1

Long story short: I want Glassfish to listen to port 80 so that you don't have to specify port when typing in the url, but linux doesn't permit using low port numbers without root and running glassfish as root is a security risk.

What is the best way to get around this? Making some sort of exception so that glassfish alone may listen to it, using some other program to forward requests from port 80 to some other port? Perhaps there is some way to give just glassfish permission to use any port without actually giving it root?

2

3 Answers 3

1

What is the best way to get around this?

The one that's given in glassfish itself.

Straight from linux-service.template:

# Example commands that demonstrate how to run GlassFish on the "special" ports < 1024
#
# iptables -t nat -A PREROUTING -p tcp -m tcp --dport 80 -j REDIRECT --to-ports 8080
# iptables -t nat -A PREROUTING -p udp -m udp --dport 80 -j REDIRECT --to-ports 8080

Yes, it would be good if glassfish were able to receive a listening file descriptor so that it could be run under something like s6-tcpserver or socket-activated by systemd. It isn't designed to operate in anything like that way, however.

Further reading

0

You could use a copy of bash...
What I mean is that you could make a separate version of bash in one of your $PATH directories, and call it bash1 or something.
Then what you could do is give it different permissions so that you could run glassfish with bash1 instead of bash.
This would mean tyat bash would remain unchanged and you have your own seperate permissions version of bash for instances such as glassfish. The only drawback is that this would mean you would have to regulate this to only certain programs and users or the whole system could possibly be undermined...

0

While it's not as heavily used as it once was, 'chroot' is a tool that improves the security for processes that must run with root privileges. It takes some extra effort as you are creating a virtual / folder with all files that your application needs, including libraries (compiled the program statically linked) That way if some process should break your security, it will be in a limited sandbox. Obviously you strip out any un-needed support programs, like editors and network tools.

One of the preferred method of running bind/named uses this, so that might be a good guide on how to set this up.

Check https://help.ubuntu.com/community/BasicChroot for more details.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .