Ubuntu – How to Restrict User Access to Certain Ports

portUbuntuubuntu-11.10

This question is purely hypothetical. Is it possible to restrict which ports certain users may use for their processes? Say users1 gets ports 8000-8999 and user2 gets ports 9000-9999.

I am running Ubuntu 11.10.

Best Answer

The only Linux native application that can handle this kind of restriction might be SElinux, which is part of the Ubuntu distribution. SElinux is well complicated and I am not sure how you would implement port restrictions on a per user bassis. That will be between you and Google.

This discussion mentions two kernel patches (GRsecurity and TOMOYO) which specifically allow port restrictions at the application level, although the discussion includes reference to per user port restriction.

Lastly, I have seen links to another kernel patch called 'user-port-hack' but its project page is not forthcoming and one kernel post mentions that it is for kernel 2.4 only. Perhaps you can dig for that.

A left field solution I can see for your requirement is to simply ask users to conform to a policy. i.e. "User X, please only use ports 8000-8999."

Alternatively, if your users insist on using ports other than the 1000 they have been allocated, you could isolate users to their own dedicated virtual machines and then implement firewall/iptables rules at the host level to limit the traffic to a certain port range for each VMs IP address.

Related Solutions

Firewall – What ports should be left open on a web server

sounds about right, if you're serving https only, then that's the one that you need to leave open. however, only application started with a root account can listen to ports below 1024, so you have two options here:

start your ruby app as root - not a good idea
have it behind apache - might be better, but depends on what you want to do, this may be just an additional overhead
run ruby app as other user on different port, say 8443 and have iptables to portforward requests from 443 to 8443 - this i guess is what you want to do

below is how you do port forwarding (you can do the same with 80 to 8080, for example):

iptables -t nat -A PREROUTING -i $EXT_IF -p tcp -m tcp --dport 443 -j REDIRECT --to-ports 8443

other than that, there's no need to open any other ports to the internet, just make sure you leave ssh on the other interface open, so you can access and manage the server.

as for firewall application, iptables comes with ubuntu and just use it, no need for any other fancy tool i'd say.

Ubuntu – ‘Singleton’ application – or let the user only launch one instance of a program at the time

It seems like your issue is that too many programs are able to be launched, not that there are too many of one app or another. For that, you might want to look into better process limiting/throttling so that they can't crash the machine that way.

As far as prevention with specific apps: When dealing with kids, what I would do is look into making shortcuts that open the current running instance of an app if there is one already open, and opens another only if there isn't. Or simply don't work if there's already a running instance.

You can make shortcuts that use a command from the command line instead of whatever they're currently doing. I can't recommend a specific command syntax that just doesn't work if there's already an instance running, but that's where I would start looking.

Best Answer

Related Solutions

Firewall – What ports should be left open on a web server

Ubuntu – ‘Singleton’ application – or let the user only launch one instance of a program at the time

Related Topic