Date: Sat, 6 Sep 2003 22:31:05 +0100 From: Bruce M Simpson <bms@spc.org> To: jakae <jaka@schalab.net> Cc: freebsd-net@freebsd.org Subject: Re: network blocking per system (local) user Message-ID: <20030906213105.GQ1417@spc.org> In-Reply-To: <3F5994CF.10802@schalab.net> References: <3F5994CF.10802@schalab.net>
next in thread | previous in thread | raw e-mail | index | archive | help
On Sat, Sep 06, 2003 at 10:03:27AM +0200, jakae wrote:
> I have a freebsd box which is connected to two different networks
> (public and private). I would like to give to somebody a shell account
> on this box, but allow him just to see, trace,.. the public network. The
> best would be if he could not even see that this box is connected to
> some private network
There's nothing to stop him from seeing that you have an interface
on the private network via ifconfig(8) or sysctl (he will clearly be
able to see the interfaces in the MIB if he knows where to look).
However, if you want to restrict his access to hosts on that network
(or beyond), you could use an ipfw ruleset containing the following:-
uid user
Match all TCP or UDP packets sent by or received for a user. A
user may be matched by name or identification number.
I think this may be limited to ipfw2, YMMV; this will work in 5.x.
BMS
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20030906213105.GQ1417>