18

I'm working on Ubuntu/Mint distro meant to be ran Live. There are multiple accounts that fall into three general groups: Admin, Internet and Security.

  • Admin is obviously has the authority to do whatever.
  • Internet account is for using the Internet.

The other accounts are Security accounts. Under no circumstances is any networking Internet, printer, Bluetooth, WiFi devices, etc, allowed.

What I'd like to do is remove the network drivers from the kernel, but that would disable the accounts that need Internet.

What are the lowest level way(s) to disable Internet for these security accounts? I'm looking for impossible to connect solutions.

0

3 Answers 3

18

You can do that with iptables (ip6tables).

Until reboot

On a terminal add the rule to iptables

sudo iptables -A OUTPUT -p all -m owner --uid-owner username -j DROP
sudo ip6tables -A OUTPUT -p all -m owner --uid-owner username -j DROP

where username is the user that you want to disable the Internet connection. Save the file and exit.

This will add a rule to iptables (ip6tables) saying that any outgoing packages created by the specified user will be automatically dropped by it.

If you want to do the same for a complete group I suggest that instead of --uid username you use --gid-owner groupname, that will have the same effect for a complete user group.

So, for example, to prevent the group security from accessing the Internet the command would look something like this

sudo iptables -A OUTPUT -p all -m owner --gid-owner security -j DROP
sudo ip6tables -A OUTPUT -p all -m owner --gid-owner security -j DROP

Permanent

To make the rule permanent you can create a script in /etc/network/if-up.d/, add the necessary lines to it and make it executable.

As an option use iptables-save (ip6tables-save) to save your current rules and restore them on boot.

Save the current iptables rules

sudo iptables-save > /etc/iptables_rules
sudo ip6tables-save > /etc/ip6tables_rules

Open /etc/rc.local with your favorite text editor and at the end of the file add

/sbin/iptables-restore < /etc/iptables_rules
/sbin/ip6tables-restore < /etc/ip6tables_rules

That will restore the saved rules on each boot. Be careful in noticing that users for which you blocked only ipv4 connections will still be able to connect to the internet.

For more informations and several more iptables options consult its manpage.

7
  • Thanks. That worked for Internet, but this user can still use bluetooth. I'm testing for wireless but have not confirmed. I seem to have the account stuck on DENY. I tried sudo iptables -A OUTPUT -p all -m owner --uid-owner internet -j ACCEPT but that didn't turn it back on for testing.
    – bambuntu
    Feb 6, 2012 at 23:00
  • Ok, iptables seem to be a filter for something lower that actually makes the network connection. What is the application making the connection possible? Can I disable it? If so, disabling based who is in control of the console. This live distro is meant for multiple users, but not meant for more than one console. So, if I can track who is using the console, I'm thinking I may be able to disable this network app based upon that users permissions.
    – bambuntu
    Feb 6, 2012 at 23:08
  • Well, that would be your network manager in Ubuntu that would be network-manager, if you remove a user from the group network and disable the connection in network-manager or other similar tool he will not be able to get it up again, in the other hand user that is part of the network group will. This is another level of thinking since it disables the connection it self. Feb 6, 2012 at 23:16
  • After a bit of Googling, I've found you can remove network-manager and set things up Ubuntu traditionally by editing /etc/network/interfaces. This doesn't seem to be the network app I'm looking to disable. I'm looking a bit lower. How low can we go before we get to the driver?
    – bambuntu
    Feb 7, 2012 at 0:47
  • I was able to remove and purge network-manager. At that point networking was disabled. But, I was able to bring things back with this: sudo /etc/init.d/networking after editing /etc/network/interfaces So is /etc/init.d/networking as low as you go?
    – bambuntu
    Feb 7, 2012 at 1:26
2

Bruno's solution is good: I think probably the best self-contained solution.

Another option you can think about is to set up a firewall/proxy on a separate machine, as the gateway to the internet, which only allows connections out that provide per-user authentication. You could use use both together for extra protection.

0

If firewalld is part of your setup, you can block network access for a specific user using a direct rule, es:

/etc/firewalld/direct.xml
‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾‾
<?xml version="1.0" encoding="utf-8"?>
<direct>
  <chain ipv="ipv4" 
         table="filter" 
         chain="restrict_user_ipv4"/>
  <rule ipv="ipv4" 
        table="filter" 
        chain="OUTPUT" 
        priority="1">-m owner --uid-owner user -j restrict_user_ipv4</rule>
  <rule ipv="ipv4" 
        table="filter" 
        chain="restrict_user_ipv4" 
        priority="3">-j DROP</rule>
  <chain ipv="ipv6" 
         table="filter" 
         chain="restrict_user_ipv6"/>
  <rule ipv="ipv6" 
        table="filter" 
        chain="OUTPUT" 
        priority="1">-m owner --uid-owner user -j restrict_user_ipv6</rule>
  <rule ipv="ipv6" 
        table="filter" 
        chain="restrict_user_ipv6" 
        priority="3">-j DROP</rule>
</direct>

Don't forget to reload with

# firewall-cmd --reload

References

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .