Shell Programming and Scripting

I am not sure what your goal is in trying to restrict the ip addresses that a user can access. My first guess is that you can't for individual users without affecting many users.


If you are asking how to limit a user only to one file or one directory on a box, that would take a great deal of management on your part.

I am not sure you could limit them to one script or file or even one directory without affecting many other users at the same time.

If you allow them on the box, they will be able to go to any directory that has "read" access on the directory for world or group if they have the same group as the directory has.

If you are having that much difficulty with a user or users, you need to have a long talk with their boss or do as LivinFree suggests and kick them off your box until they learn to play well with others.

Unix requires a certain level of trust from users who have access to it on your box. You can't allow a user on your box and then clamp down on their access to the box.

That would be like closing the barn door after the horse is already outside, it doesn't work.

i explain it manytimes mabe i explain it wrong but hard to understand what i`m looking for if you dont have a shell services provider!

we have problme realy with thos users who useing BNC Or even eggdrop,

look for this

our machine have 127.0.0.0/24 class ip the and we assing for the user 127.0.0.1 for example the user can change the ip at anytime he want , and use anyip from our class 127.0.0.0/24 ips. we want something stop him from doing that and only allow him to use what we only assing for him.




Hope u got me now

you can do it using ipfw rules as the following:
say the login is big and the ip is 172.168.0.10
# for traffic in
ipfw add allow tcp from any to 172.168.0.10 in
# only login big can use the ip to outgoing traffic
ipfw add allow tcp from 172.168.0.10 to any out uid big
# for identd can access the IP to
ipfw add allow tcp from 172.168.0.10 to any out uid root
# then deny everyone else to use the IP via outgoing traffic
ipfw add deny tcp from 172.168.0.10 to any


Hope this helps

Thanks first for this.

i think this gonna work fine with eggdrops users but not with bnc users, btw i have Class C ips+ . so u dont think its hard to block ip per ip?


Thanks

Hello,
am having 2 Class C's and working fine , its just blocking the IP per user so other users/logins wont be able to use that IP which is blocked for the user.