Re: running resin as non-root usr

"Erik Beeson" <[email protected]> writes:

>     There is a FAQ entry for that, at least for Linux users:
>    
>     http://www.caucho.com/resin-3.0/install/faq.xtp#
>     How-can-I-bind-to-a-port-under-1024-and-still-run-as-a-non-root-user?
>
> Does the real client ip address still show up in your access logs
> with iptables?

Yes, the real client ip address still show up.  It works like a charm.

> No iptables on Solaris anyways. Maybe ipfilter could do it.

I'm not familiar enough with Solaris to be of any help.

> Also, requiring root to bind to ports <1024 is done for a reason.

Well, I don't get the reason :-) <irony>I suspect the reasoning back
in the 80s (or maybe 70s?) was that local mortal users shouldn't be
able to start "system" services such as SMTP et cetera.  Back then all
system admins where friends, a kind of a priesthood.  Then you could
"trust" a server to deal with your mail properly.</irony>

> I think setuid is the only real right answer if you aren't going to
> run apache out front (which I'd rather not do, resin is a fine
> webserver).

Many setups have a dedicated NAT firewall that takes care of port
forwarding as well.  I think that's more and more common these days.

-Knut