Drop Root Privileges in Node.js after Binding to Port 80

Alternatively, you could grant the node binary the ability bind ports &#60; 1024, using setcap (Linux only):<p><pre><code> sudo setcap 'cap_net_bind_service=+ep' /path/to/nodejs </code></pre> Then you don't have to ever run it as root (at least not for the purpose of binding to the right port).

It's probably a better idea to just run nginx on port 80 and proxy requests through in any sort of real environment. And if you're not in production...well, it doesn't really matter which port you choose anyway.

Another technique is to launch the service via authbind, in your repositories. It's especially useful if you aren't able to recompile the target.<p><a href="http://en.wikipedia.org/wiki/Authbind" rel="nofollow">http://en.wikipedia.org/wiki/Authbind</a>

Looking at the snippet of code: Isn't that sample (probably) confusing group and user?<p><pre><code> process.setgid('tlhunter'); process.setuid('users'); </code></pre> I'd expect that 'users' is the group here and 'tlhunter' the user 'thomas l. hunter'?

Alternatively, if you don't trust a large program with dropping root, you can factor out the binding and listening into a separate program. Then accepting and everything beyond can be done with normal privileges.<p>Assuming a tcpserver-like program called tcplisten, this would look like<p><pre><code> sudo tcplisten 0.0.0.0 80 setuidgid nobody \ program-that-accepts-on-stdin </code></pre> FastCGI works similarly. Multiple workers can run underneath, calling accept(2) on stdin.<p>A simple implementation of tcplisten:<p><a href="https://gist.github.com/4211098" rel="nofollow">https://gist.github.com/4211098</a>

I wrote a similar article a few weeks ago (<a href="http://syskall.com/dont-run-node-dot-js-as-root/" rel="nofollow">http://syskall.com/dont-run-node-dot-js-as-root/</a>) but have since then realized that changing the process' UID brings a lot of unexpected problems and a much simpler solution is to use a higher port and proxy via nginx. For example, if you initialize a logger before starting your HTTP server and changing the process UID, you will might create root owned files and eventually run into permission conflicts.

Not a good idea to hardcode the name of the "owner". Standard practice is to setuid/gid to 65535 (nobody).

You could also create a unix socket and have node.js bind on it.