1

I typed : 

netstat -atlpvn

and noticed that applications like gedit and python had foreign addresses outside the network (the network being a single computer connected to the internet).

Is there any way for me to restrict which applications are allowed outgoing? For example I would only want firefox to have outgoing connections?

Thanks

Improve this question
1
  • I hear that SElinux can do this, but the configuration is very painful.
    – Tim
    Dec 28, 2011 at 19:49

3 Answers 3

Reset to default
3

As far as I know, the only way to restrict Internet connectivity on an application-by-application basis is through SELinux capabilities, and it involves giving applications that must have Internet connectivity additional privileges. I doubt that giving Firefox additional privileges will contribute to security, and an application that tries to access the Internet could do it through Firefox or wget or some other “legitimate” application anyway. Furthermore, for scripts, I think you'd have to give the capabilities to the interpreter (e.g. /usr/bin/python) which doesn't discriminate in any useful way.

You can restrict Internet connectivity on a user-by-user basis; see bind software to different network interfaces and Dual network connection for examples. Or you can run applications that you don't want to grant Internet connectivity to in a lightweight virtual environment such as LXC.

Improve this answer
3

EDIT: this solution doesn't work since kernel 2.6.14 . See Gilles comment.

You can use iptables rules in the output chain matching processes names with the --cmd-owner option. Something like:

iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -m owner --cmd-owner "firefox-bin" -j ACCEPT
iptables -A OUTPUT -m owner --cmd-owner "ssh" -j ACCEPT
iptables -A OUTPUT -j DENY

With that you permit output traffic from firefox-bin, ssh and established connections.

Improve this answer
2
0

You would probably need an app like LeopardFlower which allows per-application firewalling. Other than that create a separate account and launch firefox under it and use the rule like ipatbles -A OUTPUT -m owner --uid-owner 1005 -j DROP to block all traffic of that user.

Improve this answer
3
  • Hi thanks, I discovered a similar solution last night, inspired by the following article : unix.stackexchange.com/questions/21650/… So basically I logged in as a different user, started firefox, and then ssh'ed into a separate account which had user restrictions as specified in the article, and used (under this restricted user profile) all the applications which I did not want to have internet access.
    – artella
    Dec 29, 2011 at 18:27
  • That is once I had ssh'ed into the restricted account I typed : "sudo iptables -t mangle -A OUTPUT -o eth0 -m owner --uid-owner 1234 -j DROP" where 1234 was the uid number of the restricted account
    – artella
    Dec 29, 2011 at 18:32
  • As an extension to this, I have asked another question here : serverfault.com/questions/345110/… Thanks in advance for any help.
    – artella
    Dec 29, 2011 at 18:54

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .