grant users to bind ports under 1024

[trifo]

Hi!

Is there a way to grant a user to bind ports under 1024? I would need to set up a java web application environement using its built in http connector on the port 80. But, I do not want to run it as root.

I know, there is a command - dacinet - which can do similar things, but is is part of CAPP/EAL4 trusted computing base which I would like to avoid.

So what to do now?

--Tifo

 

[mag007]

Use apache, and mod_proxy.

 

[trifo]

This is jut the thing I want to avoid. mod_proxy versus Tomcat is a well known nightmare. At the moment we use mod_jk which mostly works well, but implies limitations either.

--Trifo

 

[mag007]

Either way you have to run some sort of webserver to access port 80. I strongly suggest a secured apache with mod_proxy. Forward all traffic from port, X, to port Y. mod_jk is unefficient, and bloated, IMO.

This is jut the thing I want to avoid. mod_proxy versus Tomcat is a well known nightmare. At the moment we use mod_jk which mostly works well, but implies limitations either.

You are avoiding 'Tomcat' versus 'mod_proxy'. You are doing mod_proxy versus mod_jk.

 

[trifo]

The real golal is to run Tomcat alone, as a non-privileged user, occupying port 80.

Using mod_proxy needs to configure proxy connector in Tomcat and it is discouraged by the Tomcat docs.

--Trifo

 

[mag007]

You don't need to configure anything on tomcat.

Run tomcat on a unprivledged port, 8080

Run apache on port 80, and use 'mod_proxy_ajp'. This has load balancing too.

But to answer your question, I don't think its possible to run anything below port 1024, eventhough apache can run as 'nobody'.

HTH