How do I configure a CentOS 6.4 server so that certain users can only run servers on certain ports? e.g. if I have a user that is used for running a server and I only want him to be able to bind to port 1036.
I know you can do this using network namespaces because thats how I did it. But it is pretty complicated.
The process would be this.
Now, the untrusted user of course has complete ownership of that IP, but you can use IPtables in the parent namespace to do DNATing to the specific port they are allowed to bind to and restrict communication out to only that port. Its impossible for the user to effectively deny service on another port for another user as he has a specific IP that works only from within that users namespace.
Note things are more complicated if you use
I also wrote a program in C that uses netlink calls to set all the above up. The program is closed source so unfortunately I cannot share it with you.
For the record, doing this in Fedora is a bit easier because you can create named network namespaces in it. But EL6 does not provide the