Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I want to create a new user (or group), so that any application running with this user can't connect to the network.

@Michael Kjörling I have followed your suggestion(with Ubuntu 12.04 64bit) and got some error information:

$ sudo iptables -A OUTPUT -m owner --uid-owner xyz ! -i lo -j REJECT --reject-with network-unreachable
iptables v1.4.12: unknown reject type "network-unreachable"
Try `iptables -h' or 'iptables --help' for more information.

$ sudo iptables -A OUTPUT -m owner --uid-owner xyz ! -i lo -j REJECT 
iptables v1.4.12: Can't use -i with OUTPUT

Try `iptables -h' or 'iptables --help' for more information.
$ sudo iptables -A OUTPUT -m owner --uid-owner xyz ! -j REJECT 
iptables v1.4.12: cannot have ! before -j
Try `iptables -h' or 'iptables --help' for more information.

Finally, the following one works. But I'm not sure if there is anything wrong.

$ sudo iptables -A OUTPUT -m owner --uid-owner xyz -j REJECT 
$ 
share|improve this question

marked as duplicate by Gilles, slm, jasonwryan, Anthon, Joseph R. Sep 11 '13 at 0:57

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

add comment

1 Answer 1

up vote 6 down vote accepted

You can use the owner match extension for iptables (ipt_owner.ko), together with an exception for the loopback interface, to block external network communication for a specific user. (Or, alternatively, allow network access only for a set of users.)

For example:

modprobe ipt_owner
iptables -A OUTPUT -m owner --uid-owner $USERNAME ! -o lo -j REJECT

(Untested but should get the gist across.) Replace $USERNAME with the relevant user's login name.

How to Limit network access by user / group using iptables - Owner Match by Nikesh Jauhari provides some background. It can be used with groups too, but I'm not sure how it deals with primary and secondary groups.

share|improve this answer
    
I have encountered some error message, please check my edit. –  Eastsun Sep 10 '13 at 12:54
    
@Eastsun Try it now. I find it curious though that you accepted a nonworking answer. –  Michael Kjörling Sep 10 '13 at 12:58
    
@MichaelKjörling - cool, never knew about this iptables extension. Will no doubt come in handy 8-) –  slm Sep 10 '13 at 13:20
    
@MichaelKjörling I accepted your answer because it's the right direction. I can get the whole details myself then. –  Eastsun Sep 10 '13 at 13:28
    
@slm Learn something new every day. –  Michael Kjörling Sep 10 '13 at 15:07
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.