4 ms·
I don't know about httpd specifically, but many applications want root only to be able to bind to a privileged port (like :80). This can be circumvented in one
by 5e92cb50239222b 5y ago
I don't know about httpd specifically, but many applications want root only to be able to bind to a privileged port (like :80). This can be circumvented in one of a few ways:
1. add this to .service
AmbientCapabilities=CAP_NET_BIND_SERVICE
2. or listen on :8080 and use NAT:
iptables -t nat -I OUTPUT -p tcp -o lo --dport 80 -j REDIRECT --to-ports 8080
3. or make the port unprivileged
sysctl -w net.ipv4.ip_unprivileged_port_start=80
It may work for httpd too, I haven't tested it.
- Un1corn 5y agoThe correct Systemd solution would be to create a socket unit but your solutions works without modifying the service code
- Spivak 5y agoI can't find anything for an officially supported for Apache or Nginx to support inetd/systemd socket activation bit it certainly would be nice.
- growse 5y agoI think this requires support from the service, no? Not everything that wants to open up a port seems to support socket activation. I tried with 6tunnel and couldn't get it to work.
- _0w8t 5y agosystemd provides a workaround in the form of systemd-socket-proxyd [1]. Granted it copies data, but when the max performance is not required, it works. Sometimes services allow to be configured to listen UNIX socket path, then systemd-socket-proxyd allows to disable ip address access by forwarding the network socket to that. [1] https://www.freedesktop.org/software/systemd/man/systemd-socket-proxyd.html https://www.freedesktop.org/software/systemd/man/systemd-soc...
- marcosdumay 5y agoApache also uses the start user to read stuff like TLS private keys, that its normal user does not have access to.
- VTimofeenko 5y agoIt's possible to remove the root requirement for this through systemd's credentials mechanisms: https://www.freedesktop.org/software/systemd/man/systemd.exec.html#Credentials https://www.freedesktop.org/software/systemd/man/systemd.exe...
- deleted 5y ago[deleted]
- ikiris 5y agoWhich is the right way to have it link to a proper credential management system via tokens.
- Already__Taken 5y agoI seriously a few hours trying to find a way to do this and didn't once come across this mechanism, now that I've read it in still not sure how to use it. why is systemd so adverse to writing examples
- VTimofeenko 5y agoI find this blogpost is a great example of code paired with systemd configuration for the certs: https://mgdm.net/weblog/systemd/ https://mgdm.net/weblog/systemd/
- ape4 5y agoAnd I think its common for the log files to be in /var/log/httpd owned by root but I suppose they could be moved and chown-ed.
- eliaspro 5y ago
- deleted 5y ago[deleted]
- _0w8t 5y agoSome applications like nginx or php-fpm want to run worker processes under a different user account to isolate them from the main process. In those cases user namespaces are the best option. Too bad PrivateUsers= in systemd unit just does not cover this case.
- nwmcsween 5y agoThese are workarounds and not good practices