0

Welcome, I'm looking for equivalent of mac_portacl from FreeBSD. I want to assign to one user only certain ports. Filtering it by iptables isn't enough, because when process works, the port is blocked in socket.

2

1 Answer 1

2

There's nothing like mac_portacl in the Linux kernel, but there are a couple of things that can be used to achieve more or less the same result.

  • You can use portreserve to preemptively bind the ports, and allow the user sudo access to release only the port(s) they should have access to. This is easy to configure but is limited in what you can achieve.
  • You can use selinux to put the user in a context where they only have access to a few ports. Note, however, that if you mess the config up you may end up causing a lot of problems for yourself - this is hard to configure but you can achieve pretty much anything, including things you never wanted...
3
  • "... including things you never wanted..." - truer words have never been spoken! Jul 9, 2014 at 9:33
  • Is it possible to do this same with grsecurity and gradm? What do you think about closing every user in separate lxc?
    – Janek
    Jul 9, 2014 at 11:17
  • I'm not familiar enough with grsecurity/gradm to be able to answer that. As for closing users in separate lxc's - it depends on what exactly you need to protect against, it's too broad a question to answer in a comment. You might want to pop over to Information Security and search their questions to see if there's any match.
    – Jenny D
    Jul 9, 2014 at 13:48

Not the answer you're looking for? Browse other questions tagged .