4 ms·

No, you don't need any special privileges to bind to a low port, just set the right capability: # setcap cap_net_bind_service=+ep /usr/sbin/httpd You should n

• acdha 8y ago
  I agree with you but it’s worth acknowledging that setting capabilities and making sure they persist across updates (e.g. your example breaks the first time a package update is installed) isn’t always trivial, especially in bureaucratic enterprise IT environments, and although the risk is lower an attacker could still potentially find interesting things to do using other low ports unless you’ve also setup something like authbind to limit it to just port 80/443.
• teleclimber 8y ago
  Worth noting that this allows the httpd executable to bind to a low port. Meaning that any call to httpd now has this privilege. A reverse proxy is much more targeted. For httpd this may not matter as much because it's only used as a serve. But if you use node, giving all node scripts the ability to bind to a low port is uncomfortable.