SSHD and Selinux

In Summary: Turn off SELinux. ALWAYS.

Sorry for the huge text, I just spent an hour in Fedora trying to get my firewall to allow SSHD to operate. No matter what I did, it would not work. Finally I disabled the firewall completely for debugging purposes, but it still wouldn't work! The error messages were no help!

Then, after raging at the machine for an hour, it dawned on me. This was a fresh install of Fedora. I hadn't disabled SELinux.

I can't believe how many times SELinux has bitten me in the ass. It never seems to work for anything good, but always hinder people. I consider myself a very advanced Linux User and I find it overly cumbersome. There needs to be a less.... ogre-like system put in place by default, like Ubuntu's Apper. That never got in my way BUT EVERY FLIPPING TIME SELinux has got in my way.

On systems with SELinux disabled, the SELINUX=disabled option is configured in /etc/selinux/config:

# This file controls the state of SELinux on the system.
# SELINUX= can take one of these three values:
#       enforcing - SELinux security policy is enforced.
#       permissive - SELinux prints warnings instead of enforcing.
#       disabled - No SELinux policy is loaded.
SELINUX=disabled

Go do this now. You will thank yourself. I've never heard of SELinux benefitting the average user. Ever. Ever ever ever. I'm sure someone in a corporate environment has had luck though, but they have someone on retainer there to babysit this monstrousity. And I pity that person.

More Experiences Moving to Fedora 18

More Experiences Moving to Fedora 18

Here are more experiences more experiences moving from Ubuntu to Fedora 18.

Pros

Smoother integration of certain services, like the Updater. It doesn’t require a password much of the time.

Firewall-Config

After a month or two in Fedora, I discovered a really nice graphical program for configuring my firewall! At first glance and after a simple few tasks, I think it works very nicely with SELinux as well. This is a very pleasant surprise.

Neutral

SELinux: Though I was aware of what SELinux, I had never specifically used it. I must give credit to the nice desktop user interface. For example, I needed to enable additional permissions for Firefox to use some Flash at one point. The GUI for SELinux was really easy to understand; just copy and paste this command into a console to enable that permission.

But on the slight downside, I was not able to configure my SSH exactly as I wanted until I figured out how to configure the firewall. This actually makes sense but wasn't easy for me to find the problem spot. I spent a long time attempting to configure SELinux and months later stumbled upon , and I'm not sure if it is a SELinux problem or not.

Cons

General Users

SELinux can be a pain to the average user unless there's something there to help them. I'm pretty a pretty advanced user in Linux and using SELinux is not simple or convenient. Fedora has a nice little helper System-Tray application but that's still not very useful.

For example, I routinely browse a website that uses flash. To allow certain features, such as saving a screen capture of the flash portion of the website, I have to run a SELinux command.

This wouldn't be a problem, except it is not simple or trivial to make this setting permanent. It's not readily apparent how to do this, so I essentially have to run this command every single day, every time I boot my computer up. Doing such a needlessly repetitive task to enable a certain feature is very Microsoft-Windows-esc, and should not be a problem on the Linux Desktop. There should be an easier way to do this.

Sadly I have to now go read some long and incredibly detailed manuals on SELinux, when I just want to browse a fucking website. Ugh.

This is a real Con, and I never had to do with this before.

Development

Third-Party Fedora Support
Interestingly, I didn’t realize that the world had really jumped onboard with the Ubuntu craze. So many places where I have downloaded software for use in development now only list Ubuntu, instead of Fedora/Debian/Ubuntu or some more generic Linux form.

I really hope this is somewhat problematic for me, other than a minor headache with papercuts in using their Ubuntu-focused software.

Fedora Free Open-Source Software Ideology
While I really really like the Free and Open-Source Software ideology, this has actually been a little troubling in Fedora. For example, it is currently quite difficult to add an proper Oracle Java repository to my system.

While I really like OpenJDK when it works, current development projects of mine require the official Oracle JDK. I also want a repository on my system to handle this, especially for updates. I shouldn’t have to watch the news like a hawk for Java updates.

Yum
There are some features I really like about Yum, such as transaction history and undo-features, and a very nice console interface. But they are also not perfect. Aside from being slower than Apt, it is missing two very nice features. “apt-get autoremove” and the ability to perform a “dry-run” sort of simulation, though the later is really not that big of a deal for me.

I’ve yet to find an easy and convenient way to automatically remove unused dependencies (aka “orphaned” packages).

Also the dist-upgrade command doesn't seem quite as straightforward as the apt version.

Google Music

Not sure that Fedora should be blamed for this, but the Google Music manager is NOT working for me. I've tried the 32 and 64 bit versions, including completely deleting the configuration files under my home directory. Nothing works.

I don't know what to do but this is very annoying.

Experience Moving to Fedora 18

Background

So after eight long and mostly very good years of using Ubuntu, I have finally been made to jump ship. It's funny how things sometimes all happen at the same time.

Conclusion

Fedora is a different place than Ubuntu but it's also nice. Both of them are. I think it is a testament to the quality of Fedora that it has not been difficult to find equivalents options and alternatives for most of what I want.

I think some of the problems I was having with Ubuntu when I left it were probably atypical. But I'll list them anyway, if only for my own memory.

1) Desktop Loading: When booting up, Kubuntu would load 90% of the desktop but then would hang for a period of 10 to 20 seconds. I could see everything and I could invoke certain actions but not everything. Then suddenly it would finish. At first I thought this last was from running Skype but now I'm doing that in Fedora and it's not slowed down at all.

2) Bootup Speed: Fedora boots up faster than Ubuntu / Kubuntu for me. Though admittedly I thought the graphics for prompting me my decryption password on bootup were better from Kubuntu than Fedora.

Why / The Reason I Switched to Fedora

The Big Reason: No More KDE

So if you don't know, Ubuntu is going their own way with their graphic display server Mir instead of using Wayland. Those are big complicated stories and issues which I won't detail here, but the one all important thing that came out of it was this:

The KDE people will not support Mir at this time, nor possibly ever based on decisions the Ubuntu team is making.

This is not to vilify Canonical in anyway. They can do what they want and I've liked and disliked decisions from every group at one time or another. Check out the articles on Phoronix about the subject, as they have better source links than I care to list here.

I have used KDE since the beginning in Linux and it's without question my all time favorite Desktop Environment, bar none. It is also, without question in my opinion, a far superior desktop than Gnome2/3 is, and I always recommend it to anyone who is knew to Linux. (Personally I've always felt that Gnome2's paradigm to be too much of a shock to any Windows immigrants to Linux, and I'm not friends with any Mac users savvy enough to handle even a two-button mouse.)

Just to be clear I don't hate Gnome. This is only my opinion. I am sure someone reading this will think I am foolish for pointing people to KDE because of instability. Yes, the initial KDE 4 release was a disaster which I still to this day don't understand why it happened. But if anyone reading this thinks Gnome is flawless, I only need point to Gnome3 to win my argument handily.

Ahem, moving on... sorry for the sidetrack.

KDE is far FAR more important to me than any underlying OS. It is my life in Linux. So if Ubuntu will no longer even support KDE being run on it as a community project, sadly they have no place for in my life anymore.

The Smaller Reasons: Stability Headache

I've used KDE for over 8 years, through stable and unstable times. But strangely, just as I upgraded to Kubuntu 13.04 and all the minor instability issues I suffered from KDE 4.9 (damn you Kubuntu for not upgrading to KDE 4.10 sooner!), suddenly I had to very real and serious problems. 

I use Firefox and the Pidgin instant messenger client every single day for almost every moment my computer is on. Suddenly when I upgraded, Pidgin began to lock-up and crash, which often was associated with a lock-up and crash of Firefox!

I don't know why and all attempts on my part short of running Pidgin in a debugger have failed to unearth the program or fix it. Compiling Pidgin freshly from source code doesn't seem to fix the bug either.

I strongly suspect this may be an error in a library for system resources/services that both Firefox and Pidgin use. But I am only guessing.

With these two critical program not functioning in my life, I had to make a change.

After having moved to Fedora, it has been extremely solid and reliable. In fact so much so that it has made my prior Kubuntu 13.04 KDE 4.10.2/4.10.3 desktop look shameful. Time will tell just how stable but so far first few days of light usage are very good.

Experiences of Moving / First Impressions of Fedora

Anyway, here is a list of some of my experiences moving to Fedora 18, after being in Ubuntu for so long.

Now I picked Fedora for several reasons. It's a very popular distro with good documentation and community. It supports KDE thoroughly, and tends to get about as much attention as possible behind Ubuntu itself.

The Fedora Installer

The Fedora installer needs a little polishing when it comes to smoothness and ease for completely new users. I managed just fine after clicking around a bit, but it still needs work.

Bad: First off, the buttons for clicking "OK" or "Done" are in unusual places. They are in the top area and on the left sometimes. This is not normal for almost all desktop applications. But I do understand this may be done because of needing to conform to different screen sizes. This would assure that the buttons would always be somewhere visible on screen. Still, this was a bit jarring to a new user. But the buttons weren't the only thing. Maybe I've been too long in Ubuntu's camp and I'm biased but I felt the flow of the decision making wasn't as guided as it could have been.

Good! / Bad: A major point I will acknowledge in favor of the Fedora Installer is the Hard Drive configuration system. But at the same time I must also critisize it for being slightly confusing.

The good point was that it allowed a fair deal more control and fine tuning that the Ubuntu/Kubuntu installers did. I could choose to encrypt multiple harddrives if I wanted, and also make larger volumes. This is an option Ubuntu has been promising for well over a year but continues to push back and we've not seen it yet.

At the same time I found their workflow and decision guiding needed a bit more hand-holding. I did eventually figure out how to use their partition manager/editor, and I have to say it works pretty well. But I was left with a distinct impression of lacking workflow. It didn't seem like I had a starting point and an ending point when I began editing my partitions. UPDATE: After doing this a few times as I migrated my other machines, I have learned to use their workflow model better, so it's not quite as rough as before.

So this is a mixed point on the review, but overall I have to give them a silver-star here for giving a lot more options when installing to your harddrives than Ubuntu. Perhaps the amount of options is the reason the workflow isn't so obvious to me; many options make that difficult to architect

Neutral: When I let Fedora auto-partition my system, it split the 128GB disk into two partitions. It gave about 50GB of space on my drive to OS and the rest to me. I have seriously mixed feelings about this.

Apper / Yum

Finding Apper: This was the first big problem I hit when using Fedora 18 with KDE, using the software updater is broken. It took me a moment to find Apper, which is the Software Management front-end in Fedora KDE. That was partly my fault. I looked for the words "Update" and "yum" but didn't get any results. Browsing under the category "All Applications" -> "System" didn't show me anything.

But I soon found Apper just sitting in my Favorites menu by default. I suppose my only suggestion is to also list it under the System category, because that's obviously where it also belongs.

Using Apper: Apper seems okay but a bit slow for a pro user, in several ways. The searching for items should be search-as-you-type.

Second and more importantly: When you finally click install there needs to be a better progress indicator. I tried using Apper to update my system, selected all 552 packages to update, and clicked install. It started, resolved dependencies, and then sat at 10% progress for many minutes. I thought the program had crashed so I cancelled and closed it. By then the system had asked me to reboot, which I did and tried this again. Same result but this time I couldn't even cancel out of Apper gracefully, so I rebooted a third time. This time I used Yum on the commandline and that was fine. (In fact I'm quite impressed with Yum.)

I only found out later that Apper really was working. I believe it was downloading the packages in the background but not showing me any progress indicators. This is a failure of user-interface design-101 people. Don't leave the User thinking their system has stopped responding.

Still, not a terrible experience. But I'll probably be using Yum or DNF from now on anyway. But as of right now I couldn't recommend Fedora to a newbie Linux user because Apper fails so badly in this regard.

Touchpad Tapping

Strangely, my touchpad works fine for navigation but doesn't work at all for tapping. I have no idea why and this has NEVER happened before in any distribution of Linux I've ever used.

UPDATE: I fixed this problem today! I had to go to System Settings -> Input -> Touchpad -> Tapping and under the Buttons section I had to assign actions for the different types of taps. I have never EVER had to this before but once I realized this was the problem, it was very easy to do. I'm not even mad at Fedora, though I hope they set some good defaults soon.

SSH / SSHD and SELinux

Long story short, I'm having severe troubles getting my ssh-daemon (sshd) to run on any port different than 22. I don't know if it is SELinux or the Firewall or what exactly that is causing the problem.

It's been a pain to get it to use my provided SSH-keys. Had to turn off GSSAPI options because they were really slowing down initializing of connections.

I'm going to look into fixing these, since obviously SSH can be made to run correctly under Fedora.

Hostname

A somewhat neutral comment: Fedora never asked me to set the name for my system. It is clearly an easy thing to do but for a new-Linux user, this wouldn't be apparent. I figure they should have asked.

Amarok

Back in Kubuntu/Ubuntu, my instance of Amarok was horribly unstable. It's been much better since I migrated to Fedora. It's not the versions; I've checked.