Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Welcome, I'm looking for equivalent of mac_portacl from FreeBSD. I want to assign to one user only certain ports. Filtering it by iptables isn't enough, because when process works, the port is blocked in socket.

share|improve this question

closed as off-topic by Jenny D, Matthew Ife, Ward, mdpc, dawud Jul 10 '14 at 8:51

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Ward, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

It is unclear what you are trying to implement, but if you want to make non-root processes bind to priviledged ports this might help:… – Steffen Ullrich Jul 9 '14 at 5:50
possible duplicate of Centos 6.4 only allow user to bind to certain port? – Matthew Ife Jul 9 '14 at 9:52

1 Answer 1

There's nothing like mac_portacl in the Linux kernel, but there are a couple of things that can be used to achieve more or less the same result.

  • You can use portreserve to preemptively bind the ports, and allow the user sudo access to release only the port(s) they should have access to. This is easy to configure but is limited in what you can achieve.
  • You can use selinux to put the user in a context where they only have access to a few ports. Note, however, that if you mess the config up you may end up causing a lot of problems for yourself - this is hard to configure but you can achieve pretty much anything, including things you never wanted...
share|improve this answer
"... including things you never wanted..." - truer words have never been spoken! – Janne Pikkarainen Jul 9 '14 at 9:33
Is it possible to do this same with grsecurity and gradm? What do you think about closing every user in separate lxc? – user2149412 Jul 9 '14 at 11:17
I'm not familiar enough with grsecurity/gradm to be able to answer that. As for closing users in separate lxc's - it depends on what exactly you need to protect against, it's too broad a question to answer in a comment. You might want to pop over to Information Security and search their questions to see if there's any match. – Jenny D Jul 9 '14 at 13:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.