Comments on: Linux disable or drop / block ping packets all together

By: Steve Gamble

Steve Gamble — Tue, 20 Dec 2011 21:17:04 +0000

Depending on the version and flavour of O/S you can play with permisions of /bin/ping. If RHEL and the suid is set change the permission to remove that bit and leave as 755. This will fail as ping uses a ICMP system call which is owned by root (that’s why the suid). If a different flavor if Linux just change the permission 700 and no outgoing pings

Good luck

By: Manu

Manu — Wed, 27 Jul 2011 22:52:17 +0000

Is there a way to block outgoing ping requests? I am trying to kill any ping request going out, like one of the internal server or what not. I am trying to add this last layer of security so if someone obtains the wireless password it would have hard time finding other server outside of the wireless network.

I am running a linksys WRT54GL with tomato on it. I already modified /proc/sys/net/ipv4/icmp_echo_ignore_all files but I guess that will stop only incoming ping requests.
Any ideas?

Thanks in advance.

Manu

By: MoCua.Com

MoCua.Com — Mon, 18 Jul 2011 00:14:38 +0000

very thanks

By: sandy

sandy — Thu, 05 May 2011 06:47:41 +0000

Hello Santosh Sir,
Thanks for reply.

You given stpes i followed but no luck . sandy user able to ping. i want to block sandy user to ping any other machine in network.

MY /etc/suderos file i paste here pls check any wrong entry.

## user MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere
root ALL=(ALL) ALL
sandy ALL= !/bin/ping
## Allows members of the ‘sys’ group to run networking, software,
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands
# %wheel ALL=(ALL) ALL

## Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL

sorry for my poor english.

Please help me.

By: K.Santhosh

K.Santhosh — Wed, 04 May 2011 16:04:54 +0000

sorry, in the previous reply i missed username field, correct syntax is

sandy ALL = !/bin/ping

By: K.Santhosh

K.Santhosh — Wed, 04 May 2011 16:02:36 +0000

You can try by adding the below line to /etc/sudoers file

ALL = !/bin/ping

Replace username field with the user whom you want to block access to ping.

By: sandy

sandy — Wed, 04 May 2011 13:03:12 +0000

Thanks For Reply

you means we cannot restrict ping with using sudoers file.

Waiting For Reply.

By: K.Santhosh

K.Santhosh — Wed, 04 May 2011 07:54:52 +0000

Hi Sandy,

As Ping command doesnot require sudo access, you can restrict ping with sudo.
Ping is just a normal user command.

By: sandy

sandy — Mon, 02 May 2011 07:22:44 +0000

Hello Vivek sir,

i want to restrict user sandy to ping any system in my network. by using sudoers file.

how it can be possible.

By: Nwb

Nwb — Wed, 11 Nov 2009 16:26:28 +0000

it’s good but when i do it global users can’t connect to FTP :S

By: V.Balaviswanathan

V.Balaviswanathan — Thu, 18 Jun 2009 08:26:55 +0000

Thanks for this information. Its helpful for us, How to do the same for debian based machines?