Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I would like to forbid a user account on linux to use a a given port. So far, without root privileges, a user can't use ports under 1024. Is there a way to limit a user to a given range of ports, let say [2100-2199] ?

share|improve this question

migrated from stackoverflow.com Jul 6 '11 at 13:35

This question came from our site for professional and enthusiast programmers.

This is related to the oposite problem posed here and likely shares some of the same limits / half solutions. – Caleb Jul 6 '11 at 13:49

I don't know exactly how to configure this, but I think that selinux and grsecurity are able to control this through some ACL like system. Read up on those, particularly selinux, and maybe somebody that knows how to configure them can provide an more detailed pointer.

share|improve this answer
SELinux is the way you want to go with this. – bahamat Jul 6 '11 at 20:26

From the Shorewall rules documentation iptables has the capability to match users or groups as long as they are on the same machine. You will need to setup the appropriate deny rule(s) for the port range. You may want to install Shorewall to manage your firewall.

share|improve this answer
Iptables doesn't work that way. When a packet is incoming it's not owned by any user (even if it's that user's process listening). Only outgoing packets have a user, and not all packets will be owned by who you think they should be. – bahamat Jul 6 '11 at 20:23

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.