On Sat, Sep 06, 2003 at 10:03:27AM +0200, jakae wrote:
> I have a freebsd box which is connected to two different networks
> (public and private). I would like to give to somebody a shell account
> on this box, but allow him just to see, trace,.. the public network. The
> best would be if he could not even see that this box is connected to
> some private network
There's nothing to stop him from seeing that you have an interface
on the private network via ifconfig(8) or sysctl (he will clearly be
able to see the interfaces in the MIB if he knows where to look).
However, if you want to restrict his access to hosts on that network
(or beyond), you could use an ipfw ruleset containing the following:-
uid user
Match all TCP or UDP packets sent by or received for a user. A
user may be matched by name or identification number.
I think this may be limited to ipfw2, YMMV; this will work in 5.x.
BMS
_______________________________________________
[EMAIL PROTECTED] mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "[EMAIL PROTECTED]"
