Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I want syslog to run as a non-root user on my linux box. That makes it impossible for it to bind to port 514 - because that's a privileged port. Is there any way I can grant non-admin user "foo" the ability to listen on port 514?

share|improve this question
add comment

4 Answers 4

up vote 9 down vote accepted
setcap 'cap_net_bind_service=+ep' /path/to/syslogd

Requires a not-ancient linux kernel (2.6.24 or later)

share|improve this answer
add comment

You could configure rinetd (available in most, if not all, distribution's standard repositories) to listen on port 514 and forward connections to some other port (above 1024, say 1514). That way the non-privileged user process can listen on 1514 and rinetd will forward connections so it appears to be listening on 514.

This will only work for TCP connections though. If you need to support UDP (or anything else) this way as well as or instead of TCP, then you can use iptables translation rules to achieve the same effect.

share|improve this answer
    
Oh that was so easy. Here's a guide on how to do it in Ubuntu: ubuntugeek.com/… –  Ivan Oct 18 '11 at 17:33
add comment

Just found a very good discussion of this here: http://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-1024-on-li

Doesn't look easy

share|improve this answer
    
Good xref - didn't look very hard to me. –  Jonathan Leffler Apr 18 '10 at 0:03
add comment

Listen on an unprivileged port and use iptables dnat to redirect connections.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.