Is there a way on Linux (CentOS if that matters) to enable regular users to use ports below 1024? (open listening TCP socket on that port)
Currently I understand that only root has privileges to use those ports.
Server Fault is a question and answer site for system and network administrators. It only takes a minute to sign up.Sign up to join this community
Not on CentOS 3/4/5 (Lack of filesystem capabilities):
You can set the CAP_NET_BIND_SERVICE capability to the program that needs to open this port. Root will set the capability on the executable, then any user may run that executable, it will be able to use ports <1024.
To set the capability on the executable:
setcap cap_net_bind_service=+ep /path/to/program
IIRC this is not possible, or if it is it is not recommended for security reasons.
But if you want users to be able to listen on a specific port you could always use a TCP forwarder like
rinetd or iptables rules to redirect connections to that port to one they can listen on and have them set their service to listen on that higher port.
For instance the line
aa.bb.cc.dd 80 127.0.0.1 8000
in rinetd's configuration would forward connections to port 80 on address
aa.bb.cc.dd to localhost port 8000 which a non privileged user can listen on. An equivalent iptables rule would be something like
/sbin/iptables -t nat -A PREROUTING -p tcp -d aa.bb.cc.dd --dport 80 -j DNAT --to 127.0.0.1:8000
Either way gives you much more fine grained control than letting any user listen on any port.
The iptables approach has the advantage that the listening application will see the IP address of the calling client (with the rinetd method it would see all connections as coming from the local host). The iptables method would also allow for UDP as well as TCP.
capabilities is great stuff, but it requires properly configured certain kernel versions. some programs, like sun java, do not with capabilieis. authbind works on all linux versions.
authbind, however, supports only IPv4.
This will do all the work for you.