Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Using port 80 as non root user #943

Open
balat opened this issue Oct 5, 2022 · 2 comments
Open

Using port 80 as non root user #943

balat opened this issue Oct 5, 2022 · 2 comments

Comments

@balat
Copy link

balat commented Oct 5, 2022

Hello,

Ocsigen Server switched to cohttp recently. But there is still a regression:

For security reasons, we don't want to run the server as root user.
To bind port 80 or 443, the server needs to be launched as root, and we switch to another user after binding the ports.

But I don't see a way in cohttp to be alerted just after bind/listen (or to provide a callback to be executed at that moment).

This issue has been discussed here: https://discuss.ocaml.org/t/eliom-runtime-errors-zero-compile-time-errors/10537/14

Thanks by advance!
Vincent

@avsm
Copy link
Member

avsm commented Oct 5, 2022

While there's no callback for "post binding" in cohttp, you can avoid launching the binary as root on Linux by running:

setcap 'cap_net_bind_service=+ep' <binary file>

This will then allow it to bind to a low port as a non privileged user.

@balat
Copy link
Author

balat commented Oct 6, 2022

Thank you Anil for the idea!
Indeed we can suggest our users to do that until there is a solution.

balat added a commit to ocsigen/ocsigenserver that referenced this issue Apr 26, 2024
This feature is not supported by cohttp.
In mirage/ocaml-cohttp#943,
Anil suggest to do that instead:
setcap 'cap_net_bind_service=+ep' <binary file>
to bind a low port to a non-priviledged user

I keep OCSIGENUSER in Makefile for install
balat added a commit to ocsigen/ocsigenserver that referenced this issue Apr 26, 2024
This feature is not supported by cohttp.
In mirage/ocaml-cohttp#943,
Anil suggest to do that instead:
setcap 'cap_net_bind_service=+ep' <binary file>
to bind a low port to a non-priviledged user

I keep OCSIGENUSER in Makefile for install
balat added a commit to ocsigen/ocsigenserver that referenced this issue Apr 26, 2024
This feature is not supported by cohttp.
In mirage/ocaml-cohttp#943,
Anil suggest to do that instead:
setcap 'cap_net_bind_service=+ep' <binary file>
to bind a low port to a non-priviledged user

I keep OCSIGENUSER in Makefile for install
balat added a commit to ocsigen/ocsigenserver that referenced this issue Jun 7, 2024
This feature is not supported by cohttp.
In mirage/ocaml-cohttp#943,
Anil suggest to do that instead:
setcap 'cap_net_bind_service=+ep' <binary file>
to bind a low port to a non-priviledged user

I keep OCSIGENUSER in Makefile for install
balat added a commit to ocsigen/ocsigenserver that referenced this issue Jun 7, 2024
This feature is not supported by cohttp.
In mirage/ocaml-cohttp#943,
Anil suggest to do that instead:
setcap 'cap_net_bind_service=+ep' <binary file>
to bind a low port to a non-priviledged user

I keep OCSIGENUSER in Makefile for install
balat added a commit to ocsigen/ocsigenserver that referenced this issue Aug 21, 2024
This feature is not supported by cohttp.
In mirage/ocaml-cohttp#943,
Anil suggest to do that instead:
setcap 'cap_net_bind_service=+ep' <binary file>
to bind a low port to a non-priviledged user

I keep OCSIGENUSER in Makefile for install
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

3 participants