up vote 2 down vote favorite
1
share [g+] share [fb]

How do I block a user from accessing the internet under Linux?

I'm trying the following:

iptables -A OUTPUT -p tcp --dport 80,443 -m owner --uid-owner $USERNAME -j DROP

Is that the right syntax or command?

link|improve this question
not being familiar with -m owner you could probably just remove -p tcp --dport 80,443 and prevent ALL tcp/ip access – xenoterracide Apr 5 '10 at 7:54
1  
If you have control over their access point (e.g. router), you could block their computer's physical addresses and whatnot. – iglvzx Nov 15 '11 at 0:11
feedback

2 Answers

up vote 2 down vote

And then I do ssh myhost.somewhere.onthe.internet.example.com -D 12345, point my browser to use SOCKS proxy localhost:12345, and on I go on my merry way.

In other words, blacklisting specific ports is not sufficient; you may want to block all network access:

iptables -A OUTPUT -m owner --uid-owner $USERNAME -j DROP

Note that there may be a need to access certain network resources (e.g. local network shares), so you may need to whitelist those (or perhaps whitelist the local network block).

link|improve this answer
feedback
up vote 0 down vote

This command will only block the user from accessing the World Wide Web, not the entire Internet.

Apart from that it should work, assuming it is run on the same machine $USERNAME is working on.

link|improve this answer
5  
This is correct only for web servers running on standard ports. This is the case for most web servers, but generally a web server can listen on any port. So it's possible for that user to set up a remote web server running on a non-standart port, host a CGI proxy web script there and browse the Internet over it. – geek Feb 15 '10 at 15:20
feedback

Your Answer

 
or
required, but never shown