Permission to use port 80

[Miark-3]

Hi all,

I'm doing some developing using Google's tiny webserver
Mongoose. When I call it up, I want to use port 80, but I can't
unless I run it as root--something I don't want to do.

How do I give a non-root user the permission to bind to port 80?

Thanks,
Miark

[Diego Bello]

In Linux, ports until 1024 are reserved for system stuff, like ssh, ftp, telnet and http. I'm not sure if you, as a user, can make use of it.

Can't you try to set the webserver to work on another port?

Regards.

On Fri, Aug 7, 2009 at 3:07 PM, Miark <mlist3@...> wrote:

Hi all,

I'm doing some developing using Google's tiny webserver
Mongoose. When I call it up, I want to use port 80, but I can't
unless I run it as root--something I don't want to do.

How do I give a non-root user the permission to bind to port 80?

Thanks,
Miark

--
Diego Bello Carreño

[David Guntner-3]

Miark wrote:
> Hi all,
>
> I'm doing some developing using Google's tiny webserver
> Mongoose. When I call it up, I want to use port 80, but I can't
> unless I run it as root--something I don't want to do.
>
> How do I give a non-root user the permission to bind to port 80?

You don't.  Ports below 1024 are special reserved ports, and you have to
have root permissions to bind to them.  Once bound, the process can
change to a non-privileged user and maintain the connection (assuming
the software was written to downgrade itself after doing the bind), but
to establish the binding, ya gotta be root.

        --Dave

[Luca Olivetti-2]

En/na Miark ha escrit:
> Hi all,
>
> I'm doing some developing using Google's tiny webserver
> Mongoose. When I call it up, I want to use port 80, but I can't
> unless I run it as root--something I don't want to do.
>
> How do I give a non-root user the permission to bind to port 80?

I don't know if it works, but I knew there's a way to do it, so I
googled away and I found this:

http://www.friedhoff.org/posixfilecaps.html

Look at the howto-section. There's also an example of running apache as
non root by granting it the cap_net_bind_service, so it's the right
example for you to try.

Mdv 2009.1 seems to come with a suitable kernel, setcap and getcap are
in the libcap-utils package.

Bye
--
Luca

[Miark-3]

On Sat, 08 Aug 2009 15:18:59 +0200, Luca wrote:

> En/na Miark ha escrit:
> > Hi all,
> >
> > I'm doing some developing using Google's tiny webserver
> > Mongoose. When I call it up, I want to use port 80, but I
> > can't unless I run it as root--something I don't want to do.
> >
> > How do I give a non-root user the permission to bind to port
> > 80?
>
> I don't know if it works, but I knew there's a way to do it,
> so I googled away and I found this:
>
> http://www.friedhoff.org/posixfilecaps.html

setcap--perfect! I'll give this a shot later.

Thanks,
Miark

[Miark-3]

On Fri, 7 Aug 2009 15:31:48 -0400, Diego wrote:

> In Linux, ports until 1024 are reserved for system stuff, like
> ssh, ftp, telnet and http. I'm not sure if you, as a user, can
> make use of it.
>
> Can't you try to set the webserver to work on another port?

One of the goals is to make this work stupid-proof. Alternate
ports don't make things hard, but not having to deal with them
is ideal.

Miark

[Miark-3]

On Fri, 07 Aug 2009 12:49:54 -0700, David wrote:

> Miark wrote:
> > Hi all,
> >
> > I'm doing some developing using Google's tiny webserver
> > Mongoose. When I call it up, I want to use port 80, but I
> > can't unless I run it as root--something I don't want to do.
> >
> > How do I give a non-root user the permission to bind to port
> > 80?
>
> You don't.  

Cripes, you sound like a MSCE!  ;-)

Miark

[David Guntner-3]

Miark wrote:

> On Fri, 07 Aug 2009 12:49:54 -0700, David wrote:
>
>> Miark wrote:
>>> Hi all,
>>>
>>> I'm doing some developing using Google's tiny webserver
>>> Mongoose. When I call it up, I want to use port 80, but I
>>> can't unless I run it as root--something I don't want to do.
>>>
>>> How do I give a non-root user the permission to bind to port
>>> 80?
>>
>> You don't.  
>
> Cripes, you sound like a MSCE!  ;-)

Naw, if I was sounding like that, I'd wrap it in all kinds of flowery
crap so that you'd actually be glad for the fact that you can't do that. :-)

I'd certainly be interested in hearing how (or if) the posixfilecaps
thing that someone posted to you works and how much work it was. :-)

        --Dave