4

After adding the line to /etc/haproxy/haproxy.cfg as part of creating a transparent proxy,

    source 0.0.0.0 usesrc clientip

restarting haproxy starts giving an error

~# service haproxy reload
 * Reloading haproxy haproxy                                                     
       [ALERT]     230/153724 (1140) : [/usr/sbin/haproxy.main()] Some configuration options require full privileges, so global.uid cannot be changed.

I'm already running service haproxy reload as root. What else do we have to do? Thank you!

11

Comment out following lines in your haproxy.cfg:

    user        haproxy
    group       haproxy

and restart haproxy.

1

The better way to fix this issue with privileges is to execute the below commands:

  1. Fix haproxy capabilities

    setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip /usr/sbin/haproxy
    
  2. Fix haproxy.pid file rights

    touch /var/run/haproxy.pid; chown haproxy:haproxy /var/run/haproxy.pid
    
  3. Comment out from haproxy.conf:

    User haproxy
    Group haproxy
    
  4. Execute daemon as haproxy user:

    sudo -u haproxy /sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -D -q
    
  5. Check haproxy process

    ps -ef | grep haproxy
    

    the result should be:

    haproxy  12800     1  0 фев12 ?     00:00:58 /sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -D -q
    
  6. You can put these commands in rc.local in order to start automatically with the system

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.