How can I prevent code from initiating outbound http connections?

Question

I want to prevent code from making http connections to other, specific hosts. My understanding is this can be done in /etc/hosts.deny. What would that look like?

Answer 1

You could map the hostnames to localhost in /etc/hosts (its easier to setup than hosts.deny, but lacks granular control).

Example entry in hosts file:

google.com    127.0.0.1
someotherdomain.com    127.0.0.1

Oh btw, this question is better suited for serverfault.com.

Answer 2

The /etc/hosts/ approach is a poor one since on whatever address you redirect the "forbidden host" to, another web-server might listen.

If you have write access to /etc/hosts, you're generally root and also in charge of setting up your firewall. This is where you should set up rules concerning outgoing traffic.

Answer 3

The linux kernel has firewall capabilities. these will probably give you the best results. It's not clear from you question if you want to block all http connection from your machine to the specific hosts, or only a specific program - but if needed you can also filter traffic by originating application or user.

I usually use FireHOL which is a convenient wrapper around the basic firewall configuration commands.

Answer 4

A good breakdown of the host files: http://linux.about.com/od/commands/l/blcmdl5_hostsde.htm

Answer 5

No, hosts.deny will not do it. Nor will hacking /etc/hosts make any difference (it may break the resolver library, but not prevent an application making outbound connections if it does not use the standard resolver, or finds addresses in some other way).

Using a firewall is really the most obvious way. For locally-generated traffic, iptables is able to block outbound packets by user ID, group ID or process ID, which means you can restrict it to specific processes. Probably the easiest way is to do it by user ID, and run it under some restricted user.