Tell me more ×
Ask Ubuntu is a question and answer site for Ubuntu users and developers. It's 100% free, no registration required.
up vote 5 down vote favorite
2

As it is, Linux fails to bind ports < 1024 for any user other than root.

How do you blacklist or whitelist ranges of ports for specific normal users, so that they can not bind them, in the same way a normal user can't bind port 80?

There is a way to block traffic through these ports via iptables, but as this is a real multi-user environment, they really need to be impossible to bind.

share|improve this question
Sounds like you are looking for something that could be set at an enterprise level that would trickle down to a large number of hosts? You could set the IPtables rules on one host then just scp the script to all the hosts that you would to apply this to. – Justin Andrusk Aug 30 '11 at 16:29
The users will be running their own code on this machine, that's why it'd be so much nicer if the ports fail to bind, rather than iptables silently blocking network traffic. I've also heard that SELinux can do something like this. – Stefano Palazzo♦ Aug 30 '11 at 16:32
1  
You can use SELinux, but it might not be sufficiently flexible. According to wzzrd's answer on this serverfault question: serverfault.com/questions/245374/… , you can construct rules which allow (or deny) use of operations (like bind) on SELinux labels (which can be ports). I doubt that automated tools exist to create those rules. – taneli Aug 31 '11 at 19:25

2 Answers

up vote 3 down vote

Based on the article I'm attaching you have a few possible options and you can combine them:

  1. SELinux - As was stated earlier you might have to set a policy to restrict this to specific processes such as bind system calls and the like.
  2. GRSecurity - The article is stating that you would have to make this application specific so I'm wondering if you just defined the application as the users shell (i.e. /bin/bash) this might work.

There are others listed that seem to fall in line with GRSecurity, but if you do pursue GRSecurity you need to make sure that your kernel has it enabled.

How can I restrict ports for users to bind to?

share|improve this answer
up vote 1 down vote

One approach would be to run port reserve which can be found in ubuntu, this allows you to bind to the ports which would then be reserved disallowing anyone else to bind to them.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.