113 reputation
29
bio website
location Australia
age
visits member for 2 years, 10 months
seen Sep 26 at 3:50

Aug
30
awarded  Notable Question
Jul
9
awarded  Notable Question
Feb
11
awarded  Popular Question
Jun
6
comment Allow non-root process to listen on port 80 without doing anything drastic
That's OK. When I have sufficient reputation, I'll be back here to downvote answers and comments that refused to answer the question actually asked. :)
Jun
6
comment Allow non-root process to listen on port 80 without doing anything drastic
Btw, I did not downvote this. It was the only answer that specifically addressed the question. It was likely downvoted by one of the question downvoters. As I understand it, you generally don't downvote questions that ask how to do something that, in someone's opinion, you shouldn't do.
Jun
6
comment Allow non-root process to listen on port 80 without doing anything drastic
No, iptables is the way. Except GlassFish won't play nice. I have already proven that I can bind GlassFish as root to ports 80 and 443. I have also proven that I can block all other ports with iptables. And I have proven that the recommended iptables configuration to forward incoming 80 and 443 traffic to 8080 and 8181 respectively does not work. And I came here hoping, at best, for enthusiast advice. (See the FAQ.) Answers that don't specifically answer the specific question will be debated unless they provide an acceptable solution I haven't thought about yet.
Jun
6
comment Allow non-root process to listen on port 80 without doing anything drastic
Apparently this question does not show any research effort, is unclear or not useful. Can the down-voter please tell me exactly how this question does not show any research effort, is unclear or not useful?
Jun
6
comment Allow non-root process to listen on port 80 without doing anything drastic
Yes, I read an article saying that this was filed as a Java bug and their answer is that it's a security feature.
Jun
6
comment Allow non-root process to listen on port 80 without doing anything drastic
Thanks. A great idea, but with one teeny tiny problem: java: error while loading shared libraries: libjli.so: cannot open shared object file: No such file or directory
Jun
6
comment Allow non-root process to listen on port 80 without doing anything drastic
I did click the link. There was no elaboration on security. As for performance, I would have to make architectural changes to take advantage of the performance, otherwise I'll just be making the app slightly slower. Putting httpd between GlassFish and the Internet isn't going to magically speed things up.
Jun
6
comment Allow non-root process to listen on port 80 without doing anything drastic
Yes, I do want to do this.
Jun
6
comment Allow non-root process to listen on port 80 without doing anything drastic
And do you know why? It's so non-root compromised accounts can't imitate secure services. But with iptables blocking those secure ports anyway except for the ports on which root already listens, it's a non-issue.
Jun
6
asked Allow non-root process to listen on port 80 without doing anything drastic
Jun
6
comment Relationship between /etc/hosts and iptables?
OK. I don't want to run as root so I will have to grant the user the privileges to listen on ports 80 and 443. You said above that I don't need to do that, but I can't see how I can run as a non-root user and listen on those ports without that user being granted a privilege to do so.
Jun
6
comment Relationship between /etc/hosts and iptables?
It already uses 8080 and 8181. The iptables rules I have set up are supposed to redirect incoming requests on ports 80/443 to 8080/8181, yet GlassFish is not receiving these requests on ports 8080/8181. I do however need privileges to bind GlassFish directly to ports 80/443 which is what you suggested a few comments up.
Jun
6
comment Relationship between /etc/hosts and iptables?
How can I have GlassFish (or any other service) launched as root then switch to a jailed user account while allowing it to listen on a privileged port? I would have thought that, by definition, putting a process in jail means you put it in jail.
Jun
6
comment Relationship between /etc/hosts and iptables?
Yes I can do that. I will also have to grant its user account permission to listen on privileged ports. That's something I'd rather avoid if possible.
Jun
5
revised Relationship between /etc/hosts and iptables?
added 188 characters in body
Jun
5
comment Relationship between /etc/hosts and iptables?
I don't want to run GlassFish as root if I can avoid it. Regular users can't listen on ports < 1024.
Jun
5
comment Relationship between /etc/hosts and iptables?
Question edited. Hope it clarifies.