From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S263880AbTLXVet (ORCPT ); Wed, 24 Dec 2003 16:34:49 -0500 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S263893AbTLXVet (ORCPT ); Wed, 24 Dec 2003 16:34:49 -0500 Received: from greendale.ukc.ac.uk ([129.12.21.13]:5291 "EHLO greendale.ukc.ac.uk") by vger.kernel.org with ESMTP id S263880AbTLXVes convert rfc822-to-8bit (ORCPT ); Wed, 24 Dec 2003 16:34:48 -0500 To: =?iso-8859-15?q?Sven_K=F6hler?= Cc: linux-kernel@vger.kernel.org Subject: Re: allow process or user to listen on priviledged ports? References: From: Adam Sampson Organization: Things I did not know at first I learned by doing twice. Date: Wed, 24 Dec 2003 21:34:39 +0000 In-Reply-To: ( =?iso-8859-15?q?Sven_K=F6hler's_message_of?= "Wed, 24 Dec 2003 17:43:09 +0100") Message-ID: User-Agent: Gnus/5.1002 (Gnus v5.10.2) Emacs/21.3 (gnu/linux) MIME-Version: 1.0 Content-Type: text/plain; charset=iso-8859-15 Content-Transfer-Encoding: 8BIT X-UKC-Mail-System: No virus detected Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org Sven Köhler writes: > So is there any machanism to bind that permission (to listen on a > priviledged tcp-port) to a specific user or a specific process? Even if you can't find a way to do this, you can cheat: use an iptables DNAT rule to translate connections to the desired port into connections to a non-privileged port upon which your daemon is actually listening. Something like: iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to 1.2.3.4:8080 -- Adam Sampson