Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

In linux,since normal-user can open ports above 1024- does any one know how to prevent normal-user from opening any port on the system.

share|improve this question
add comment

2 Answers

up vote 0 down vote accepted

I don't think you can disallow users to bind to a port, but you can firewall them. Iptables has "owner" support, that might give you the options you need.

share|improve this answer
    
thanks for the suggestion - I'll check iptables. But I also need to know how to prevent user from starting a port. on my system has plenty of normal user can login into it. He can write a simple C program or python to open a new port. how to avoid that? –  user55479 Sep 28 '10 at 7:14
    
See serverfault.com/questions/185287/… –  joschi Sep 28 '10 at 7:58
    
:) :) Are you sure ,is that correct url ? –  user55479 Sep 28 '10 at 9:51
    
Yes, I am sure. –  joschi Sep 28 '10 at 10:38
    
I assume "bind" is different from "opening" a port. In programming terms, client can "bind" to server which is listening for client connection. What you have suggested is how to prevent client from connecting to server- that's different from my requirement which is " how to prevent user from opening a port".If i'm wrong let me know. –  user55479 Sep 28 '10 at 11:59
show 2 more comments

All the common security extensions for Linux like SELinux, grsecurity, AppArmor or Tomoyo enable you to forbid normal users to bind to any UDP or TCP socket or to specify which sockets they can bind to.

share|improve this answer
    
thanks.please check my comment below –  user55479 Sep 28 '10 at 7:37
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.