Hi all,

I have been searching for a way to restrict users' access to specific
ethernet devices. We have a couple of consultant users who have ssh
access to one host, but I would like to prevent them from using the
eth1 LAN interface. Is this possible? Since there's no device file
in /dev I can't change permissions or ownership.

Thanks,

Michael wrote:
Hi all,

I have been searching for a way to restrict users' access to specific
ethernet devices. We have a couple of consultant users who have ssh
access to one host, but I would like to prevent them from using the
eth1 LAN interface. Is this possible? Since there's no device file
in /dev I can't change permissions or ownership.

Thanks,

Not sure on the situation of things - but any chance you could do an
iptables block by MAC or IP? If they are on your corporate network,
this could be a solution if they don't change around. I personally
don't know a way to do it by user unless you put something in
/etc/profile that pops an iptable rule in from the address they are
coming from - don't forget to take it out when they logout or exit -
this can of course be problematic with disconnected sessions.

What did you put into their contract - the practical way would be to
have terms/conditions/etc. that they should follow. If you don't trust
them, or they break the contract, then fire them. Computer firewall
rules don't replace common sense or legal agreements.

owner
This module attempts to match various characteristics of the
packet creator, for locally-generated packets. It is only valid
in the OUTPUT chain, and even then some packets (such as ICMP
ping responses) may have no owner, and hence never match.

--uid-owner userid
Matches if the packet was created by a process with the given
effective (numerical) user id.

On Thu, 27 Aug 2009 20:01:28 -0400
Johnny Rebel <rebel at (no spam) none.com> wrote:

Michael wrote:
Hi all,

I have been searching for a way to restrict users' access to specific
ethernet devices. We have a couple of consultant users who have ssh
access to one host, but I would like to prevent them from using the
eth1 LAN interface. Is this possible? Since there's no device file
in /dev I can't change permissions or ownership.

Thanks,
Not sure on the situation of things - but any chance you could do an
iptables block by MAC or IP? If they are on your corporate network,
this could be a solution if they don't change around. I personally
don't know a way to do it by user unless you put something in
/etc/profile that pops an iptable rule in from the address they are
coming from - don't forget to take it out when they logout or exit -
this can of course be problematic with disconnected sessions.

Thanks, I'll give this some thought. I haven't completely decided if
blocking the internal NIC is even necessary, since none of the
machines on the LAN accept commands over ssh without a root pw. In
other words, I don't truly treat the LAN as trusted.