4 ms·

One kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter p

by SEJeff 12y ago

One kind of neat thing I do is filter outbound traffic based on the user. If you're using s newish distro like centos7/rhel7 or a newer ubuntu, you can filter packets with ip tables based on the user. I force the apps in various docker containers to run as different users (one per major app or major suite of apps), and use up tables to lock those bits down. My wordpress got owned and there was a little perl script attempting to contact the C&C server, which ip tables happily blocked. It isn't a panacea, but security works best in multiple overlapping layers.

click170 12y ago
I really like this idea. I'm trying to take it one step further in fact. My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.
- chronomex 12y ago
  Maybe with VLAN tagging?
  - click170 12y ago
    I like this idea. It does assume that a user can't set the vlan themselves but my switches support this and I think it would be really cool to have segregated networks for different levels of user trust.
    - hahainternet 12y ago
      QinQ
    - mobiplayer 12y ago
      Guys, calm down! This has been applied for ages and it's networking 101. Heck, it's the freaking 'hello world' :-) And actually a user can tag his packets, but the security is applied at the switch level, where you can just strip it and add yours. Too bad that means it is not per user, but per switch port... although you may leverage 802.1x... ok, this is getting complex :-) Easier: Block all outgoing traffic, except for an authenticated proxy where every user/app has to go through in order to reach the internet.
- renaudg 12y ago
  The DSCP field is a good candidate for that.
- jethro_tell 12y ago
  Uh set the evilbit as it leaves tue machine and get the gateway to filter it?

by SEJeff 12y ago

click170 12y ago

I really like this idea. I'm trying to take it one step further in fact. My filtering is done at the gateway, and I'm hunting for ways of communicating which packets are associated with which users (on Linux and Mac). Probably done by tagging an unused part of the packet with some kind of ID.

chronomex 12y ago
Maybe with VLAN tagging?
- click170 12y ago
  I like this idea. It does assume that a user can't set the vlan themselves but my switches support this and I think it would be really cool to have segregated networks for different levels of user trust.
  - hahainternet 12y ago
    QinQ
  - mobiplayer 12y ago
    Guys, calm down! This has been applied for ages and it's networking 101. Heck, it's the freaking 'hello world' :-) And actually a user can tag his packets, but the security is applied at the switch level, where you can just strip it and add yours. Too bad that means it is not per user, but per switch port... although you may leverage 802.1x... ok, this is getting complex :-) Easier: Block all outgoing traffic, except for an authenticated proxy where every user/app has to go through in order to reach the internet.
renaudg 12y ago
The DSCP field is a good candidate for that.
jethro_tell 12y ago
Uh set the evilbit as it leaves tue machine and get the gateway to filter it?