This option is part of an extended packet matching module. You need to load
such modules explicitly (in many cases). Try including "--match owner" just
before the --uid-owner argument. That should load the appropriate module.
George Toft wrote:
> Your assumption is correct - squid + DansGuardian
>
> I need a little help.
>
> I tried:
> iptables -A OUTPUT -p TCP --dport 80 --uid-owner cff -j REJECT
> and got this error:
> iptables v1.3.3: Unknown arg `--uid-owner'
> Try `iptables -h' or `iptables --help' for more information.
>
> I also tried
> iptables -A OUTPUT -p TCP --dport 80 --uid-owner 1001 -j REJECT
> with the same error.
>
> I looked in the man page, and it looks right to me:
> --uid-owner userid
> Matches if the packet was created by a process with the
> given effective user id.
>
> What did I mess up?
>
> George Toft, CISSP, MSIS
> 623-203-1760
>
>
>
> Joshua Zeidner wrote:
>> On 1/21/07, George Toft <george@georgetoft.com> wrote:
>>
>>> I need to set up a Linux workstation (Computers for Families project)
>>> that filters content. The workstation is an edubuntu install. Users
>>> have a generic login, separate from the admin, and the root account is
>>> locked. I added Squid and DansGuardian, which works perfectly once the
>>> Firefox connection settings are set to 127.0.0.1:8080. Problem is that
>>> any user can override this setting in their local profile.
>>>
>>> Is there an elegan way to prevent a user from changing this setting and
>>> surfing the sites of ill repute?
>>>
>>> Kluge/Hackjob method 1:
>>> I guess I could implement a cronjob that checks to see if firefox has
>>> any established port 80 connections, then kills it. Pretty Draconian,
>>> but it will get the point across. Make pref.js read-only for the user
>>> which restores the proxy settings. Pretty inconvenient for the user :(
>>>
>>>
>>> Thoughts?
>>
>> George,
>>
>> I am assuming you are running Squid and DansGaurdian as a
>> different user than firefox( if not you should change it ). You
>> should set iptables to block all packets with destination other than
>> localhost:8080 from your browser user( use --uid-owner <firefoxuser>
>> switch ). This will also stop them from using other applications to
>> contact internet services of ill repute.
>>
>> -jmz
>>
>>
> ---------------------------------------------------
> PLUG-discuss mailing list - PLUG-discuss@lists.plug.phoenix.az.us
> To subscribe, unsubscribe, or to change you mail settings:
> http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
>
--
-Eric 'shubes'
---------------------------------------------------
PLUG-discuss mailing list -
PLUG-discuss@lists.plug.phoenix.az.us
To subscribe, unsubscribe, or to change you mail settings:
http://lists.PLUG.phoenix.az.us/mailman/listinfo/plug-discuss
![M](../imgs/f.png "Eric \\"Shubes\\" at 2007-01-22 14:02")
(text/plain)