1

I want to allow user to check how many rules are present in filter table, but not able to view actual rules, is that possible?

literally I mean iptables -L | wc -l (I know it's faulty), but sudo doesn't seem to support pipe commands like that, I mean, currently If I wanted to allow that, I need to grant permission to run iptables -L instead of iptables -L | wc -l

Any thoughts?

Improve this question
3
  • not sure what shell you are using but I'am able to run the following: sudo iptables -L|egrep -v 'Chain|target'|wc -l without any problem
    – BitsOfNix
    Jan 2, 2013 at 13:48
  • @AlexandreAlves updated question ...
    – daisy
    Jan 2, 2013 at 13:54
  • The reason that pipe commands do not work with sudo, is because it is actually two separate commands...
    – Gert van den Berg
    Jan 2, 2013 at 14:06

1 Answer 1

Reset to default
4

Create a script that runs the commands to get the number of iptables rules. I would suggest something like this:

#!/bin/sh
/sbin/iptables -L | grep -Ecv '^$|^Chain |^target'

Save script in /usr/local/bin, make it executable and check that only root can write to it. Recommended mode: 0555

Edit sudoers to allow the user to run that script using sudo.

Improve this answer
2
  • Looks easy to do that! But anyway, I modified iptables program to do the counting ... thanks anyway, scripting is a good ideas to problems like this
    – daisy
    Jan 2, 2013 at 15:04
  • (This is not completely valid with the edited case where the user doesn't have permissions to run iptables -L) (the info seem to require root to access, so a modified iptables (or other command getting the info from /proc/net/ip_*) running setuid root or via sudo is likely the only practical solution)
    – Gert van den Berg
    Mar 23, 2016 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.