Date: Sun, 02 Apr 2006 18:52:08 +0200 From: =?ISO-8859-1?Q?Erik_N=F8rgaard?= <norgaard@locolomo.org> To: Niklaus <niklaus@gmail.com> Cc: questions@freebsd.org Subject: Re: disable listen on ports Message-ID: <44300138.8030502@locolomo.org> In-Reply-To: <85e0e3140604020746t19565d1doc61493b89ec87905@mail.gmail.com> References: <85e0e3140604020746t19565d1doc61493b89ec87905@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
Niklaus wrote: > Hi, > How do i disable users on a system to run their own http proxy. I > don't want to allow users who have login accounts on my system to > listen to any port . How do i do that. Putting up a packet filter as some suggest may break other things. Instead, you can take a look at MAC, Mandatory Access Controls. There is a module mac_portacl(4) that can control this. You need to compile your kernel with options MAC and then add mac_portacl_load="YES" to loader.conf But don't ask me how it works, haven't used it. Cheers, Erik -- Ph: +34.666334818 web: www.locolomo.org S/MIME Certificate: www.daemonsecurity.com/ca/8D03551FFCE04F06.crt Subject ID: 9E:AA:18:E6:94:7A:91:44:0A:E4:DD:87:73:7F:4E:82:E7:08:9C:72 Fingerprint: 5B:D5:1E:3E:47:E7:EC:1C:4C:C8:3A:19:CC:AE:14:F5:DF:18:0F:B9
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?44300138.8030502>