How can I tell which user has bound to which ports?

Question

How can I get a list of ports that are being listened on and the name of the user who bound them (on linux)?

Ultimately I want to have several users on a system which are assigned 2 ports to use and may not bind on any other ports.

I couldn't figure out how to do that, but it seems that if I had the right combination of bash-fu, I should be able to get the aforementioned list and periodically check to see which users have bound to which ports and if any users should be locked out for using ports which they were not assigned.

Answer 1

You can probably get the answer using netstat, however, I have always used lsof which I usually install on servers. lsof is great for investigating linux processes and the files and sockets they are utilizing. For example, lsof -i -P will produce this type of output:

# lsof -i -P
COMMAND     PID    USER   FD   TYPE   DEVICE SIZE/OFF NODE NAME
sshd       1468    root    3u  IPv4   599160      0t0  TCP *:22 (LISTEN)
mysqld     1718   mysql   10u  IPv4   599883      0t0  TCP *:3306 (LISTEN)
dovecot    1776    root    5u  IPv4   599934      0t0  TCP *:993 (LISTEN)
spamd      1789    root    5u  IPv4   600861      0t0  TCP localhost.localdomain:783 (LISTEN)

Combine this with cut, grep, sed, etc and you should be able to script up a solution that provides you a report.

Answer 2

How about using IPTABLES to allow only ports which you want your users should have access to: eg allow port 80:

/sbin/iptables -A INPUT -p tcp --dport 80 -j ACCEPT
/sbin/iptables -A OUTPUT -p tcp --sport 80 -j ACCEPT

rest other ports are by default rejected(need few more entries to specify default behavior). The same concept is explained here

Also, if in future if you want to allow any user to have access to some specific port, you can add an entry to IPTABLE with options -m owner --uid-owner {USERNAME} for specific user