LinuxQuestions.org
Latest LQ Deal: Latest LQ Deals
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices


Reply
  Search this Thread
Old 03-14-2008, 12:38 AM   #1
The_Nerd
Member
 
Registered: Aug 2002
Distribution: Debian
Posts: 540

Rep: Reputation: 32
Blocking a certain user from the internet


On linux how do I block any user from accessing the internet with any application, and yet allow others to access without hinderance?

Thanks!
 
Old 03-14-2008, 02:28 AM   #2
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 677Reputation: 677Reputation: 677Reputation: 677Reputation: 677Reputation: 677
Is this a user on his or her own machine or another user on the same machine?


If it is on the same linux machine you could add this to the iptables rules to reject DNS requests:
Code:
/sbin/iptables -A OUTPUT -p tcp --dport 53 -m owner --uid-owner 503 -j REJECT
/sbin/iptables -A OUTPUT -p udp --dport 53 -m owner --uid-owner 503 -j REJECT
I got this from this webpage: http://linux.deadgod.net/2007/01/24/...per-user_basis
Normally web access is controlled by using a proxy server.
An easy thing to do if you have small children is to configure your NAT router to serve supply an openDNS nameserver via dhcp. You can than opt for filtering in the setup page of the openDNS service.
 
Old 03-14-2008, 03:28 AM   #3
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 677Reputation: 677Reputation: 677Reputation: 677Reputation: 677Reputation: 677
I tried to block a "testuser" on my laptop.
Code:
su -

modprobe ipt_owner
iptables -A OUTPUT -m owner --uid-owner 1001 -j DROP
It didn't work. Maybe someone more adept at netfilter rules can point out my mistake.
Sorry I didn't test this out before posting, but that required me to log off.

I even tried using three rules matching tcp, udp and icmp explicitly. They didn't work either.

From iptables -L OUTPUT:
Code:
DROP       tcp  --  anywhere             anywhere            OWNER UID match testuser
DROP       udp  --  anywhere             anywhere            OWNER UID match testuser
DROP       icmp --  anywhere             anywhere            OWNER UID match testuser
 
Old 03-14-2008, 09:31 AM   #4
Simon Bridge
LQ Guru
 
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 198Reputation: 198
iptables -A OUTPUT -m owner --uid-owner 1001 -j DROP
... you probably need to put it ahead of the other output rules. If you have default drop, then you may want to write the rule to say:

iptables -A OUTPUT -m owner --uid-owner !1001 -j ACCEPT

The exact situation is important.
http://iptables-tutorial.frozentux.n...tml#OWNERMATCH

If the user is on a network where you control the gateway...

Generally, if you have a problem with a user, you need to go talk to the user.
 
Old 03-14-2008, 10:06 AM   #5
jschiwal
LQ Guru
 
Registered: Aug 2001
Location: Fargo, ND
Distribution: SuSE AMD64
Posts: 15,733

Rep: Reputation: 677Reputation: 677Reputation: 677Reputation: 677Reputation: 677Reputation: 677
You are right. I inserted the rule after the first one in my rules and "testuser" couldn't access the internet. My example was too simple because it eliminates LAN access as well.
--

Code:
iptables -I OUTPUT 2 -m owner --uid-owner 1001 ! --dest 192.168.1.0/255.255.255.128 -j REJECT
I tried this as root in screen 1 and logged in to screen 2 as testuser (uid=1001). Then testuser was able to use samba but not firefox. Thanks for the pointer.

Last edited by jschiwal; 03-14-2008 at 10:36 AM.
 
Old 03-14-2008, 11:39 PM   #6
Simon Bridge
LQ Guru
 
Registered: Oct 2003
Location: Waiheke NZ
Distribution: Ubuntu
Posts: 9,211

Rep: Reputation: 198Reputation: 198
It remains now to hear back from The_Nerd ... how about it? How did you get on?
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Help Dovecot blocking user tertius Linux - Server 0 08-10-2006 10:09 AM
blocking ssh for a user jitheshmurali Linux - Networking 2 05-05-2006 12:44 AM
per user email blocking kubicon Linux - Networking 1 08-15-2005 06:42 PM
blocking user? westverg Linux - General 6 05-15-2005 11:10 PM
blocking ssh for only 1 user evilchild Linux - Security 2 08-22-2004 07:48 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Networking

All times are GMT -5. The time now is 03:06 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration