Linux

Hi experts,
I want to run HTTP server on port 80, I learn from somewhere that it MUST not be run as root for security reason, how to do that?


Thank you in advance!

Hi.

(This is from RedHat, but hope it applied to you too).

Extract from httpd.conf

Code:

#
# If you wish httpd to run as a different user or group, you must run
# httpd as root initially and it will switch.
#
# User/Group: The name (or #number) of the user/group to run httpd as.
#  . On SCO (ODT 3) use "User nouser" and "Group nogroup".
#  . On HPUX you may not be able to use shared memory as nobody, and the
#    suggested workaround is to create a user www and use that user.
#  NOTE that some kernels refuse to setgid(Group) or semctl(IPC_SET)
#  when the value of (unsigned)Group is above 60000;
#  don't use Group #-1 on these systems!
#
User apache
Group apache

Hi, scottn, thanks for your quick reply.
I am using Nginx, how to do this in Nginx?

Hi.

I know absolutely nothing about nginx, sorry.

So I did what I normally do... hit google

Are you using Nginx just, or with Apache?

Do you have a file /usr/local/nginx/conf/nginx.conf

If so, try changing the user there. If with Apache, try it in /etc/httpd/conf/httpd.conf.

Hi, scottn, thanks for you reply.

I have the configuration file you mentioned, adding user and group there didn't help.
After adding user and group in nginx.conf, child processes forked by the master process have the non-root user(which I specified in nginx.conf) associated. but the master process is still run as root.

I have googled around for quite a while, and I found some info that say one can use iptable to redirect traffic coming to the privileged ports(<1024) to higher ports, but we don't use firewall on the server, so this seems not a viable solution.

And some say that one can use setuid(chmod +s /usr/local/nginx/sbin/nginx), and then run nginx as a non-root user. Yes, I can run nginx in this case using a non-root user, but the master process is still owned by root.

It's really frustrating...
Any more help?

apache cannot be made to drop privileges in this fashion, so if you don't want to use redirection you're stuck.

Unprivileged user (non-root) cannot run a process that is listening on port below 1024. That's why the nignx's master process must have root privileges.

Short answer to your question is: you don't.