Score:1

Server

Tomcat 9 on port 443 working with only root which can be hamful

Noor

12/9/22, 10:14 AM

After so many reading of serverfault.com articles I have successfully configured my tomcat 9 on port 443.

But problem is 443 is an privileged port in which i added root user in below tomcat.service but how i can avoid this as i want to give permission to tomcat user for just only one service. I hope you understand my issue and will advise the best answer.

vim /etc/systemd/system/tomcat.service


[Unit]
Description=Tomcat 9 servlet container
After=network.target

[Service]
Type=forking



############## I added root user here ##########################
**User=root
Group=root**

Environment="JAVA_HOME=/usr/lib/jvm/jre"
Environment="JAVA_OPTS=-Djava.security.egd=file:///dev/urandom"

Environment="CATALINA_BASE=/opt/tomcat/latest"
Environment="CATALINA_HOME=/opt/tomcat/latest"
Environment="CATALINA_PID=/opt/tomcat/latest/temp/tomcat.pid"
Environment="CATALINA_OPTS=-Xms512M -Xmx1024M -server -XX:+UseParallelGC"

ExecStart=/opt/tomcat/latest/bin/startup.sh
ExecStop=/opt/tomcat/latest/bin/shutdown.sh

[Install]
WantedBy=multi-user.target

298

1 + 8

tomcat9

vidarlo

12/9/22, 10:20 AM

You may want to have a look at e.g. https://unix.stackexchange.com/questions/187726/how-do-daemons-like-apache-or-bind-open-ports-below-1024

Noor

12/9/22, 10:42 AM

Its very limited and has incomplete answer as i already read the article thats why writing another for complete guidance and solution.

Noor

12/9/22, 12:54 PM

anyone can reply on this waiting

doneal24

12/9/22, 2:34 PM

Why does using root capabilities not apply to your situation?

doneal24

12/9/22, 4:27 PM

There is also [tomcat 9 configuration for port 443](https://serverfault.com/questions/969191/tomcat-9-configuration-for-port-443?rq=1)

Noor

12/9/22, 5:05 PM

Not working at All i have tried all the above methods from 5 days but no luck at All.

Noor

12/10/22, 4:10 AM

Tomcat 9 Service is working fine with user tomcat and group tomcat but problem is that with tomcat 443 port is not opening but when i added root the port is opening.

Noor

12/10/22, 4:25 AM

https://superuser.com/questions/710253/allow-non-root-process-to-bind-to-port-80-and-443 this is the url what i need but this is still incomplete answer can someone please guide in detail how i can use net_cap for tomcat 443

Score:1

Server

Michael Hampton

12/10/22, 7:50 PM

You can run Tomcat (or anything) as non-root and still bind to system ports if you have granted the CAP_NET_BIND_SERVICE capability set. You can do this in your systemd unit by adding AmbientCapabilities= in the [Service] section:

AmbientCapabilities=CAP_NET_BIND_SERVICE

Obviously you will also need to remove User= and Group=.

You should also consider using NoNewPrivileges=true to restrict the app from elevating its privileges.

0 + 2

Noor

12/11/22, 5:49 AM

Appreciated ! Dear Michael Hampton, after followed you instructions my issue has resolved i would like to say thanks to understand my issue and your dedication for said problem. Thanks you very much.

Michael Hampton

12/11/22, 1:07 PM

@Noor Thank you! You can mark it as solved by clicking the outline of the tick mark so that it turns solid green.

Elon Musk

I sit in a Tesla and translated this thread with Ai:

EN: Tomcat 9 on port 443 working with only root which can be hamful

TH: Tomcat 9 บนพอร์ต 443 ทำงานกับรูทเท่านั้นซึ่งอาจเป็นอันตรายได้

RO: Tomcat 9 pe portul 443 lucrează doar cu root care poate fi dăunător

RU: Tomcat 9 на порту 443 работает только с root, что может быть вредно

VI: Tomcat 9 trên cổng 443 chỉ hoạt động với root có thể gây khó khăn

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.