Centos
阻止某些 uid 的傳出連接(root、apache、nobody)
在 CentOS 5 和 6 Linux 中使用 iptables - 您如何防止以root、apache或nobody身份執行的程序啟動傳出連接?
在 CentOS 5 Linux 上,我嘗試將這些行放入 /etc/sysconfig/iptables:
-A OUTPUT -m owner --uid-owner root -j DROP -A OUTPUT -m owner --uid-owner apache -j DROP -A OUTPUT -m owner --uid-owner nobody -j DROP
但不幸的是得到錯誤:
# sudo service iptables restart iptables: Flushing firewall rules: [ OK ] iptables: Setting chains to policy ACCEPT: filter [ OK ] iptables: Unloading modules: [ OK ] iptables: Applying firewall rules: iptables-restore v1.4.7: owner: Bad value for "--uid-owner" option: "apache" Error occurred at line: 27 Try `iptables-restore -h' or 'iptables-restore --help' for more information. [FAILED]
嘗試使用數字 UID 而不是名稱。例如:
-A OUTPUT -m owner --uid-owner 400 -j DROP
代替
-A OUTPUT -m owner --uid-owner apache -j DROP
您可以通過鍵入找到 UID
id user