how to make a secure local port as a normal user

Question

I am working on a shared linux server as a normal user with no root access. Can I start a program listening on a local tcp port, and be the only user able to connect to that port? I can control the address and port the program listens on.

For example this program could be a development / test version of a webserver.

Further, as the server only accepts incoming tcp connections on port 22 (ssh), I am forwarding the local port over ssh so I can connect to the port using my laptop. ssh -L 8080:localhost:8000 evaben@dice01 So a solution that still allows that or similar would be good.

Answer 1

Only root can set up firewalls.

One possibility is to run the program in a container such as Docker. This requires root privileges, but there's a chance you may be allowed to instantiate Docker containers even if you don't have root access.

If you don't have a direct or indirect way to set up the network protection, you'll need to modify how the program works. Make it listen on a Unix socket instead of TCP. Assuming the program is dynamically linked against the standard library (virtually all programs are), you don't need to change the program itself, just the way you run it. You can do this with LD_PRELOAD, by loading a wrapper for the TCP socket opening function that instead opens a Unix socket. ttu does precisely this (according to its documentation, I've never used it).

Answer 2

Can I start a program listening on a local tcp port

Yes. If you're not root you will only be able to listen on the so-called "high ports", i.e. port numbers > 1024.

and be the only user able to connect to that port?

No. If you had root access you might have been able to do something with iptables, but there is no concept of user-based access control when accepting connections on a port.