Arch Linux

ezzetabi

Member

Registered: 2006-08-27

Posts: 947

Stop a program from connecting to the Internet

For any reason you want to stop a program from connecting to the Internet.

What can you do?

I used iptables, this rule blocks the outgoing connections for user ``blockinternet'' (uid 1004)

-A OUTPUT ! -o lo -m owner --uid-owner 1004 -j DROP

I added to sudoers the command ``su - blockinternet'' and it seems working, but using
a different user has some problems. It uses a different home shared to all users, it need
to enable ``xhost +local:'' for opening X windows...

Is there a better way? Lets discuss...

tr!x0r

Member

From: Belgium

Registered: 2010-12-31

Posts: 55

Website

Re: Stop a program from connecting to the Internet

We have some policies like you describe over here. Instead of blocking the internet access on the local machine, we're using a firewall that is AD integrated.
As user needs to authenticate with NTLM (Windows protocol bah!), to get on the internet. This gives the security team the possibility to check who's allowed to go online and who's not. (All the programs run as a specific user)

As a dedicated Linux user, this is a pain in my ass! ;-).

So, on topic,

The program, will it always go to the same url? if so, I would block it on DNS level.

On Ubuntu geek they suggest the same solution as you did, http://www.ubuntugeek.com/disable-inter … buntu.html

Cheers

Last edited by tr!x0r (2012-08-09 09:04:47)

---

Remember, when using Linux, you're the one in control
http://www.linux-answered.com

ebal

Member

From: Athens, Greece

Registered: 2009-05-26

Posts: 224

Website

Re: Stop a program from connecting to the Internet

what about pid-owner ?

http://www.frozentux.net/iptables-tutor … OWNERMATCH

	--pid-owner

---

https://balaskas.gr
Linux System Engineer - Registered Linux User #420129

ezzetabi

Member

Registered: 2006-08-27

Posts: 947

Re: Stop a program from connecting to the Internet

--cmd-owner and --pid-owner seems worth a try, but it seems they cannot be used directly in archlinux

# iptables -A OUTPUT -m owner --cmd-owner firefox -j DROP
iptables v1.4.14: unknown option "--cmd-owner"
Try `iptables -h' or 'iptables --help' for more information.
# iptables -A OUTPUT -m owner --pid-owner 790884 -j DROP
iptables v1.4.14: unknown option "--pid-owner"
Try `iptables -h' or 'iptables --help' for more information.

Do I need to recompile the kernel?