Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

With iptables in CentOS 5 and 6 Linux - how can you please prevent processes running as root, apache or nobody from initiating outgoing connections?

On CentOS 5 Linux I've tried putting these lines into /etc/sysconfig/iptables:

-A OUTPUT -m owner --uid-owner root -j DROP
-A OUTPUT -m owner --uid-owner apache -j DROP
-A OUTPUT -m owner --uid-owner nobody -j DROP

but unfortunately get the error:

# sudo service iptables restart
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules: iptables-restore v1.4.7: owner: Bad value for "--uid-owner" option: "apache"
Error occurred at line: 27
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
                                                           [FAILED]
share|improve this question
    
you can not do it using iptables. iptables only checks the ip packets , and there is no information about the uid / gid in there. iptables can only block packets by the source / destination fields, ports, ... –  Goez Apr 4 '12 at 9:00
    
I know that OpenBSD's pf can do it. And also there seems to be the -m owner in Linux iptables too. So maybe you're wrong? –  Alexander Farber Apr 4 '12 at 9:04
    
if I check my manpage, -m stands for match (module ) and not for the owner, maybe there is a module for the owner of the process, not sure. –  Goez Apr 4 '12 at 9:13
    
In my understanding "-m owner" says to iptables: "please load the 'owner' module, so we can do things" –  Alexander Farber Apr 4 '12 at 9:14
    
just checked, there is indeed a owner module. Never heard of it before. But it works with numeric id's, so he will have to alter his rule –  Goez Apr 4 '12 at 9:17

1 Answer 1

up vote 4 down vote accepted

try using the numeric UID instead of the name. F.e:

-A OUTPUT -m owner --uid-owner 400 -j DROP

instead of

-A OUTPUT -m owner --uid-owner apache -j DROP

you can find the uid by typing

id user
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.