3

The company I'm in uses the Java Secure Application Manager to "secure" non-internal connections their webmail and electronic collaboration software.

Aside from using expired certificates, and missing the permissions JAR File Manifest Attributes, the sofware runs fine, except it needs to bind to ports 80 and 443, which means to run it, I need to be running the icedtea plugin in Firefox running as root. Is there anyway I can let this application access to those ports without needing to run it as root (for security reasons)?

Improve this question
2
  • 1
    you can allow any java program to bind to any ports by running setcap 'cap_net_bind_service=+ep' JRE_FILE - see stackoverflow.com/a/414258 for more details
    – Ulrich Dangel
    Jul 19, 2014 at 22:51
  • Your answer is the one that solves the problem I'm asking, unfortunatly setcap fails with Failed to set capabilities on file /usr/bin/program (Invalid argument)
    – Mark Hatley
    Jul 20, 2014 at 3:15

1 Answer 1

Reset to default
1

Run the software behind a reverse proxy. There are many to choose from. Probably the most popular is nginx, but many web servers have a way to configure them as a reverse proxy. There are also dedicated reverse proxy programs like Apache Traffic Server.

Alternately, if you are running on Linux, you can do NAT port forwarding via iptables.

This assumes you can configure the software to bind to a nonstandard port. Proxying or NAT will let the software appear to be bound to the standard HTTP[S] ports.

If the software isn't configurable, and you don't have the in-house capability to hack the JAR files to make them work on nonstandard ports, you can run the software in a VM, or on a dedicated machine, where the consequences of running as root are not as problematic. Then you can do as before: NAT or proxy the dedicated server/VM so that it appears to be served directly from the user-facing machine.

Improve this answer
2
  • If I understood correctly the question, the program is hard coded to open ports 80 and 443 and can't use other ports, so your solution won't work in this case.
    – Cristian Ciupitu
    Jul 20, 2014 at 0:10
  • @CristianCiupitu: Addressed that in the answer.
    – Warren Young
    Jul 20, 2014 at 0:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .