2

Can a Node.js server serving an app over HTTPS be run as a non-root user? The problem is that there seems to be no way to run a script like this without sudo, since it has to access the certs.

I'm aware that it's possible to drop the root privileges after starting Node, but I'd like to avoid this if possible, since it may lead to some unexpected behavior.

Improve this question

1 Answer 1

Reset to default
4

The certificates problem is easy to fix, just chown them to your user and adjusting the permissions accordingly.

You'll find though that you can't make your server listen to the HTTPS port, 443, as it's a privileged one (< 1024).

You can solve this problem in various ways though, like:

  • Reverse proxy in front (Apache / nginx) forwarding requests to nodejs listening to a highier port

  • Port forwarding 443 -> 1443 (or any highier than 1024 port) and nodejs listening on 1443

  • Using linux capabilities (CAP_NET_ADMIN IIRC).

Probably there are other methods too.

Improve this answer
3
  • Thank you for your answer Fredi! I have already found a way to run the app on a privileged port without sudo. Chowning and adjusting permissions for the cert files was something I thought of. However, is it bad practice to grant these permissions to a non-root user?
    – Matias Heikkilä
    Nov 30, 2016 at 17:57
  • Well, there are plenty of opinions in this matter :-) . I like the apache's one, where the server starts as root (so it can open privileged ports, and read all files) then switch to an unprivileged user, daemon by default. In this case you can keep your certs unreadable by all eccept root, so if your webserver get's compromised the attacker can only do what the unprivileged user and can't read the certs. Actually if you follow the reverse proxy path you can have this for free. And you can scale your app when needed. But this is an answer to another question :-)
    – Fredi
    Dec 1, 2016 at 10:27
  • @MatiasHeikkilä, if you liked the answer you can aprove it BTW :)
    – Fredi
    Dec 1, 2016 at 11:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.