Dear Linux, Privileged Ports Must Die
ar.al/2022/08/30/dear-linux-pr…
#Linux #PrivilegedPortsMustDie
Dear Linux, Privileged Ports Must Die
Privileged ports, toffs of the Linux world. Kitten is a small web server that runs as a user-level service and would never need elevated privileges if it wasn’t for one archaic anti-security feature in Linux that dates back to the mainframe era: pr…Aral Balkan
Aral Balkan reshared this.
ArneBab
in reply to Aral Balkan • • •my first thought was "uh, what?!"
But starting unprivileged at 80 sounds good.
I would not want unprivileged to start at 22, though: SSH must stay in the domain of root because it is how any other user can log in.
If it gives privilege, it should be a privileged port.
Aral Balkan
in reply to ArneBab • • •Lars Lehtonen
in reply to Aral Balkan • • •Aral Balkan
in reply to Lars Lehtonen • • •@alrs Thanks, Lars, appreciate the fact checking (it was the one bit I couldn’t find a proper source for and, after your post, some more digging brought up the original implementation). I’ve updated the post accordingly; appreciate it :)
ar.al/2022/08/30/dear-linux-pr…
Dear Linux, Privileged Ports Must Die
Aral BalkanAral Balkan
Unknown parent • • •Aral Balkan
Unknown parent • • •Disable privileged ports security theatre on Linux instead of using setcap (#169) · Issues · Site.js / app
GitLabAral Balkan
Unknown parent • • •BrightSide
in reply to Aral Balkan • • •You can do this for specific executables using "setcap 'cap_net_bind_service=+ep' /path/to/program"
Or (not to get tangled in another discussion about this) but if you launch with a systemd service you can put AmbientCapabilities=CAP_NET_BIND_SERVICE in your [Service] section
Aral Balkan
in reply to BrightSide • • •@brightside Yeah, I know :)
source.small-tech.org/site.js/…
Disable privileged ports security theatre on Linux instead of using setcap (#169) · Issues · Site.js / app
GitLabEmacsen
in reply to Aral Balkan • • •Yes to all of this.
I didn't know it was configurable. This is a huge deal. Thank you!
always tired (moved to chaos)
in reply to Aral Balkan • • •Aral Balkan
in reply to always tired (moved to chaos) • • •e-Jim 🖧
in reply to Aral Balkan • • •I had never considered it.