3 ms·

Interesting, I didn't even know this existed. I guess the "old way" of allowing an "inferior users" (like tomcat8 in my example) to bind to a port below 1024 is

Interesting, I didn't even know this existed. I guess the "old way" of allowing an "inferior users" (like tomcat8 in my example) to bind to a port below 1024 is now out-dated? I've always used authbind: # cat /etc/default/tomcat8 | grep AUTHBIND AUTHBIND=yes # touch /etc/authbind/byport/80 # chown tomcat8:tomcat8 /etc/authbind/byport/80 I guess instead the capabilities should be added for the start-up script?

Nullabillity 6y ago
cap_net_bind_service is all or nothing: you either get permission to bind all service ports or none of them. So in this case it'd be more relevant for running authbind rootless too. The actual modern solution here would be to use systemd socket activation (systemd binds the port and lets your process inherit it on startup).
- bjarneh 6y ago
  > So in this case it'd be more relevant for running authbind rootless too. Ahh OK, that makes more sense. > would be to use systemd socket activation I have to admit that every time I need one of those systemd scripts for some type of service I have, it's usually just a copy-n-paste from an older one with small modifications of paths/name etc. Perhaps I should actually learn some of that stuff. I guess it is here to stay; even though there was some debate about it a few years ago.
  - yrro 6y ago
    It looks pretty straight forward in Tomcat 8 or later. * Set useInheritedChannel="true" on one (and only one) connector * Create tomcat.socket as described in https://bz.apache.org/bugzilla/show_bug.cgi?id=60560#c8 https://bz.apache.org/bugzilla/show_bug.cgi?id=60560#c8 Shame tomcat can only accept one 'inherited' channel, so you can't have Tomcat's :443 _and_ :80 connectors both make use of systemd-created sockets.
    - bjarneh 6y ago
      > It looks pretty straight forward in Tomcat 8 or later. Yes, when seeing the examples, it doesn't look too bad. I guess without any example and no idea (at all) on how to set this up, it would still take quite some time to figure out.

Nullabillity 6y ago

cap_net_bind_service is all or nothing: you either get permission to bind all service ports or none of them. So in this case it'd be more relevant for running authbind rootless too. The actual modern solution here would be to use systemd socket activation (systemd binds the port and lets your process inherit it on startup).

bjarneh 6y ago
> So in this case it'd be more relevant for running authbind rootless too. Ahh OK, that makes more sense. > would be to use systemd socket activation I have to admit that every time I need one of those systemd scripts for some type of service I have, it's usually just a copy-n-paste from an older one with small modifications of paths/name etc. Perhaps I should actually learn some of that stuff. I guess it is here to stay; even though there was some debate about it a few years ago.
- yrro 6y ago
  It looks pretty straight forward in Tomcat 8 or later. * Set useInheritedChannel="true" on one (and only one) connector * Create tomcat.socket as described in https://bz.apache.org/bugzilla/show_bug.cgi?id=60560#c8 https://bz.apache.org/bugzilla/show_bug.cgi?id=60560#c8 Shame tomcat can only accept one 'inherited' channel, so you can't have Tomcat's :443 _and_ :80 connectors both make use of systemd-created sockets.
  - bjarneh 6y ago
    > It looks pretty straight forward in Tomcat 8 or later. Yes, when seeing the examples, it doesn't look too bad. I guess without any example and no idea (at all) on how to set this up, it would still take quite some time to figure out.