19

Caddy server would not start and displayed this error after upgrading to v0.9.3:

listen tcp :443: bind: permission denied

I was running caddy with systemd as user caddy. I checked that the binary was, in fact, owned by caddy.

2 Answers 2

14

If you're running systemd v229 or later, you can do this without giving the binary capabilities intrinsically:

AmbientCapabilities=CAP_NET_BIND_SERVICE
1
31

It's not a caddy issue, nor a user-permissions issue. Linux doesn't allow processes to listen on low-level ports by default.

To grant access:

sudo setcap CAP_NET_BIND_SERVICE=+eip $(which caddy)

source: superuser: Allow non-root process to bind to port 80 and 443?

3
  • Using sudo caddy start seems to work. Is this a bad idea? Jan 31 at 6:21
  • Probably not, but it's more secure to run caddy as a non-privileged user. The reason is that if a hacker gets access through caddy, eg with a webshell, and caddy is running as root, then the hacker will have root access to your system.
    – ki9
    Feb 26 at 1:25
  • I understand. Thanks Feb 29 at 6:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .