3

I am interested in peoples thoughts on what the best approach would be to controlling access to network interfaces at a user/group/process level for a Linux based host. The scenario I have in mind is a multi-user, public, linux ssh login server with 2 network interfaces. One is connected to the internet for external access (public interface) and the other is connected to an internal management network (management interface) that is NOT directly connected to the outside world. Traffic/connections over this interface should ideally only be by admin users or specific processes.

Obviously traffic needs to be allowed in and out over the management interface for mounting remote filesystems, host monitoring and access to the machine when the public interface is disabled. Whilst this can be controlled with a firewall, the problem is that a firewall makes no distinction between connections to hosts on the management network from a regular user or an admin user.

I have been reading about SELinux and its network ingress/egress functionality here - http://paulmoore.livejournal.com/5536.html but I'm still investigating SELinux so I'm unsure if the access control at such granularity is even possible with this method. In my case I would be interested in the egress controls to stop connections from users or processes that are not authorised to hosts on the management network. Hopefully this would stop users from having access to hosts that need to be on a common management network but should only be visible/accessed by admins.

What other takes on such user/group/process level network access control is there apart from SELinux? Has anyone had any success with SELinux network ingress/egress controls?

Improve this question
3
  • Where does the firewall fit in your network topology? If it's running on that Linux host, iptables does have options to filter by user and by SELinux context. If it's running outside, how do you intend to communicate the user/context information from the Linux host to the firewall?
    – Gilles 'SO- stop being evil'
    May 22, 2012 at 18:11
  • The firewall would be iptables running on the Linux host.
    – blueglowey
    May 23, 2012 at 10:32
  • so a labels/iptables solution is a possibility. I was interested in the pros and cons of each - iptables and SELinux labels or SELinux and network egress controls. My aim is to stop traffic from unauthorized users/processes getting out of the host and not to try and filter inbound traffic.
    – blueglowey
    May 23, 2012 at 10:46

1 Answer 1

Reset to default
3

I have no experience of SELinux, but it is not necessary if you want to filter network access by users and groups. You can use the owner module to iptables, with rules like -m owner --uid-owner guest or -m owner --gid-owner staff.

There are several examples on our Unix sister site, in particular:

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .