How to set up network permissions for user accounts. Restrict network access.

r00tb33r · 02-04-2007, 04:07 PM

I don't know much about groups and permissions and I am clueless how to restrict access to network for one user account.
I was searching around the tree for something like eth0 and try to deny permissions for the user account but I found no such device file.
I've never dealt with network permissions before and unfortunately don't know much about networking on linux machines.
Walk me through it if you can. I need to completely DENY network access to one user account.

elmr007 · 02-04-2007, 05:03 PM

I've never been on a Vector box but I would assume simular to the other distros. You could probably restrict access using either your firewall, or Samba if your running that.

r00tb33r · 02-04-2007, 05:10 PM

To clarify, I need to restrict a LOCAL user, on this machine. I need to restrict OUTGOING traffic/access.
Thanks anyway.

unSpawn · 02-04-2007, 05:31 PM

There's a few ways depending on how certain it must be:
- use an iptables module like "owner" and deny by UID/GID,
- run account in a chroot and don't supply tools and shell that has network capabilities,
- use the GRSecurity kernel patch,
- SELinux custom rules.
My preference would be to use the GRSecurity kernel patch because it "just works" and has easy managable controls to deny any UID access to client, server or both type of sockets.

r00tb33r · 02-04-2007, 06:32 PM

Is there any way to set permissions to a device file or something like that? I could not find the device file for eth0 anywhere in the tree... I mean its linux, this thing should have like groups and permissions to use each service...
which brings me to the next question:
Can I chmod the network service? If so what files do I need to set the permissions to?

unSpawn · 02-04-2007, 07:12 PM

Is there any way to set permissions to a device file or something like that?
It doesn't work that way.

I could not find the device file for eth0 anywhere in the tree...
Me neither. Maybe wrong tree. Maybe try Sherwood Forest.

I mean its linux, this thing should have like groups and permissions to use each service...
No, it doesn't work that way, really.

Can I chmod the network service?
Rrrhhaaahhhh! It doesn't work that way!

r00tb33r · 02-04-2007, 07:25 PM

Quote:

Originally Posted by unSpawn

Is there any way to set permissions to a device file or something like that?
It doesn't work that way.

I could not find the device file for eth0 anywhere in the tree...
Me neither. Maybe wrong tree. Maybe try Sherwood Forest.

I mean its linux, this thing should have like groups and permissions to use each service...
No, it doesn't work that way, really.

Can I chmod the network service?
Rrrhhaaahhhh! It doesn't work that way!

Hey-hey, stop bashing me. Anyway I solved it with one line:

iptables -A OUTPUT -m owner --uid-owner 666 -j DROP

Took a bit of man pages (no not MAXIM or PlayBoy)... I was confused with its usage...
Anyway thats the solution.

elmr007 · 02-04-2007, 09:10 PM

LOL...interesting thread

Anyway glad you got your firewall restrictions fixed.

unSpawn, show some professionalism :\