Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

On a Red Hat-based host running a fairly recent Apache and PHP 5.2, we are using the solr-php-client library to connect to an external Solr server. This library requires the PHP directive allow_url_fopen to be enabled. Therefore, I would like to disable outgoing PHP connections via iptables, other than connections to the necessary server.

Googling for an appropriate iptables rule leads down many wrong paths. What rule would allow PHP to connect via CURL or fopen() to a specific server, but no other?

Thank you.

share|improve this question
add comment

2 Answers

up vote 4 down vote accepted

how about using iptables rule that filters not only based on the destination address/port but also based on the source user?

iptables -A OUTPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner uidForYourApacheUser -p tcp --dport 80 -d yourServerIp -j ACCEPT
iptables -A OUTPUT -m owner --uid-owner uidForYourApacheUser -p tcp --dport 80 -j REJECT

if needed you can use su-php to run just your sorl scripts under different uid than your apache.

share|improve this answer
    
Not sure such rule will prevent php form accessing script_kiddies_using_url_fopen.com:8080. –  Eric DANNIELOU Aug 19 '12 at 17:36
    
+1 for uid-owner tip –  Eric DANNIELOU Aug 19 '12 at 17:37
    
Thank you! This is a very good base to start googling from for further honing. –  dotancohen Aug 19 '12 at 18:08
    
@Eric DANNIELOU - su-php with separate config/user just for the lucene part + another user for rest of php and proper file system permissions should sort that out. –  pQd Aug 19 '12 at 19:14
    
--dport 80 : You wont prevent http access on other ports like 8080 –  Eric DANNIELOU Aug 19 '12 at 20:38
show 2 more comments

This can't work. You can not disable PHP connections via iptable. iptables is not aware about which process open a connection.

What you might want to do is to disable all outgoing connection except for one destination IP. But you will break any legitimate outgoing trafic.

Tip : One secure setup could be to install a filtering proxy and to disable all traffic except to the proxy, but that's a lot of work.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.