On Unix-based systems, port 80 is protected; typically only the superuser root can open it. For security reasons, it is not desirable to run the server as root. This page presents several options to access port 80 as a non-root user, including using ipchains, iptables, Jetty's SetUID feature, xinetd, and the Solaris 10 User Rights Management Framework.
On some Linux systems you can use the ipchains REDIRECT mechanism to redirect from one port to another inside the kernel (if ipchains is not available, then usually iptables is):
/sbin/ipchains -I input --proto TCP --dport 80 -j REDIRECT 8080
This command instructs the system as follows: "Insert into the kernel's packet filtering the following as the first rule to check on incoming packets: If the protocol is TCP and the destination port is 80, redirect the packet to port 8080." Be aware that your kernel must be compiled with support for ipchains (virtually all stock kernels are). You must also have the ipchains command-line utility installed (on RedHat the package is aptly named "ipchains"). You can run this command at any time, preferably just once, since it inserts another copy of the rule every time you run it.
After you set up this rule, a Linux 2.2 kernel redirects all data addressed to port 80 to a server such as Jetty running on port 8080.This includes all RedHat 6.x distros. Linux 2.4 kernels, for example, RedHat 7.1+, have a similar iptables facility.
On many Linux systems you can use the iptables REDIRECTmechanism to redirect from one port to another inside the kernel (if iptables is not available, then usually ipchains is).
You need to add something like the following to the startup scripts or your firewall rules:
/sbin/iptables -t nat -I PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080
The underlying model of iptables is different from ipchains, so the forwarding normally happens only to packets originating off-box. You also need to allow incoming packets to port 8080 if you use iptables as a local firewall.
Be careful to place rules like this one early in your input chain. Such rules must precede any rule that accepts the packet, otherwise the redirection won't occur. You can insert as many rules as required if your server needs to listen on multiple ports, as for HTTPS.
The SetUID feature is among the Jetty 7 modules that remain at Codehaus, and it retains the mortbay.org
package naming. It does use the Jetty 7 package modules at
Eclipse. Jetty-hightide-7 at Codehaus comes with
jetty-setuid
compiled for Jetty 7. You can also download the setuid
Jar and
config
Jar from the Maven
Central Repository, and then copy the setuid
Jar to $jetty.home/etc
, and
unjar the setuid-config
Jar in $jetty.home.
Create a Jetty config file as follows:
<?xml version="1.0"?> <!DOCTYPE Configure PUBLIC "-//Mort Bay Consulting//DTD Configure//EN" "http://jetty.mortbay.org/jetty/configure.dtd"> <Configure id="Server" class="org.mortbay.setuid.SetUIDServer"> <Set name="umask">UMASK</Set> <Set name="uid">USERID</Set> </Configure>
Where you replace:
<Set name="umask">18</Set>
<Set name="umaskOctal">022</Set>
$jetty.home/etc/jetty-setuid.xml
. Alternatively, if you downloaded the
jetty-setuid-java
Jars from the Maven Central repo, find it in the
jetty-setuid-java-config.jar
file.The easiest way to do this is to edit the $jetty.home/start.ini
file:
--exec
-Djava.library.path=lib/setuid
OPTIONS=Server,jsp,jmx,resources,websocket,ext,jta,plus,jdbc,annotations,setuid
etc/jetty-setuid.xml
as the first file in the configuration file
sectionetc/jetty-setuid.xml
file is first in the list of config
files.Having edited start.ini
as advised above, to run jetty as the root user:
sudo java -jar start.jar
jetty-setuid/modules/native/pom.xml
as necessary.With modern Linux flavours, inetd has a newer, better big brother xinetd, that you can use to redirect network traffic. Since xinetd is driven by text files, all you need is a text editor. For detailed information, see http://www.xinetd.org/.
There are two ways to give xinetd instructions:
etc/xinetd.conf
etc/xinetd.d
The format is the same; if you have a look at the file/directory, you will get the picture.
The following entry redirects all inward TCP traffic on port 80 to port 8888 on the local machine. You can also redirect to other machines for gimp proxying:
service my_redirector { type = UNLISTED disable = no socket_type = stream protocol = tcp user = root wait = no port = 80 redirect = 127.0.0.1 8888 log_type = FILE /tmp/somefile.log }
Be aware of the following:
Include a space on either side of the '=' or it is ignored.
type = UNLISTED
means that the name of the service does not have to be in
/etc/services
, but you have to specify port and protocol. If you want to do use an existing
service name, for example, http:
service http { disable = no socket_type = stream user = root wait = no redirect = 127.0.0.1 8888 log_type = FILE /tmp/somefile.log }
Have a browse in /etc/services and it will all become clear.
Logging might present certain security problems, so you might want to leave that out.
RHEL5 doesn't contain xinetd by default for reasons best known to themselves; yum install xinetd fixes that.
Xinetd is a hugely powerful and configurable system, so expect to do some reading.
Solaris 10 provides a User Rights Management framework that can permit users and processes superuser-like abilities:
usermod -K defaultpriv=basic,net_privaddr myself
Now the myself
user can bind to port 80.
Refer to the Solaris 10 and Solaris 11 Security Services documentation for more information.