I'm running a LAMP server with FTP(S) and several users. The users have only access to uploading PHP files and other web content. Some are running Drupal and Wordpress, but also a few home made stuff. I already disabled all shell access attempts from php. But in order to fully protect myself, my server and my users from downtime, script kiddies and other nasty things I want to disallow RFI. Actually I don't want to allow any traffic (TCP & UDP) going out from my server that I don't allow to. For this task I want to make a transparent proxy that retrieves all packages before they are sent, making decisions if the packages should be allowed or not. I want to use Python for the task of making the decisions as it is easy to fetch allowed URL's from the local database. Like I want to allow certain API's / OAuth sources.
How do I configure iptables to send all data (including destination ip and port), to my python application? Or is there any better way of doing this?
My thought was just that if I can disable shell access and unauthorized network traffic I can sleep at night. Then no one can use my server as a bot in a botnet. And they can't email spam. What do you think?
I don't want to rely upon Suhosin, since I'm using PHP 5.4 and later.