5 ms·

Alternatively, you could grant the node binary the ability bind ports < 1024, using setcap (Linux only): sudo setcap 'cap_net_bind_service=+ep' /path/to/no

Alternatively, you could grant the node binary the ability bind ports < 1024, using setcap (Linux only): sudo setcap 'cap_net_bind_service=+ep' /path/to/nodejs Then you don't have to ever run it as root (at least not for the purpose of binding to the right port).

hahainternet 14y ago
Endless bonus points to you for mentioning capabilities. They're so unknown but gems to come across.
typpo 14y ago
Or route port 80 to your node port (eg. 8080): sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080
- seiji 14y ago
  Friendly reminder: iptables has a significant performance penalty on high traffic servers. If your service gets a few thousand hits per day, it'll be okay. If you're trying to survive a few thousand hits per second, your clients will suffer less than optimal throughput.
  - toong 14y ago
    Friendly reminder @ seiji: don't make those kind of statements without backing these, please ? In what use case would iptables give a performance penalty ? I have iptable-setups running with hundreds of rules and 800-1000 concurrent(!) users. During traffic peaks times my 5-6(?) year old Xeon does a good job, cpu usage barely touches 3-4%. Throughput downstream at that point around 350Mbit/s (admitted, downstream just matched by conntrack:matched/established) and upstream around 20Mbit/s, working through hundreds of rules. iptables runs in the kernel-space and is very, very, VERY performant. (well, I lied, iptables itself is just a configuration tool for the kernel - but it is incredibly fast). Following that kind of traffic with tcpdump (userland) just drops about half of the packets because it maxes out that poor CPU instantly. (yes, that depends on the args). And don't even thinkg about using iptraf :-) (That reminds me: please, some one, send me better server hardware :-x)
    - stock_toaster 14y ago
      He could have meant iptables state tracking, which can often overflow in the face of high traffic/connection rates. 1. Don't use connection tracking 2. If you need to use it, make judicious use of -j NOTRACK I use this on a few high traffic servers, with good results: iptables -t raw -A PREROUTING -i lo -j NOTRACK iptables -t raw -A OUTPUT -o lo -j NOTRACK iptables -A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT iptables -A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT iptables -t raw -A OUTPUT -o eth0 -p tcp -m tcp --sport 443 -j NOTRACK iptables -t raw -A OUTPUT -o eth0 -p tcp -m tcp --sport 80 -j NOTRACK
      - stock_toaster 14y ago
        Well crap. Replying to myself. Missed a pair of rules in my earlier copy/paste: iptables -t raw -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j NOTRACK iptables -t raw -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j NOTRACK
      - toong 14y ago
        Related: http://www.lognormal.com/blog/2012/09/27/linux-tcpip-tuning/ http://www.lognormal.com/blog/2012/09/27/linux-tcpip-tuning/
Hello71 14y ago
That kinda defeats the purpose of restricting ports under 1024.
- ejdyksen 14y ago
  This only grants that right to a single executable--it doesn't allow everyone on the system to bind to low port numbers.
  - Hello71 14y ago
    It kinda does, unless you restrict execution of nodejs to root/nodejs group anyways. It's like setting /bin/bash setuid.
    - ejdyksen 14y ago
      That's true--since node can run arbitrary code for you, you'd want to restrict execution of node to a known set of users.
    - drivebyacct2 14y ago
      I don't really understand. Does it grant nodejs root privileges? I assumed it ONLY allowed for binding to port 80, not all root privileges...
- seiji 14y ago
  What was the purpose of that arbitrary limitation again? It's mostly a holdover from the olden days we now have to constantly work around (by mostly having lazy people run things as root everywhere).
ruxkor 14y ago
setcap solves the problem in the wrong way in this scenario imho: With setcap, any user could run node with a node script using ports < 1024. What would be more useful is the ability to allow a _user_ to open a privileged port. In my option mappu's answer is the right way to go, i.e. using authbind to allow a certain user to open a port or a range of ports.
- X-Istence 14y ago
  http://news.ycombinator.com/item?id=4874152 http://news.ycombinator.com/item?id=4874152 The answer you are looking for in Solaris...
- ejdyksen 14y ago
  Just make sure node is only executable by a restricted group of users. This limits it both on the basis of which user can open ports and which programs can.
- toong 14y ago
  Authbind looks really appropriate here. (Hmm, did parent just edit his comment ? He didn't mention authbind when I hit reply, did he ?) From the man page: authbind allows a program which does not or should not run as root to bind to low-numbered ports in a controlled way. The shared library loaded using LD_PRELOAD overrides the bind(2) system call. When a program invoked via authbind calls bind to bind a socket to a low-numbered TCP/IP port, and if the program doesn't already have an effective uid of 0, the version of bind supposed by authbind forks and executes a setuid-root helper program. You can create configuration file like /etc/authbind/byport/port and use standard linux file permissions to allow certain non-root users to bind to ports < 1024
X-Istence 14y ago
If you are on Solaris (10 or higher works from experience) you can grant a single user the ability to bind to the lower ports: usermod -K defaultpriv=basic,net_privaddr ${user} You can off course also assign the privileges to a role, and then assign the user that role so as required they can su to the role and use the privileges. Here is a pretty neat description of what is possible and why it is pretty awesome: http://www.c0t0d0s0.org/archives/4075-Less-known-Solaris-features-RBAC-and-Privileges-Part-3-Privileges.html http://www.c0t0d0s0.org/archives/4075-Less-known-Solaris-fea... --- On FreeBSD if you have the MAC framework enabled, you can use the portacl module to give new privileges: sysctl security.mac.portacl.rules=uid:$user_id:tcp:80 See http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mac-portacl.html http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ma... for more information.

hahainternet 14y ago

Endless bonus points to you for mentioning capabilities. They're so unknown but gems to come across.

typpo 14y ago

Or route port 80 to your node port (eg. 8080): sudo iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 8080

seiji 14y ago
Friendly reminder: iptables has a significant performance penalty on high traffic servers. If your service gets a few thousand hits per day, it'll be okay. If you're trying to survive a few thousand hits per second, your clients will suffer less than optimal throughput.
- toong 14y ago
  Friendly reminder @ seiji: don't make those kind of statements without backing these, please ? In what use case would iptables give a performance penalty ? I have iptable-setups running with hundreds of rules and 800-1000 concurrent(!) users. During traffic peaks times my 5-6(?) year old Xeon does a good job, cpu usage barely touches 3-4%. Throughput downstream at that point around 350Mbit/s (admitted, downstream just matched by conntrack:matched/established) and upstream around 20Mbit/s, working through hundreds of rules. iptables runs in the kernel-space and is very, very, VERY performant. (well, I lied, iptables itself is just a configuration tool for the kernel - but it is incredibly fast). Following that kind of traffic with tcpdump (userland) just drops about half of the packets because it maxes out that poor CPU instantly. (yes, that depends on the args). And don't even thinkg about using iptraf :-) (That reminds me: please, some one, send me better server hardware :-x)
  - stock_toaster 14y ago
    He could have meant iptables state tracking, which can often overflow in the face of high traffic/connection rates. 1. Don't use connection tracking 2. If you need to use it, make judicious use of -j NOTRACK I use this on a few high traffic servers, with good results: iptables -t raw -A PREROUTING -i lo -j NOTRACK iptables -t raw -A OUTPUT -o lo -j NOTRACK iptables -A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT iptables -A INPUT -i eth0 -p tcp -m tcp --dport 443 -j ACCEPT iptables -t raw -A OUTPUT -o eth0 -p tcp -m tcp --sport 443 -j NOTRACK iptables -t raw -A OUTPUT -o eth0 -p tcp -m tcp --sport 80 -j NOTRACK
    - stock_toaster 14y ago
      Well crap. Replying to myself. Missed a pair of rules in my earlier copy/paste: iptables -t raw -A PREROUTING -i eth0 -p tcp -m tcp --dport 443 -j NOTRACK iptables -t raw -A PREROUTING -i eth0 -p tcp -m tcp --dport 80 -j NOTRACK
    - toong 14y ago
      Related: http://www.lognormal.com/blog/2012/09/27/linux-tcpip-tuning/ http://www.lognormal.com/blog/2012/09/27/linux-tcpip-tuning/

Hello71 14y ago

That kinda defeats the purpose of restricting ports under 1024.

ejdyksen 14y ago
This only grants that right to a single executable--it doesn't allow everyone on the system to bind to low port numbers.
- Hello71 14y ago
  It kinda does, unless you restrict execution of nodejs to root/nodejs group anyways. It's like setting /bin/bash setuid.
  - ejdyksen 14y ago
    That's true--since node can run arbitrary code for you, you'd want to restrict execution of node to a known set of users.
  - drivebyacct2 14y ago
    I don't really understand. Does it grant nodejs root privileges? I assumed it ONLY allowed for binding to port 80, not all root privileges...
seiji 14y ago
What was the purpose of that arbitrary limitation again? It's mostly a holdover from the olden days we now have to constantly work around (by mostly having lazy people run things as root everywhere).

ruxkor 14y ago

setcap solves the problem in the wrong way in this scenario imho: With setcap, any user could run node with a node script using ports < 1024. What would be more useful is the ability to allow a _user_ to open a privileged port. In my option mappu's answer is the right way to go, i.e. using authbind to allow a certain user to open a port or a range of ports.

X-Istence 14y ago
http://news.ycombinator.com/item?id=4874152 http://news.ycombinator.com/item?id=4874152 The answer you are looking for in Solaris...
ejdyksen 14y ago
Just make sure node is only executable by a restricted group of users. This limits it both on the basis of which user can open ports and which programs can.
toong 14y ago
Authbind looks really appropriate here. (Hmm, did parent just edit his comment ? He didn't mention authbind when I hit reply, did he ?) From the man page: authbind allows a program which does not or should not run as root to bind to low-numbered ports in a controlled way. The shared library loaded using LD_PRELOAD overrides the bind(2) system call. When a program invoked via authbind calls bind to bind a socket to a low-numbered TCP/IP port, and if the program doesn't already have an effective uid of 0, the version of bind supposed by authbind forks and executes a setuid-root helper program. You can create configuration file like /etc/authbind/byport/port and use standard linux file permissions to allow certain non-root users to bind to ports < 1024

X-Istence 14y ago

If you are on Solaris (10 or higher works from experience) you can grant a single user the ability to bind to the lower ports: usermod -K defaultpriv=basic,net_privaddr ${user} You can off course also assign the privileges to a role, and then assign the user that role so as required they can su to the role and use the privileges. Here is a pretty neat description of what is possible and why it is pretty awesome: http://www.c0t0d0s0.org/archives/4075-Less-known-Solaris-features-RBAC-and-Privileges-Part-3-Privileges.html http://www.c0t0d0s0.org/archives/4075-Less-known-Solaris-fea... --- On FreeBSD if you have the MAC framework enabled, you can use the portacl module to give new privileges: sysctl security.mac.portacl.rules=uid:$user_id:tcp:80 See http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/mac-portacl.html http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/ma... for more information.