up vote 1 down vote favorite
share [g+] share [fb]

In linux,since normal-user can open ports above 1024- does any one know how to prevent normal-user from opening any port on the system.

link|improve this question
feedback

2 Answers

up vote 0 down vote accepted

I don't think you can disallow users to bind to a port, but you can firewall them. Iptables has "owner" support, that might give you the options you need.

link|improve this answer
thanks for the suggestion - I'll check iptables. But I also need to know how to prevent user from starting a port. on my system has plenty of normal user can login into it. He can write a simple C program or python to open a new port. how to avoid that? – user55479 Sep 28 '10 at 7:14
See serverfault.com/questions/185287/… – joschi Sep 28 '10 at 7:58
:) :) Are you sure ,is that correct url ? – user55479 Sep 28 '10 at 9:51
Yes, I am sure. – joschi Sep 28 '10 at 10:38
I assume "bind" is different from "opening" a port. In programming terms, client can "bind" to server which is listening for client connection. What you have suggested is how to prevent client from connecting to server- that's different from my requirement which is " how to prevent user from opening a port".If i'm wrong let me know. – user55479 Sep 28 '10 at 11:59
show 2 more comments
feedback
up vote 1 down vote

All the common security extensions for Linux like SELinux, grsecurity, AppArmor or Tomoyo enable you to forbid normal users to bind to any UDP or TCP socket or to specify which sockets they can bind to.

link|improve this answer
thanks.please check my comment below – user55479 Sep 28 '10 at 7:37
feedback

Your Answer

 
or
required, but never shown
discard