Question

18

Disable networking for specific users

rated 0 times [ 18] [ 0] / answers: 1 / hits: 15431 / 3 Years ago, fri, august 13, 2021, 3:59:19

I'm working on Ubuntu/Mint distro meant to be ran Live. There are multiple accounts that fall into three general groups: Admin, Internet and Security.

Admin is obviously has the authority to do whatever.

Internet account is for using the Internet.

The other accounts are Security accounts. Under no circumstances is any networking Internet, printer, Bluetooth, WiFi devices, etc, allowed.

What I'd like to do is remove the network drivers from the kernel, but that would disable the accounts that need Internet.

What are the lowest level way(s) to disable Internet for these security accounts? I'm looking for impossible to connect solutions.

Answers

Only authorized users can answer the question. Please sign in first, or register a free account.

ardingiba

Add To Favorites

Follow

Total Points: 497

Total Questions: 95

Total Answers: 109

Location: Gabon

Member since Sat, Jan 15, 2022

2 Years ago

answered 3 Years ago bblerest · Accepted Answer

You can do that with iptables (ip6tables).

Until reboot

On a terminal add the rule to iptables

sudo iptables -A OUTPUT -p all -m owner --uid-owner username -j DROP

sudo ip6tables -A OUTPUT -p all -m owner --uid-owner username -j DROP

where username is the user that you want to disable the Internet connection. Save the file and exit.

This will add a rule to iptables (ip6tables) saying that any outgoing packages created by the specified user will be automatically dropped by it.

If you want to do the same for a complete group I suggest that instead of --uid username you use --gid-owner groupname, that will have the same effect for a complete user group.

So, for example, to prevent the group security from accessing the Internet the command would look something like this

sudo iptables -A OUTPUT -p all -m owner --gid-owner security -j DROP

sudo ip6tables -A OUTPUT -p all -m owner --gid-owner security -j DROP

Permanent

To make the rule permanent you can create a script in /etc/network/if-up.d/, add the necessary lines to it and make it executable.

As an option use iptables-save (ip6tables-save) to save your current rules and restore them on boot.

Save the current iptables rules

sudo iptables-save > /etc/iptables_rules

sudo ip6tables-save > /etc/ip6tables_rules

Open /etc/rc.local with your favorite text editor and at the end of the file add

/sbin/iptables-restore < /etc/iptables_rules

/sbin/ip6tables-restore < /etc/ip6tables_rules

That will restore the saved rules on each boot. Be careful in noticing that users for which you blocked only ipv4 connections will still be able to connect to the internet.

For more informations and several more iptables options consult its manpage.