3 ms·

sudo setcap CAP_NET_BIND_SERVICE=+eip /path/to/binary

rochacon 4y ago
Saw the title and came here to post this; simple and effective. I use this in combination with `kubectl port-forward` and `/etc/hosts` almost daily to easily proxy to internal services.
silisili 4y ago
I believe this has been the recommendation for quite some time. It's how users are able to use ping, for example. That said, I kinda agree with the author that it feels weird today. And the vast majority of people will just reach for the sudo hammer instead of researching to find setcap, which is a security nightmare. I'd probably argue keeping the idea of privileged ports, but not having it enabled by default anymore, I guess.
- bombcar 4y ago
  Unix is strange in that the vast majority of computers running it are single user, but still have everything for multiuser support laying around.
  - Beltalowda 4y ago
    Most systems do tend to use different users for running services though; so while there's a single "human user", the multi-user support is being used quite a lot.
    - bombcar 4y ago
      Which is another bandaid - "system users" is a hack that should be better handled by a system designed to handle permissions, etc in a more granular method than "this is a user".
ninefathom 4y ago
Literally my first thought when reading the article: "oh look- somebody else whining without RTFM." I kept waiting for the author to mention capabilities, and give some reason why they aren't ideal- nope. The author is (was) simply oblivious.
- beprogrammed 4y ago
  Yeap, I don't understand this security stuff, I don't know why we just don't turn it all off. As an aside, my life has been much easier since I learned you can 'sudo su' your shell and then everything just works.
  - preisschild 4y ago
    Same vibes as "Why don't you just disable the password on your phone? Swiping up is way easier"
im3w1l 4y ago
I don't want to delegate the port to a program. I want to delegate it to a user. The user should be able to open the port with any server he wants. Apache today, Django tomorrow - fine by me. Furthermore no one else should be able to run the server, they could set malicious arguments which again I don't want. Oh and finally it can get any port it wants with that CAP. I want it to only be allowed one specific port.
- sitkack 4y ago
  I understand, but the current Linux way would to make a program that implemented all those features and then exceed the program if your choice.
- ninefathom 4y ago
  I'll be happy to implement that for you. Already have a solution in mind; please feel free to reach out and we'll discuss my fees for Linux sysadmin work.

Saw the title and came here to post this; simple and effective. I use this in combination with `kubectl port-forward` and `/etc/hosts` almost daily to easily proxy to internal services.

silisili 4y ago

I believe this has been the recommendation for quite some time. It's how users are able to use ping, for example. That said, I kinda agree with the author that it feels weird today. And the vast majority of people will just reach for the sudo hammer instead of researching to find setcap, which is a security nightmare. I'd probably argue keeping the idea of privileged ports, but not having it enabled by default anymore, I guess.

bombcar 4y ago
Unix is strange in that the vast majority of computers running it are single user, but still have everything for multiuser support laying around.
- Beltalowda 4y ago
  Most systems do tend to use different users for running services though; so while there's a single "human user", the multi-user support is being used quite a lot.
  - bombcar 4y ago
    Which is another bandaid - "system users" is a hack that should be better handled by a system designed to handle permissions, etc in a more granular method than "this is a user".

ninefathom 4y ago

Literally my first thought when reading the article: "oh look- somebody else whining without RTFM." I kept waiting for the author to mention capabilities, and give some reason why they aren't ideal- nope. The author is (was) simply oblivious.

beprogrammed 4y ago
Yeap, I don't understand this security stuff, I don't know why we just don't turn it all off. As an aside, my life has been much easier since I learned you can 'sudo su' your shell and then everything just works.
- preisschild 4y ago
  Same vibes as "Why don't you just disable the password on your phone? Swiping up is way easier"

im3w1l 4y ago

I don't want to delegate the port to a program. I want to delegate it to a user. The user should be able to open the port with any server he wants. Apache today, Django tomorrow - fine by me. Furthermore no one else should be able to run the server, they could set malicious arguments which again I don't want. Oh and finally it can get any port it wants with that CAP. I want it to only be allowed one specific port.

sitkack 4y ago
I understand, but the current Linux way would to make a program that implemented all those features and then exceed the program if your choice.
ninefathom 4y ago
I'll be happy to implement that for you. Already have a solution in mind; please feel free to reach out and we'll discuss my fees for Linux sysadmin work.