RHEL 7 SELinux Blocks Rsync Over Nonstandard Port

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

Backup jobs fail when rsync daemon listens on custom port, increasing risk of missed recovery points.

Environment & Reproduction

RHEL 7 backup node configured with rsyncd on alternate port and SELinux enforcing mode.

Root Cause Analysis

Custom port lacks correct SELinux type assignment for rsync, so daemon cannot bind or accept traffic.

Quick Triage

Check service/systemctl status rsyncd, verify firewalld port open, and inspect journalctl plus audit AVC entries.

Step-by-Step Diagnosis

Run semanage port -l, confirm rsync config port, and test bind attempts while monitoring audit logs.

Solution – Primary Fix

Assign proper SELinux port type with semanage, open firewalld rule, and restart rsync service.

Solution – Alternative Approaches

Use default rsync port, SSH transport mode, or dedicated backup VLAN with standard policy labels.

Verification & Acceptance Criteria

Rsync transfers complete on target port and no new SELinux denials appear in journalctl/audit logs.

Rollback Plan

Remove custom port mapping and revert rsync to previous port configuration with service restart.

Prevention & Hardening

Document all nonstandard ports, enforce SELinux policy checks, and include firewalld validation in change control.

Related Errors & Cross-Refs

Related to custom sshd port labeling, nfs context issues, and systemctl unit ordering for backup targets.

Related tutorial: View the step-by-step tutorial for rhel-7.

View all rhel-7 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

See SELinux port management docs, rsync service hardening notes, and journalctl troubleshooting examples.