Date: Fri, 10 Feb 2006 04:23:03 +1100 From: andrew clarke <mail@ozzmosis.com> To: freebsd-questions@freebsd.org Subject: Re: fine grained firewall? Message-ID: <20060209172303.GA46771@ozzmosis.com> In-Reply-To: <43EB35D9.8040409@mac.com> References: <20060209084833.GA26877@ozzmosis.com> <43EB35D9.8040409@mac.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Thu, Feb 09, 2006 at 07:30:17AM -0500, Chuck Swiger wrote:
> > Is it possible to configure the FreeBSD firewall to block ports on a
> > per-user or per-executable basis?
> >
> > eg.
> >
> > - Block /usr/local/bin/irc from connecting to TCP port 6667
> >
> > - Block user 'johnsmith' from connecting to TCP port 21
>
> Yes to users (if the connections originate from the firewall box), no to
> per-executables. The latter seems useless when "cp irc myirc" is all it would
> take to defeat it. Frankly, neither option is very useful or would be needed
> for a good ruleset...
The latter may not be so useless if the firewall automatically blocked
all executables that were not registered with it. The full path,
filename, md5sum of the executable could be recorded and matched with
its database. Some Windows firewall software works this way.
It may also be useful for logging (not blocking) connections to/from a
certain executable, for traffic accounting.
I see now the option for per-user control in the ipfw manpage. Not sure
why I missed that before.
uid user
Match all TCP or UDP packets sent by or received for a user. A
user may be matched by name or identification number.
Thanks,
Regards
Andrew
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20060209172303.GA46771>