Running tcpdump as non root user
This is a short guide to setup tcpdump as a non root user but only so that specific users which are added to a group can actually run tcpdump. This is different from running tcpdump from sudo which will still actually be running tcpdump as a root user.
Also you can check the file /usr/bin/tcpdump
, if it does not resides at /usr/sbin/tcpdump
You can enable this for non root users in a secure method by using the following commands
groupadd tcpdump
addgroup <username> tcpdump
chown root.tcpdump /usr/sbin/tcpdump
chmod 0750 /usr/sbin/tcpdump
setcap "CAP_NET_RAW+eip" /usr/sbin/tcpdump
As a brief explanation of the above.
We create a group called tcpdump
We then add the user or users that we want to be able to use tcpdump to the group.
We then change the user/group of tcpdump to match root and the new group.
We then make sure the permissions are set on tcpdump so that members of the group can execute it but other normal users cannot.
We then use setcap to give the CAP_NET_RAW priviledge to the executable when it runs. This is so that tcpdump can open its raw socket which is not normally permitted unless you are root.
found on : https://www.stev.org/post/howtoruntcpdumpasroot