forked from extern/shorewall_code
Content moved to UserSets.xml
git-svn-id: https://shorewall.svn.sourceforge.net/svnroot/shorewall/trunk@939 fbd18981-670d-0410-9b5c-8dc0c1a9a2bb
This commit is contained in:
mhnoyes
parent
537090184f
commit
06516f33b5
@ -1,141 +0,0 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
|
||||
<html>
|
||||
<head>
|
||||
<meta http-equiv="Content-Language" content="en-us">
|
||||
<meta http-equiv="Content-Type"
|
||||
content="text/html; charset=windows-1252">
|
||||
<meta name="GENERATOR" content="Microsoft FrontPage 5.0">
|
||||
<meta name="ProgId" content="FrontPage.Editor.Document">
|
||||
<title>Controlling Traffic by UID/GID</title>
|
||||
<meta name="author" content="Tom Eastep">
|
||||
</head>
|
||||
<body>
|
||||
<table border="0" cellpadding="0" cellspacing="0"
|
||||
style="border-collapse: collapse;" bordercolor="#111111" width="100%"
|
||||
id="AutoNumber1" bgcolor="#3366ff" height="90">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td width="100%">
|
||||
<h1 align="center"><font color="#ffffff">Controlling Output
|
||||
Traffic by UID/GID<br>
|
||||
</font></h1>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
This capability was added in Shorewall release
|
||||
1.4.7.<br>
|
||||
<br>
|
||||
Netfilter provides the capability to filter packets generated on the
|
||||
firewall system by User Id and/or Group Id. Shorewall provides two
|
||||
separate but related ways to use this Netfilter capability:<br>
|
||||
<ol>
|
||||
<li>Shorewall allows you to
|
||||
define collections of users called "<a href="#UserSet">User Sets</a>"
|
||||
and then to restrict
|
||||
certain rules in /etc/shorewall/rules to a given User Set.</li>
|
||||
<li>Shorewall also allows you to restrict a given <a href="#Rule">rule
|
||||
</a>to a particular user and/or group.<br>
|
||||
</li>
|
||||
</ol>
|
||||
Since only packets created by programs running on the Shorewall box
|
||||
itself, only rules whose SOURCE is the firewall ($FW) may be restricted
|
||||
using either of the facilities.<br>
|
||||
<h2><a name="UserSet"></a>User Sets<br>
|
||||
</h2>
|
||||
Given the way that this facility is implemented in Shorewall, it is not
|
||||
possible to control logging of individual rules using a User Set and
|
||||
logging is rather specified on the User Set itself.<br>
|
||||
<br>
|
||||
User Sets are defined in the /etc/shorewall/usersets file. Columns in
|
||||
that file include:<br>
|
||||
<br>
|
||||
<div style="margin-left: 40px;">USERSET
|
||||
The name of a User Set. Must be a legal
|
||||
shell
|
||||
identifier of no more than six (6) characters in length.<br>
|
||||
REJECT
|
||||
Log level for connections rejected for this User Set.<br>
|
||||
ACCEPT Log
|
||||
level for connections accepted for this User Set.<br>
|
||||
DROP
|
||||
Log level for connections dropped for this User Set.<br>
|
||||
</div>
|
||||
<br>
|
||||
In the REJECT and ACCEPT columns, if you don't want to specify a value
|
||||
in the column but you want to specify a value in a following column,
|
||||
you may enter "-".<br>
|
||||
<br>
|
||||
Users and/or groups are added to User Sets using the
|
||||
/etc/shorewall/users file. Columns in that file are:<br>
|
||||
<br>
|
||||
<div style="margin-left: 40px;">USERSET
|
||||
The name of a User Set defined in
|
||||
/etc/shorewall/usersets.<br>
|
||||
USER
|
||||
The name of a user defined on the system or a user number.<br>
|
||||
GROUP
|
||||
The name of a group defined on the system or a number.<br>
|
||||
</div>
|
||||
<p align="left">Only one of the USER and GROUP
|
||||
column needs to be non-empty. If you wish to specify a GROUP but not a
|
||||
USER, enter "-" in the user column.<br>
|
||||
</p>
|
||||
<p align="left">If both USER and GROUP are
|
||||
specified then only programs running under that USER:GROUP pair will
|
||||
match rules specifying the User Set named in the USERSET column.<br>
|
||||
</p>
|
||||
<p align="left">Once a user set has been defined, its name may be
|
||||
placed in the USER SET column of the /etc/shorewall/rules file. <span
|
||||
style="color: rgb(255, 0, 0);"><span style="font-weight: bold;">IMPORTANT:
|
||||
</span></span>When
|
||||
the name of a user set is given in the USER SET column, you may not
|
||||
include a log level in the ACTION column; logging of such rules is
|
||||
governed solely by the user set's definition in the
|
||||
/etc/shorewall/userset file.
|
||||
</p>
|
||||
<p align="left">Example: You want members of the
|
||||
'admin' group and 'root' to be able to use ssh on the firewall to
|
||||
connect to local systems. You want to log all connections accepted for
|
||||
these users using syslog at the 'info' level.<br>
|
||||
</p>
|
||||
<div style="margin-left: 40px;"></div>
|
||||
<p align="left" style="margin-left: 40px;">/etc/shorewall/usersets</p>
|
||||
<div style="margin-left: 40px;"></div>
|
||||
<pre style="margin-left: 80px;">#USERSET REJECT ACCEPT DROP<br>admins - info<br></pre>
|
||||
<div style="margin-left: 40px;"></div>
|
||||
<p align="left" style="margin-left: 40px;">/etc/shorewall/users<br>
|
||||
</p>
|
||||
<div style="margin-left: 40px;"></div>
|
||||
<pre style="margin-left: 80px;">#USERSET USER GROUP<br>admins - admin<br>admins root<br></pre>
|
||||
<div style="margin-left: 40px;">/etc/shorewall/rules<br>
|
||||
</div>
|
||||
<pre style="margin-left: 80px;">#ACTION SOURCE DESTINATION PROTO PORT SOURCE ORIGINAL RATE USER<br># PORT(S) DESTINATION SET<br><br>ACCEPT $FW loc tcp 22 - - - admins<br></pre>
|
||||
<h2><a name="Rule"></a>Restricting a rule to a particular user and/or
|
||||
group<br>
|
||||
</h2>
|
||||
In cases where you may want to restrict a rule to a particular user
|
||||
and/or group, the USER SET column in the rules file may be specified as:<br>
|
||||
<br>
|
||||
<div style="margin-left: 40px;">[ <<span style="font-style: italic;">user
|
||||
name or number</span>> ] : [ <<span style="font-style: italic;">group
|
||||
name or number</span>> ]<br>
|
||||
<div style="text-align: left;"><br>
|
||||
</div>
|
||||
</div>
|
||||
When a user and/or group name is given in the USER SET column, it is OK
|
||||
to specify a log level in the ACTION column. <br>
|
||||
<br>
|
||||
Example: You want user <span style="font-style: italic;">mail </span>to
|
||||
be able to send email from the firewall to the local net zone<br>
|
||||
<br>
|
||||
<div style="margin-left: 40px;">/etc/shorewall/rules (be sure to note
|
||||
the ":" in the USER SET column entry).<br>
|
||||
<pre>#ACTION SOURCE DESTINATION PROTO PORT SOURCE ORIGINAL RATE USER<br># PORT(S) DESTINATION SET<br><br>ACCEPT $FW loc tcp 25 - - - mail:</pre>
|
||||
</div>
|
||||
<p align="left"><font size="2">Last updated 9/19/2003 - <a
|
||||
href="support.htm">Tom Eastep</a></font></p>
|
||||
<p><font face="Trebuchet MS"><a href="copyright.htm"><font size="2">Copyright</font>
|
||||
© <font size="2">2003 Thomas M. Eastep.</font></a></font></p>
|
||||
</body>
|
||||
</html>
|
||||
Loading…
Reference in New Issue
Block a user