1

This tutorial shows how to set up an easy parental control facility, with help of DansGuardian, Privoxy and a few firewall rules. I've tested it and so far, it seems to be working for most part.

There are, however, some things I fail to understand. Namely, in this tutorial we are told to set up, among others, following firewall rules:

sudo iptables -A OUTPUT -p tcp -m multiport --dports 80,443 -m owner --uid-owner privoxy -j ACCEPT
sudo iptables -A OUTPUT -o lo -p tcp --dport 8118 -m owner --uid-owner dansguardian -j ACCEPT

Wait... -m owner --uid-owner dansguardian, -m owner --uid-owner privoxy??

I always thought that uids can be either usernames or groups, which can be assigned to users, and not processes or files? I must've been wrong...

This is even more confusing because getent group shows an entry for dansguardian, but not for privoxy; so I'm not sure what does this --uid-owner privoxy refers to, since privoxy is neither a user nor group.

Thanks in advance for explaining this to me.

Improve this question

2 Answers 2

Reset to default
1

I always thought that uids can be either usernames or groups

Those are user names. It's intended that you run Privoxy under a user called prixovy and DansGuardian under a user called dansguardian.

This is even more confusing because getent group shows an entry for dansguardian, but not for privoxy

Do cat /etc/passwd to see the list of users. Most likely, privoxy is a user on your system if you installed the privoxy package in Debian or Ubuntu. There might not be a corresponding group as there is for dansguardian.

Improve this answer
4
  • Is it possible to declare that a binary should always be run under a certain username? Or does this have to be declared in the source code of this binary?
    – gaazkam
    Dec 14, 2016 at 2:44
  • @gaazkam Just chown the binary to that user and chmod 0700 it. Or even chmod 0500 if it has no business modifying itself. Note that it can always chmod itself back to +w if it really wants to.
    – DepressedDaniel
    Dec 14, 2016 at 2:45
  • Wait, if I chown the binary to a username like privoxy and set perms like these, then I won't be able to run this binary unless I'll log in as privoxy, right? So how possible Privoxy can run under username privoxy even though I'm logged in as e.g. gaazkam and not privoxy?
    – gaazkam
    Dec 14, 2016 at 2:53
  • @gaazkam Privoxy is started by the service manager (systemd), which runs as root and can therefore set to any other user before running a command. If you become root with sudo -i, you will be able to use su - username to become any user (at least, any user that has a working shell configured; systemd doesn't have this limitation as it can bypass the shell).
    – DepressedDaniel
    Dec 14, 2016 at 2:57
0

You can block it based on which ports used by programs like messenger applications. You cant block it based on programs name when you used iptables. Some firewalls can block it based on programs name.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .