pam_netns (CentOS, RedHat, AMI version)
what is this
Simple demonstration applying pre-configured network namespaces to user session using Pluggable Authentication Modules.
what is your use case?
You can have multiple linux users on one server to each use/see only their own designated network. Without this, all linux users share same, default network configuration. With this, users can also be isolated according to IP and network rules, in addition to user/group permissions. Linux has Network Namespaces which enable administrators to create multiple independent networks and then run processes bound to those networks. With this script, users can be bound to those networks.
Awesome/awful, should I use it?
Probably not.
Requirements
-
Python:
yum install python26 python26-devel python26-sphinx
-
pam_python
, a PAM-to-Python adapter, enabling one to run Python scripts as PAM modules.
Source here: https://sourceforge.net/projects/pam-python/
A patch to make it build on CentOS, here: https://sourceforge.net/p/pam-python/tickets/4/attachment/pam-python-1.0.7.from-1.0.6.patch
Example
Configure a network namespace using ip netns
:
ip netns add ns0
# loopback up
ip netns exec ns0 ip link set dev lo up
NOTE: By default namespaces configured with ip netns
are not preserved across reboots. You need to write your own script to restore them on boot.
Place configuration in /etc/security/pam_netns.conf
. Configuration file contains one username and network namespace name per line. Do not use hash comments. To map user test to ns0:
test ns0
Configure PAM to use this module when creating a session.
For CentOS based distributions add to the end of /etc/pam.d/sshd
:
session optional pam_python.so /etc/secirity/pam_python/pam_netns.py
Possible options:
config=<path>
use alternative location for configuration file. Default:/etc/security/pam_netns.conf
log=<path>
additional logging to a separate log. Default: empty (no logging)debug
more verbose logging
Bugs
When using sudo
, su
etc., the network namespace is not changd back to default (pid 1) one.
Further reading
https://blogs.igalia.com/dpino/2016/04/10/network-namespaces/