4 ms·

An advantage of “iptables magic” is that the service doesn’t ever have to run as root: I’ve done this before to great success to have a web server be accessible

An advantage of “iptables magic” is that the service doesn’t ever have to run as root: I’ve done this before to great success to have a web server be accessible on standard ports even though it was running as an unprivileged user.

f33d5173 3y ago
There's a capabilities thing you can do to add the permission to a process without changing users. You can also have it bind to the port as root then drop permissions afterwards.
- fiddlerwoaroof 3y ago
  Yeah, but requiring the process to start as root adds a window of vulnerability and the process has to drop privileges correctly. You could also do it in the load balancer/router.
  - superb_dev 3y ago
    Systemd can setup the privileges before starting the process
  - greyface- 3y ago
    Run this as root once: setcap 'cap_net_bind_service=+ep' /path/to/executable Now, the process doesn't need to start as root and drop privs.
dijit 3y ago
this is actually dangerous advice. The reason privileged ports require root is so that they cannot be easily intercepted by userland processes. The entire reason for the root requirement is this; it's expected that after your port assignment you drop your privileges to a lesser user. But requiring root to bind is a feature, not a bug. If you do not have this then intentionally crashing the process for a user and rebinding the port as a standard user (even `nobody`) is possible. This means if you break into someones mail server and run as the mail user, you would be able to bind ssh ports (if they are not privileged ports <1024). Of course your mail server should be running as the `mail` user or some equivelent, because only the binding of the ports should be done on startup as root and then it should drop into the mail user.
- fiddlerwoaroof 3y ago
  Only if you can kill the ssh server that's already listening on the port.
  - dijit 3y ago
    Yes, but you can do so as a regular user in some cases. Security is an onion.
- ChoHag 3y ago
  [dead]

f33d5173 3y ago

There's a capabilities thing you can do to add the permission to a process without changing users. You can also have it bind to the port as root then drop permissions afterwards.

fiddlerwoaroof 3y ago
Yeah, but requiring the process to start as root adds a window of vulnerability and the process has to drop privileges correctly. You could also do it in the load balancer/router.
- superb_dev 3y ago
  Systemd can setup the privileges before starting the process
- greyface- 3y ago
  Run this as root once: setcap 'cap_net_bind_service=+ep' /path/to/executable Now, the process doesn't need to start as root and drop privs.

dijit 3y ago

this is actually dangerous advice. The reason privileged ports require root is so that they cannot be easily intercepted by userland processes. The entire reason for the root requirement is this; it's expected that after your port assignment you drop your privileges to a lesser user. But requiring root to bind is a feature, not a bug. If you do not have this then intentionally crashing the process for a user and rebinding the port as a standard user (even `nobody`) is possible. This means if you break into someones mail server and run as the mail user, you would be able to bind ssh ports (if they are not privileged ports <1024). Of course your mail server should be running as the `mail` user or some equivelent, because only the binding of the ports should be done on startup as root and then it should drop into the mail user.

fiddlerwoaroof 3y ago
Only if you can kill the ssh server that's already listening on the port.
- dijit 3y ago
  Yes, but you can do so as a regular user in some cases. Security is an onion.
ChoHag 3y ago
[dead]