I need to allow an user (different from root) to run a server listening on port 80.
Is there any way to do this?
this will work for specific processes. But to allow a particular user to bind to ports below 1024 you will have to add him to sudoers.
Have a look at this discussion for more.
Authbind, @Gilles already mentioned it, but I'd like to expand on it a bit.
It has convenient access control (details in man page): you can filter access by port, interface address, uid, ranges of address or port and combination of these.
It has very useful parameter
"Levels deep" means when a script (or program), runs another script it descends a level. So if you have
To illustrate, you could have something like this: for sake of security, you have a user
I've created the
This might be enough for the average Joe, but because you know how to use the
(Some of these methods have been mentioned in other answers; I'm giving several possible choices in rough order of preference.)
You can redirect the low port to a high port and listen on the high port.
You can start your server as root and drop privileges after it's started listening on the privileged port. Preferably, rather than coding that yourself, start your server from a wrapper that does the job for you. If your server starts one instance per connection, start it from
If your server listens in a single instance, start it from a program such as
If your server executable is stored on a filesystem that supports capabilities, you can give it the
The short answer is that this is not possible by design.
The long answer is that in the open source worlds there are lots of people playing with the design and coming up with alternate methods. In general it is widely accepted practice that this should not be possible. The fact that you are trying probably means you have another design fault in your system and should reconsider your whole system architecture in light of *nix best practices and security implications.
Lastly, if you rust specific users to run specific programs as root and what you really need is just to allow a user to restart apache or something like that,
You could use netcat or xinetd or iptables port forwarding, or use apache as a front end proxy and run the process on a non-privileged port.