose to enable SELinux, you might have issues running the installer unless you change the security context of some directories as follows:

1

chcon -R --type httpd_sys_rw_content_t <magento_root>/app/etc

1

chcon -R --type httpd_sys_rw_content_t <magento_root>/var

1

chcon -R --type httpd_sys_rw_content_t <magento_root>/pub/media

1

chcon -R --type httpd_sys_rw_content_t <magento_root>/pub/static

1

chcon -R --type httpd_sys_rw_content_t <magento_root>/generated

The preceding commands work only with the Apache web server. Because of the variety of configurations and security requirements, we do not guarantee these commands work in all situations. For more information, see:

Enable inter-server communication

If Apache and the database server are on the same host, use the following command if you plan to use integrations that use curl (ex. Paypal and USPS). To enable Apache to initiate a connection to another host with SELinux enabled:

  1. To determine if SELinux is enabled, use the following command:

    1

    getenforce

Enforcing displays to confirm that SELinux is running.

1
2
3

* CentOS: `setsebool -P httpd_can_network_connect=1`

* Ubuntu: `setsebool -P apache2_can_network_connect=1`

Opening Ports In Your Firewall

Depending on your security requirements, you might find it necessary to open port 80 and other ports in your firewall. Because of the sensitive nature of networking security, Magento strongly recommends you consult with your IT department before proceeding. Following are some suggested references:

Related topics

© 2020 Magento. All rights reserved.