disable listen on ports

Erik Nørgaard norgaard at locolomo.org
Sun Apr 2 16:52:19 UTC 2006


Niklaus wrote:
> Hi,
>  How do i disable users on a system to run their own http proxy. I
> don't want to allow users who have login accounts on my system to
> listen to any port . How do i do that.

Putting up a packet filter as some suggest may break other things.

Instead, you can take a look at MAC, Mandatory Access Controls. There is 
a module mac_portacl(4) that can control this.

You need to compile your kernel with options MAC and then add 
mac_portacl_load="YES" to loader.conf

But don't ask me how it works, haven't used it.

Cheers, Erik

-- 
Ph: +34.666334818                                  web: www.locolomo.org
S/MIME Certificate: www.daemonsecurity.com/ca/8D03551FFCE04F06.crt
Subject ID:  9E:AA:18:E6:94:7A:91:44:0A:E4:DD:87:73:7F:4E:82:E7:08:9C:72
Fingerprint: 5B:D5:1E:3E:47:E7:EC:1C:4C:C8:3A:19:CC:AE:14:F5:DF:18:0F:B9


More information about the freebsd-questions mailing list