3

I would like to forbid a user account on linux to use a a given port. So far, without root privileges, a user can't use ports under 1024. Is there a way to limit a user to a given range of ports, let say [2100-2199] ?

Hugo
  • 131
  • 3
  • 1
    This is related to [the oposite problem posed here](http://unix.stackexchange.com/q/10735/1925) and likely shares some of the same limits / half solutions. – Caleb Jul 06 '11 at 13:49

2 Answers2

1

I don't know exactly how to configure this, but I think that selinux and grsecurity are able to control this through some ACL like system. Read up on those, particularly selinux, and maybe somebody that knows how to configure them can provide an more detailed pointer.

Caleb
  • 69,278
  • 18
  • 196
  • 226
1

From the Shorewall rules documentation iptables has the capability to match users or groups as long as they are on the same machine. You will need to setup the appropriate deny rule(s) for the port range. You may want to install Shorewall to manage your firewall.

BillThor
  • 8,887
  • 22
  • 27
  • Iptables doesn't work that way. When a packet is incoming it's not owned by any user (even if it's that user's process listening). Only outgoing packets have a user, and not all packets will be owned by who you think they should be. – bahamat Jul 06 '11 at 20:23