I am interested in peoples thoughts on what the best approach would be to controlling access to network interfaces at a user/group/process level for a Linux based host. The scenario I have in mind is a multi-user, public, linux ssh login server with 2 network interfaces. One is connected to the internet for external access (public interface) and the other is connected to an internal management network (management interface) that is NOT directly connected to the outside world. Traffic/connections over this interface should ideally only be by admin users or specific processes.
Obviously traffic needs to be allowed in and out over the management interface for mounting remote filesystems, host monitoring and access to the machine when the public interface is disabled. Whilst this can be controlled with a firewall, the problem is that a firewall makes no distinction between connections to hosts on the management network from a regular user or an admin user.
I have been reading about SELinux and its network ingress/egress functionality here - http://paulmoore.livejournal.com/5536.html but I'm still investigating SELinux so I'm unsure if the access control at such granularity is even possible with this method. In my case I would be interested in the egress controls to stop connections from users or processes that are not authorised to hosts on the management network. Hopefully this would stop users from having access to hosts that need to be on a common management network but should only be visible/accessed by admins.
What other takes on such user/group/process level network access control is there apart from SELinux? Has anyone had any success with SELinux network ingress/egress controls?
iptables
does have options to filter by user and by SELinux context. If it's running outside, how do you intend to communicate the user/context information from the Linux host to the firewall?