Welcome, I'm looking for equivalent of mac_portacl from FreeBSD. I want to assign to one user only certain ports. Filtering it by iptables isn't enough, because when process works, the port is blocked in socket.
-
It is unclear what you are trying to implement, but if you want to make non-root processes bind to priviledged ports this might help: stackoverflow.com/questions/413807/…– Steffen UllrichJul 9, 2014 at 5:50
-
possible duplicate of Centos 6.4 only allow user to bind to certain port?– Matthew IfeJul 9, 2014 at 9:52
Add a comment
|
1 Answer
There's nothing like mac_portacl in the Linux kernel, but there are a couple of things that can be used to achieve more or less the same result.
- You can use portreserve to preemptively bind the ports, and allow the user sudo access to release only the port(s) they should have access to. This is easy to configure but is limited in what you can achieve.
- You can use selinux to put the user in a context where they only have access to a few ports. Note, however, that if you mess the config up you may end up causing a lot of problems for yourself - this is hard to configure but you can achieve pretty much anything, including things you never wanted...
-
"... including things you never wanted..." - truer words have never been spoken! Jul 9, 2014 at 9:33
-
Is it possible to do this same with grsecurity and gradm? What do you think about closing every user in separate lxc?– JanekJul 9, 2014 at 11:17
-
I'm not familiar enough with grsecurity/gradm to be able to answer that. As for closing users in separate lxc's - it depends on what exactly you need to protect against, it's too broad a question to answer in a comment. You might want to pop over to Information Security and search their questions to see if there's any match.– Jenny DJul 9, 2014 at 13:48