Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

This question is purely hypothetical. Is it possible to restrict which ports certain users may use for their processes? Say users1 gets ports 8000-8999 and user2 gets ports 9000-9999.

I am running Ubuntu 11.10.

share|improve this question
1  
I think you are talking about TCP/UDP ports. Are these source (listening) or destination ports? Only super user can start processes listening on low port numbers < 1024. –  Khaled Dec 26 '11 at 9:48
    
Yes, I am aware of the ports below 1024. I would like to have more control over the ports higher than that as to avoid any possible conflicts e.g. somebody has something running on 9001 and takes it down momentarily -- meanwhile somebody else takes port 9001 for their own purpose. –  KPthunder Dec 26 '11 at 9:53

2 Answers 2

up vote 0 down vote accepted

The only Linux native application that can handle this kind of restriction might be SElinux, which is part of the Ubuntu distribution. SElinux is well complicated and I am not sure how you would implement port restrictions on a per user bassis. That will be between you and Google.

This discussion mentions two kernel patches (GRsecurity and TOMOYO) which specifically allow port restrictions at the application level, although the discussion includes reference to per user port restriction.

Lastly, I have seen links to another kernel patch called 'user-port-hack' but its project page is not forthcoming and one kernel post mentions that it is for kernel 2.4 only. Perhaps you can dig for that.

A left field solution I can see for your requirement is to simply ask users to conform to a policy. i.e. "User X, please only use ports 8000-8999."

Alternatively, if your users insist on using ports other than the 1000 they have been allocated, you could isolate users to their own dedicated virtual machines and then implement firewall/iptables rules at the host level to limit the traffic to a certain port range for each VMs IP address.

share|improve this answer

You should consider using iptables with the owner module. I've never tried it in this exact situation, but it seems to answer your question.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.