Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have stumbled upon this little tech dilemma yesterday, and know that there is a solution to it (IRC BNC resellers have it implemented already). However, the exact details and implementation elude me, and this is what I'd like to find out.

I have a server running nginx to proxy a whole load of web services for a whole load of virtual hosts, all of them dynamically generated. I have a complete list of what each vhost should have in terms of ports, and more importantly, what they shouldn't have. A typical example:

Host 1:

  • port 9000: PHP-FPM
  • port 9001: Node

Host 2:

  • Port 9002: PHP-FPM
  • port 9003: Node
  • port 9004: IIS (remote forward)

Each server/forward is done as the user, and I know ahead of time which port is given to which user. My question is therefore pretty straightforward: is there a way to deny a user bind/listen rights on a port based on its UID? The reason I want to do this is to prevent Host 1 from subverting Host 2's ports or vice versa.

share|improve this question
Given the /iptables tag, I presume you're using Linux? Are you using Apparmor/SELinux/…? – Gilles Jan 30 '13 at 23:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.