Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do I configure a CentOS 6.4 server so that certain users can only run servers on certain ports? e.g. if I have a user that is used for running a server and I only want him to be able to bind to port 1036.

share|improve this question
Very interesting thought. Shouldn't this be application specific. What is the name of the application service? – Chakri Oct 17 '13 at 17:40
In this case I am dealing with untrusted users running node servers – DrAwesome Oct 17 '13 at 17:41
Sounds like a job for SELinux, though it will probably be complicated. – Michael Hampton Oct 17 '13 at 17:58
Could you point me to a guide and/or reference on using SELinux to accomplish this? – DrAwesome Oct 17 '13 at 18:04
Is it a apache server? If so, we are current set up something like apache listen on port 1036 and user document root is /home/user/public_html. The configuration is using "url port mapping" or something like that, sorry Im mobile and dont have server access atm, I can check exact syntax later if you need – Shâu Shắc Oct 17 '13 at 18:26
up vote 4 down vote accepted

I know you can do this using network namespaces because thats how I did it. But it is pretty complicated.

The process would be this.

  1. Create a network namespace by using unshare
  2. Create a veth device using ip link add type veth ....
  3. Move one end of the veth into this device using ip link set vethX netns ${PIDOFUNSHARE}
  4. Bring up loopback (if not already) in the new namespace.
  5. Bring up an IP address (if not already) in the new namespace and the vethX device.
  6. Set a default route in new network namespace to an IP in the parent namespace.
  7. Set a static route to the ip you added in the child namespace to go down the vethX in the parent namespace.

Now, the untrusted user of course has complete ownership of that IP, but you can use IPtables in the parent namespace to do DNATing to the specific port they are allowed to bind to and restrict communication out to only that port. Its impossible for the user to effectively deny service on another port for another user as he has a specific IP that works only from within that users namespace.

Note things are more complicated if you use nslcd or nscd for name resolution service as the unix socket that is used for inter process communication is invalid in the child namespace. The only way I was able to fix this was to patch these programs to provide a TCP transport and do name resolution services in the parent namespace over TCP.

I also wrote a program in C that uses netlink calls to set all the above up. The program is closed source so unfortunately I cannot share it with you.

For the record, doing this in Fedora is a bit easier because you can create named network namespaces in it. But EL6 does not provide the /proc/<pid>/ns functionality to do this.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.