Take the 2-minute tour ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.

I'm working on Ubuntu/Mint distro meant to be ran Live. There are multiple accounts that fall into three general groups: Admin, Internet and Security.

  • Admin is obviously has the authority to do whatever.
  • Internet account is for using the Internet.

The other accounts are Security accounts. Under no circumstances is any networking Internet, printer, Bluetooth, WiFi devices, etc, allowed.

What I'd like to do is remove the network drivers from the kernel, but that would disable the accounts that need Internet.

What are the lowest level way(s) to disable Internet for these security accounts? I'm looking for impossible to connect solutions.

share|improve this question

2 Answers 2

up vote 6 down vote accepted

You can do that with iptables.

On a terminal add the rule to iptables

sudo iptables -A OUTPUT -p all -m owner --uid-owner username -j DROP

where username is the user that you want to disable the Internet connection. Save the file and exit.

This will add a rule to iptables saying that any outgoing packages created by the specified user will be automatically dropped by iptables.

If you want to do the same for a complete group I sugest that instead of --uid username you use --gid-owner groupname, that will have the same effect for a complete user group.

So to prevent the group Security from accessing the Internet the command would look something like this

sudo iptables -A OUTPUT -p all -m owner --gid-owner security -j DROP

To make the rule permanent you can create a script in /etc/network/if-up.d/, add the necessary lines to it and make it executable.


As an option use iptables-save to save your current rules and restore them on boot.

Save the current iptables rules

sudo iptables-save > /etc/iptables_rules

Open /etc/rc.local with your favorite text editor and at the end of the file add

/sbin/iptables-restore < /etc/iptables_rules

That will restore the saved rules on each boot.

For more information visit the [iptables manpage] page for more information on several iptables options.

share|improve this answer
    
Thanks. That worked for Internet, but this user can still use bluetooth. I'm testing for wireless but have not confirmed. I seem to have the account stuck on DENY. I tried sudo iptables -A OUTPUT -p all -m owner --uid-owner internet -j ACCEPT but that didn't turn it back on for testing. –  bambuntu Feb 6 '12 at 23:00
    
Ok, iptables seem to be a filter for something lower that actually makes the network connection. What is the application making the connection possible? Can I disable it? If so, disabling based who is in control of the console. This live distro is meant for multiple users, but not meant for more than one console. So, if I can track who is using the console, I'm thinking I may be able to disable this network app based upon that users permissions. –  bambuntu Feb 6 '12 at 23:08
    
Well, that would be your network manager in Ubuntu that would be network-manager, if you remove a user from the group network and disable the connection in network-manager or other similar tool he will not be able to get it up again, in the other hand user that is part of the network group will. This is another level of thinking since it disables the connection it self. –  Bruno Pereira Feb 6 '12 at 23:16
    
After a bit of Googling, I've found you can remove network-manager and set things up Ubuntu traditionally by editing /etc/network/interfaces. This doesn't seem to be the network app I'm looking to disable. I'm looking a bit lower. How low can we go before we get to the driver? –  bambuntu Feb 7 '12 at 0:47
    
I was able to remove and purge network-manager. At that point networking was disabled. But, I was able to bring things back with this: sudo /etc/init.d/networking after editing /etc/network/interfaces So is /etc/init.d/networking as low as you go? –  bambuntu Feb 7 '12 at 1:26

Bruno's solution is good: I think probably the best self-contained solution.

Another option you can think about is to set up a firewall/proxy on a separate machine, as the gateway to the internet, which only allows connections out that provide per-user authentication. You could use use both together for extra protection.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.