Tell me more ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.
up vote 3 down vote favorite
1

I would like to forbid a user account on linux to use a a given port. So far, without root privileges, a user can't use ports under 1024. Is there a way to limit a user to a given range of ports, let say [2100-2199] ?

share|improve this question
1  
This is related to the oposite problem posed here and likely shares some of the same limits / half solutions. – Caleb Jul 6 '11 at 13:49

migrated from stackoverflow.com Jul 6 '11 at 13:35

2 Answers

up vote 1 down vote

I don't know exactly how to configure this, but I think that selinux and grsecurity are able to control this through some ACL like system. Read up on those, particularly selinux, and maybe somebody that knows how to configure them can provide an more detailed pointer.

share|improve this answer
SELinux is the way you want to go with this. – bahamat Jul 6 '11 at 20:26
up vote 1 down vote

From the Shorewall rules documentation iptables has the capability to match users or groups as long as they are on the same machine. You will need to setup the appropriate deny rule(s) for the port range. You may want to install Shorewall to manage your firewall.

share|improve this answer
Iptables doesn't work that way. When a packet is incoming it's not owned by any user (even if it's that user's process listening). Only outgoing packets have a user, and not all packets will be owned by who you think they should be. – bahamat Jul 6 '11 at 20:23

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.