Return
-
Title
How to set up Foglight Management server (FMS) listen to port 80/443 with non-root user on Linux server -
Description
How to set up Foglight Management server (FMS) listen to port 80/443 with non-root user on Linux server.
-
Cause
Traditional UNIX implementations distinguish two categories of processes: privileged processes (whose effective user ID is 0, referred to as superuser or root), and unprivileged processes (whose effective UID is nonzero). Privileged processes bypass all kernel permission checks, while unprivileged processes are subject to full permission checking based on the process's credentials (usually: effective UID, effective GID, and supplementary group list).
Starting with kernel 2.2, Linux divides the privileges traditionally associated with superuser into distinct units, known as capabilities, which can be independently enabled and disabled. Capabilities are a per-thread attribute.
By default, any non-root user in Linux system will not able to bind/listen Internet domain privileged ports (port numbers less than 1024), therefor FMS will not listen to port 80 even you change the server.http.port = "80" on server.config -
Resolution
RESOLUTION:
1. Stop Foglight FMS process
2. Login as root
3. setcap cap_net_bind_service=+ep /path/fms (you need replace /path/fms to your real path)
4. Modify $FGLHOME/config/server.config and change server.http.port to 80 and/or server.https.port to 443.
5. Login as your foglight user and restart FMS.
6. You should able to access Foglight console via 80 or 443
ALTERNATIVE METHOD:
You can use nat based method to redirect traffic from port 80 to 8080.(this way you do NOT make change on server.config and system will direct all incoming port 80 access to port 8080)root@myhost # iptables -t nat -A PREROUTING -d <ip> -p tcp --dport 80 -m addrtype --dst-type LOCAL -j DNAT --to-destination <ip>:8080root@myhost # iptables -t nat -A OUTPUT -d <ip> -p tcp --dport 80 -m addrtype --dst-type LOCAL -j DNAT --to-destination <ip>:8080