0

I hope you can do that somehow with the owner iptables module…

On a single machine, if:

  • userA starts a TCP serverA on (random) port 1111
  • userB starts a TCP serverB on (random) port 2222

… how can I:

  • disallow userB to connect to serverA, based only on the fact that the owner of serverA is not userB themselves, but some other user,
  • and still allow userB to connect to serverB, because userB owns the process of serverB?
3
  • 1
    This can actually be done with some firewalls, but then you're looking at actual dedicated firewall hardware and software, and it's not cheap.
    – Jenny D
    Mar 19, 2019 at 15:52
  • @JennyD I see… would you name some? Maybe in an answer, as that would probably be the best one.
    – Michal Rus
    Mar 20, 2019 at 16:12
  • I'm not a firewall expert, but I think both Cisco and Juniper have such solutions. A good google search could be "firewall user ACL". You could also check the sister site networkengineering.stackexchange.com
    – Jenny D
    Mar 20, 2019 at 19:03

2 Answers 2

2

TCP connections work with IP addresses and port numbers. It does not know anything about "users". So unless each user has a unique fixed IP address, there is no way to block user A from creating a TCP connection to server B. Why would you want to anyway? If the server hosts a website, make it request authentication. User B won't be able to login to the website on server A so there is no problem.

2
  • Ummm, there’s the owner module in iptables, so not entirely true.
    – Michal Rus
    Mar 20, 2019 at 16:11
  • That module is only useful on outbound connections. I consider it pointless trying to configure all possible servers with that module to limit access on user-level.
    – Tommiie
    Mar 21, 2019 at 15:15
2

The owner iptables extension has more limitations than you think. From the iptables-extensions man page:

owner

This module attempts to match various characteristics of the packet creator, for locally generated packets. This match is only valid in the OUTPUT and POSTROUTING chains. Forwarded packets do not have any socket associated with them.

  • Only OUTPUT is restricted, so you must restrict outgoing connections.
  • Not only userB, but every user you don't want to make a connection.
  • On every host, because if userB made this connection from serverC there would be nothing stopping them.
  • You also need to make exceptions if userB is going to have network access at all. So you still have to define your service in terms of a connection tuple like ports.
  • Plus apparently the owner extension has non intuitive behavior with group membership.

A better solution would be to use authentication in your network protocol.

If you must restrict arbitrary network access of a given user, consider writing SELinux policy similar to the boolean httpd_can_network_connect_db.

1
  • I see… I wanted to do some marking based on -m owner, but if that only works for OUTPUT, then I won’t then be able to compare the mark and INPUT owner…
    – Michal Rus
    Mar 20, 2019 at 16:14

Not the answer you're looking for? Browse other questions tagged .