mirror of
https://gitlab.com/shorewall/code.git
synced 2024-11-24 08:33:40 +01:00
c2ccd7fd3d
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@800 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
142 lines
6.1 KiB
HTML
Executable File
142 lines
6.1 KiB
HTML
Executable File
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||
<html>
|
||
<head>
|
||
<meta http-equiv="Content-Language" content="en-us">
|
||
<meta http-equiv="Content-Type"
|
||
content="text/html; charset=windows-1252">
|
||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||
<title>Controlling Traffic by UID/GID</title>
|
||
<meta name="author" content="Tom Eastep">
|
||
</head>
|
||
<body>
|
||
<table border="0" cellpadding="0" cellspacing="0"
|
||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||
id="AutoNumber1" bgcolor="#3366ff" height="90">
|
||
<tbody>
|
||
<tr>
|
||
<td width="100%">
|
||
<h1 align="center"><font color="#ffffff">Controlling Output
|
||
Traffic by UID/GID<br>
|
||
</font></h1>
|
||
</td>
|
||
</tr>
|
||
</tbody>
|
||
</table>
|
||
This capability was added in Shorewall release
|
||
1.4.7.<br>
|
||
<br>
|
||
Netfilter provides the capability to filter packets generated on the
|
||
firewall system by User Id and/or Group Id. Shorewall provides two
|
||
separate but related ways to use this Netfilter capability:<br>
|
||
<ol>
|
||
<li>Shorewall allows you to
|
||
define collections of users called "<a href="#UserSet">User Sets</a>"
|
||
and then to restrict
|
||
certain rules in /etc/shorewall/rules to a given User Set.</li>
|
||
<li>Shorewall also allows you to restrict a given <a href="#Rule">rule
|
||
</a>to a particular user and/or group.<br>
|
||
</li>
|
||
</ol>
|
||
Since only packets created by programs running on the Shorewall box
|
||
itself, only rules whose SOURCE is the firewall ($FW) may be restricted
|
||
using either of the facilities.<br>
|
||
<h2><a name="UserSet"></a>User Sets<br>
|
||
</h2>
|
||
Given the way that this facility is implemented in Shorewall, it is not
|
||
possible to control logging of individual rules using a User Set and
|
||
logging is rather specified on the User Set itself.<br>
|
||
<br>
|
||
User Sets are defined in the /etc/shorewall/usersets file. Columns in
|
||
that file include:<br>
|
||
<br>
|
||
<div style="margin-left: 40px;">USERSET
|
||
The name of a User Set. Must be a legal
|
||
shell
|
||
identifier of no more than six (6) characters in length.<br>
|
||
REJECT
|
||
Log level for connections rejected for this User Set.<br>
|
||
ACCEPT Log
|
||
level for connections accepted for this User Set.<br>
|
||
DROP
|
||
Log level for connections dropped for this User Set.<br>
|
||
</div>
|
||
<br>
|
||
In the REJECT and ACCEPT columns, if you don't want to specify a value
|
||
in the column but you want to specify a value in a following column,
|
||
you may enter "-".<br>
|
||
<br>
|
||
Users and/or groups are added to User Sets using the
|
||
/etc/shorewall/users file. Columns in that file are:<br>
|
||
<br>
|
||
<div style="margin-left: 40px;">USERSET
|
||
The name of a User Set defined in
|
||
/etc/shorewall/usersets.<br>
|
||
USER
|
||
The name of a user defined on the system or a user number.<br>
|
||
GROUP
|
||
The name of a group defined on the system or a number.<br>
|
||
</div>
|
||
<p align="left">Only one of the USER and GROUP
|
||
column needs to be non-empty. If you wish to specify a GROUP but not a
|
||
USER, enter "-" in the user column.<br>
|
||
</p>
|
||
<p align="left">If both USER and GROUP are
|
||
specified then only programs running under that USER:GROUP pair will
|
||
match rules specifying the User Set named in the USERSET column.<br>
|
||
</p>
|
||
<p align="left">Once a user set has been defined, its name may be
|
||
placed in the USER SET column of the /etc/shorewall/rules file. <span
|
||
style="color: rgb(255, 0, 0);"><span style="font-weight: bold;">IMPORTANT:
|
||
</span></span>When
|
||
the name of a user set is given in the USER SET column, you may not
|
||
include a log level in the ACTION column; logging of such rules is
|
||
governed solely by the user set's definition in the
|
||
/etc/shorewall/userset file.
|
||
</p>
|
||
<p align="left">Example: You want members of the
|
||
'admin' group and 'root' to be able to use ssh on the firewall to
|
||
connect to local systems. You want to log all connections accepted for
|
||
these users using syslog at the 'info' level.<br>
|
||
</p>
|
||
<div style="margin-left: 40px;"></div>
|
||
<p align="left" style="margin-left: 40px;">/etc/shorewall/usersets</p>
|
||
<div style="margin-left: 40px;"></div>
|
||
<pre style="margin-left: 80px;">#USERSET REJECT ACCEPT DROP<br>admins - info<br></pre>
|
||
<div style="margin-left: 40px;"></div>
|
||
<p align="left" style="margin-left: 40px;">/etc/shorewall/users<br>
|
||
</p>
|
||
<div style="margin-left: 40px;"></div>
|
||
<pre style="margin-left: 80px;">#USERSET USER GROUP<br>admins - admin<br>admins root<br></pre>
|
||
<div style="margin-left: 40px;">/etc/shorewall/rules<br>
|
||
</div>
|
||
<pre style="margin-left: 80px;">#ACTION SOURCE DESTINATION PROTO PORT SOURCE ORIGINAL RATE USER<br># PORT(S) DESTINATION SET<br><br>ACCEPT $FW loc tcp 22 - - - admins<br></pre>
|
||
<h2><a name="Rule"></a>Restricting a rule to a particular user and/or
|
||
group<br>
|
||
</h2>
|
||
In cases where you may want to restrict a rule to a particular user
|
||
and/or group, the USER SET column in the rules file may be specified as:<br>
|
||
<br>
|
||
<div style="margin-left: 40px;">[ <<span style="font-style: italic;">user
|
||
name or number</span>> ] : [ <<span style="font-style: italic;">group
|
||
name or number</span>> ]<br>
|
||
<div style="text-align: left;"><br>
|
||
</div>
|
||
</div>
|
||
When a user and/or group name is given in the USER SET column, it is OK
|
||
to specify a log level in the ACTION column. <br>
|
||
<br>
|
||
Example: You want user <span style="font-style: italic;">mail </span>to
|
||
be able to send email from the firewall to the local net zone<br>
|
||
<br>
|
||
<div style="margin-left: 40px;">/etc/shorewall/rules (be sure to note
|
||
the ":" in the USER SET column entry).<br>
|
||
<pre>#ACTION SOURCE DESTINATION PROTO PORT SOURCE ORIGINAL RATE USER<br># PORT(S) DESTINATION SET<br><br>ACCEPT $FW loc tcp 25 - - - mail:</pre>
|
||
</div>
|
||
<p align="left"><font size="2">Last updated 9/19/2003 - <a
|
||
href="support.htm">Tom Eastep</a></font></p>
|
||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||
<EFBFBD> <font size="2">2003 Thomas M. Eastep.</font></a></font></p>
|
||
</body>
|
||
</html>
|