I know about changing owners/permissions on particular programs/files, but how can I control which users have access to the NIC or the power to create network sockets?


As described here, you can block all Internet access for certain users using this iptables command:

sudo iptables -A OUTPUT -m owner --uid-owner {USERNAME} -j REJECT

If you want this command to run automatically when the system starts up, you should add it to the end of your /etc/rc.local file.

While this won't make it impossible for those users to create sockets, it will block all outgoing traffic (like a firewall).

| improve this answer | |
  • 1
    how would you then reverse this command? – ubuntu_uk_user Aug 26 '15 at 16:29
  • @user2662639 Simply reboot. Unless you've added the line to /etc/rc.local, it's not persistent, and if you have, then you can just remove that line. – Frxstrem Aug 26 '15 at 16:36
  • @user2662639 (I think it's possible without rebooting but it's been three years since I wrote this answer and so I really can't remember anymore.) – Frxstrem Aug 26 '15 at 16:37
  • run this: sudo iptables -D OUTPUT -m owner --uid-owner {USERNAME} -j REJECT ||||||||| to delete the rule that you've added, notice the "-D" switch. – Artyom Dec 26 '16 at 18:01
  • @Frxstrem it would be interesting to edit the answer and include how to do it with newer versions (with systemd): what would be the simplest way instead of /etc/rc.local? (or maybe would this still work, even with systemd?) – Basj Apr 25 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.