How can I block net access for 1 user?

jimk · 11-25-2004, 04:24 PM

I would like to block internet access on my son's user account.

Our family shares one computer running Suse 9.1 with DSL internet access through a router. There is no other networking. Everybody has their own sign-on and password. I would like my son to be able to use the computer without supervision, and the only way I'll feel safe doing so is if he can't get on the Internet. Is there an easy way to do this?

I rarely use command prompt, so I would appreciate some detail in any replies involving commands

Thanks.

hostprotect · 11-25-2004, 04:58 PM

http://freshmeat.net/projects/censornet/

jimk · 11-25-2004, 05:11 PM

Thanks. I checked the link, and apparently censornet would require me to go out and buy another computer:

"CensorNet is a Debian-based Linux distribution in its own right and must be installed on a *dedicated* machine with a minimum of two Ethernet adapters."

I was hoping for a simpler solution.

capybara · 11-25-2004, 05:42 PM

for every browser, create a group "newgroup."
addusrs to it, everybody except your son.
"other" has no right to execute these browsers.
members of "newgroup" has the right.
#chmod (for ex.) 776 mozilla

jimk · 11-25-2004, 05:59 PM

Thanks, capybara. Sounds great. The only thing is he won't be able to use konqueror, which is also a file manager. But I think I can come up with something else for that.

DaHammer · 11-25-2004, 11:40 PM

That still wouldn't prevent him from using other programs like Xchat, gaim, & etc. Since you only have the single PC and since everyone has to logon as themselves to use, you could write a shell script to disable the network card, or modem whatever the case may be, when he logs on and to bring it up for everyone else. Course that will require you know your way around linux pretty well.

Capt_Caveman · 11-26-2004, 12:03 AM

You can also use the iptables userid match and block all outgoing traffic initiated by that user. General syntax for userid blocking is:

iptables -I OUTPUT -o <external_interface> -m owner --uid-owner <users_id> -j REJECT

Note that certain types of traffic that are initiated by suid programs will be exempt (like ping).

jimk · 11-26-2004, 02:21 AM

Quote:

Originally posted by Capt_Caveman
You can also use the iptables userid match and block all outgoing traffic initiated by that user. General syntax for userid blocking is:

iptables -I OUTPUT -o <external_interface> -m owner --uid-owner <users_id> -j REJECT

Thanks, Capt.! A quick newbie question: Would <external_interface> be eth0?

redjokerx · 11-26-2004, 02:36 AM

Capt_Caveman · 11-26-2004, 09:26 AM

Quote:

Originally posted by jimk
Thanks, Capt.! A quick newbie question: Would <external_interface> be eth0?

Depends. Normally yes, but on some systems this can be eth1 or a ppp interface. Using the ifconfig command should show you a list of interfaces that are currently up. Whichever IP address corresponds to your internet connection will be the proper external interface

jimk · 11-26-2004, 11:43 AM

Capt_Caveman's iptables command was just what I was looking for and it worked perfectly. Thanks to everybody for your help.

--Jim