Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In linux,since normal-user can open ports above 1024- does any one know how to prevent normal-user from opening any port on the system.

share|improve this question
up vote 0 down vote accepted

I don't think you can disallow users to bind to a port, but you can firewall them. Iptables has "owner" support, that might give you the options you need.

share|improve this answer
thanks for the suggestion - I'll check iptables. But I also need to know how to prevent user from starting a port. on my system has plenty of normal user can login into it. He can write a simple C program or python to open a new port. how to avoid that? – user55479 Sep 28 '10 at 7:14
See… – joschi Sep 28 '10 at 7:58
:) :) Are you sure ,is that correct url ? – user55479 Sep 28 '10 at 9:51
Yes, I am sure. – joschi Sep 28 '10 at 10:38
I assume "bind" is different from "opening" a port. In programming terms, client can "bind" to server which is listening for client connection. What you have suggested is how to prevent client from connecting to server- that's different from my requirement which is " how to prevent user from opening a port".If i'm wrong let me know. – user55479 Sep 28 '10 at 11:59

All the common security extensions for Linux like SELinux, grsecurity, AppArmor or Tomoyo enable you to forbid normal users to bind to any UDP or TCP socket or to specify which sockets they can bind to.

share|improve this answer
thanks.please check my comment below – user55479 Sep 28 '10 at 7:37

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.