iptables

I would like to deny a group of user (GID 1000) to send packets from the
server to the outside when they connect with ssh.

My default policies are all ACCEPT.

I added this rule to avoid GID 1000 to connect anywhere from the shell:

/usr/sbin/iptables -A OUTPUT -s 0/0 -m owner --gid-owner 1000 -j REJECT

This work fine, but I would like to allow those users to connect to the
server with FTP too.
PASSIVE FTP uses highports so I changed the rules to:

/usr/sbin/iptables -A OUTPUT -p TCP -s 0/0 -m owner --gid-owner 1000 --dport
1024:65535 -j ACCEPT
/usr/sbin/iptables -A OUTPUT -s 0/0 -m owner --gid-owner 1000 -j REJECT

In this way ftp works for GID=1000 but there is the problem that users will
be able to connect from the shell to the outside using ports 1024:65535

And the firewall will be quite useless.

How can I set up the firewall rules to Deny any kind of activity from users
with GID 1000 on the server Except the FTP connection?

thanx for your help

Dopa

sinapsi <info@zam.it> wrote:

> I would like to deny a group of user (GID 1000) to send packets from the
> server to the outside when they connect with ssh.
>
> My default policies are all ACCEPT.

It's better to have drop as policy and then explicitly allow
only certain services.


> I added this rule to avoid GID 1000 to connect anywhere from the shell:
>
> /usr/sbin/iptables -A OUTPUT -s 0/0 -m owner --gid-owner 1000 -j REJECT
>
> This work fine, but I would like to allow those users to connect to the
> server with FTP too.
[...]
> How can I set up the firewall rules to Deny any kind of activity from
> users with GID 1000 on the server Except the FTP connection?

Use FTP connection tracking and allow outgoing FTP control
connections. Something similar like:

modprobe ip_conntrack_ftp

iptables -A OUTPUT -p tcp --dport ftp -m owner --gid-owner 1000 \
--syn -m state --state NEW -j ACCEPT
iptables -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT

iptables -A OUTPUT -m owner --gid-owner 1000 -j REJECT

Note, if you use NAT you need to use "modprobe ip_nat_ftp"
above.


HTH

Ciao, Horst
--
»When pings go wrong (It hurts me too)« E.Clapton/E.James/P.Tscharn