Re: www user than root

From: Jeremie Le Hen (jeremie_at_le-hen.org)
Date: 06/23/05

  • Next message: Abu Khaled: "Re: www user than root" 
    Date: Thu, 23 Jun 2005 15:14:55 +0200
To: Darren Pilgrim <dmp@bitfreak.org>

    > Most daemons that bind to "priveleged" ports and run as a non-root uid,
    > start as root, then change the effective UID after binding to the port.

    Yes. Secure programs like Postfix (smtp), OpenSSH, vsftpd and Dovecot
    (imap) use privilege separation. For instance if you need to open the
    TCP port 80 lately, you could use a separate process for this purpose
    only and communicate through it (through a UNIX socket). There is
    obviously some performance degradation if you need to use high speed
    communications, but this is a trade-off if you really need to open a
    privileged port lately and you want security.

    Regards, 

    -- 
Jeremie Le Hen
< jeremie at le-hen dot org >< ttz at chchile dot org >
_______________________________________________
freebsd-net@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-net
To unsubscribe, send any mail to "freebsd-net-unsubscribe@freebsd.org"
  • Next message: Abu Khaled: "Re: www user than root"

    Relevant Pages

    • Bind a socket to a low port number without privilege
      ... I have successfully port and run an anti-spam/anti-virus SMTP proxy server on VMS. ... But as the process need to access port 25, ... grant to the process either SYSPRV, BYPASS, or OPER privilege. ...
      (comp.os.vms)
    • Run process as non-root user with port <1024
      ... Is there anyway to allow a non-root user listen on a port below 1024? ... know only root is suppose to have this privilege. ... Note, using iptables ...
      (SunManagers)
    • Re: Lasted NDIS wrapper for D-Link DWL-520+ on RELENG_6
      ... support most of the ACX chip family, ... ISTR that I read this port does not compile on RELENG_6 ... Jeremie Le Hen ... < jeremie at le-hen dot org>< ttz at chchile dot org> ...
      (freebsd-current)
    • Re: vms versus solaris
      ... >> inbound connections. ... But no privilege to listen on a port with a higher number. ... DECnet requires privilege to receive _any_ unauthenticated inbound ...
      (comp.os.vms)
    • Re: vpnc problem
      ... I am successfully using vpnc that came with freebsd 6.1 able to connect ... into cisco 3000 concentrator ... Jeremie Le Hen wrote: ... The port stands in security/vpnc, ...
      (freebsd-questions)