network blocking per system (local) user

[Bruce M Simpson]

On Sat, Sep 06, 2003 at 10:03:27AM +0200, jakae wrote:
> I have a freebsd box which is connected to two different networks 
> (public and private). I would like to give to somebody a shell account 
> on this box, but allow him just to see, trace,.. the public network. The 
> best would be if  he could not even see that this box is connected to 
> some private network

There's nothing to stop him from seeing that you have an interface
on the private network via ifconfig(8) or sysctl (he will clearly be
able to see the interfaces in the MIB if he knows where to look).

However, if you want to restrict his access to hosts on that network
(or beyond), you could use an ipfw ruleset containing the following:-

     uid user
             Match all TCP or UDP packets sent by or received for a user.  A
             user may be matched by name or identification number.

I think this may be limited to ipfw2, YMMV; this will work in 5.x.

BMS