Problem: starting jboss service on port < 1000 (80 to be exa

[katazan]

I'm running the jboss_init_redhat.sh script as root from the bin directory under JBOSS_HOME.

I've created the jboss user (as referenced from the script), and all other things seem to be in line.

I'm getting the following error:
java.net.BindException: Permission Denied

This exception origninates from the MBeanProxy after attempting to start the Jetty service.

From what I understand, if you aren't starting the process as root, and the process attempts to acquire a socket to a port < 100 (port 80 in this case), the previous exception case will arise. I thought that the su -c someLinuxProcess would circumvent the problem, but it doesn't seem to be.

Please advise.

Thanks,

John

[jules]

Look through this forum for the JBoss/Jetty FAQ - there is an item on exactly this.

Jules

[jules]

Sorry - not this forum - the web forum.

[katazan]

Thanks...I'll check it out...do you have a link?

[techmonkey]

had the same problem. I wanted to run JBoss as a non-root user for security reasons. I got an error trying to bind to port 80. So here is how I solved it (for Linux)

I setup my JBoss to run on port 8080 as user JBoss.

I changed Linux to redirect port 80 to port 8080, effectively bypassing the security restriction of non-root users binding to port 80.

The redirect command is as follows:

iptables -t nat -A PREROUTING -p tcp --dport 80 -j REDIRECT --to-port 8080

You will need to integrate this into whatever iptables commands you are already using.

[mjdinsmore]

That seems like a convoluted way AROUND the problem. Why don't you just change the tomcat41-service.xml file and modify the line:



to use port 80 like it is here. That will work fine, and if you have multiple IP adresses on the machine, you can also add in the address attribute.

-Michael

[techmonkey]

that works fine if you run JBoss as "root". However, I consider that a security risk, and would rather run JBoss as a user who couldn't accidently delete every file on my system.

Yeah, the solution is pretty convulted, but it gives me the best security on port 80.