Welcome, I'm looking for equivalent of mac_portacl from FreeBSD. I want to assign to one user only certain ports. Filtering it by iptables isn't enough, because when process works, the port is blocked in socket.
closed as off-topic by Jenny D, Matthew Ife, Ward♦, mdpc, dawud Jul 10 '14 at 8:51
This question appears to be off-topic. The users who voted to close gave this specific reason:
- "Questions must be relevant to professional system administration. Server Fault is dedicated to professional system and network administrators. End user and enthusiast questions are off-topic (contact your system administrator or hire a professional to help you out). Please see the Help Center for more information." – Ward, mdpc
There's nothing like mac_portacl in the Linux kernel, but there are a couple of things that can be used to achieve more or less the same result.
- You can use portreserve to preemptively bind the ports, and allow the user sudo access to release only the port(s) they should have access to. This is easy to configure but is limited in what you can achieve.
- You can use selinux to put the user in a context where they only have access to a few ports. Note, however, that if you mess the config up you may end up causing a lot of problems for yourself - this is hard to configure but you can achieve pretty much anything, including things you never wanted...