Home / server / Questions / 376568
Accepted
Alexander Farber
Asked: 2012-04-05 00:56:27 +0800 CST

Block outgoing connections for certaing uids (root, apache, nobody)

  • 772

With iptables in CentOS 5 and 6 Linux - how can you please prevent processes running as root, apache or nobody from initiating outgoing connections?

On CentOS 5 Linux I've tried putting these lines into /etc/sysconfig/iptables:

-A OUTPUT -m owner --uid-owner root -j DROP
-A OUTPUT -m owner --uid-owner apache -j DROP
-A OUTPUT -m owner --uid-owner nobody -j DROP

but unfortunately get the error:

# sudo service iptables restart
iptables: Flushing firewall rules:                         [  OK  ]
iptables: Setting chains to policy ACCEPT: filter          [  OK  ]
iptables: Unloading modules:                               [  OK  ]
iptables: Applying firewall rules: iptables-restore v1.4.7: owner: Bad value for "--uid-owner" option: "apache"
Error occurred at line: 27
Try `iptables-restore -h' or 'iptables-restore --help' for more information.
                                                           [FAILED]
firewall centos iptables centos6 centos5

1 Answers

  1. Best Answer

    Try using the numeric UID instead of the name. For example: 

    -A OUTPUT -m owner --uid-owner 400 -j DROP

    instead of 

    -A OUTPUT -m owner --uid-owner apache -j DROP

    You can find the UID by typing 

    id user
    • 8