Linux normal users use ports below 1024 (80)

Linux for non-root users can not use the port below 1024, for some services, excessive permissions, will bring a certain risk. How to open a port below 1024 for low-privileged users. I've got a couple of options here, and it works.
First build Environment Centos7 account Tengine no sudo permissions

1.nginx and other software to do reverse proxy

The reverse proxy did not say. On the internet to find

2.iptables Port Forwarding

First, the program binds more than 1024 ports, and then the root permission to do the forwarding note some systems need to manually turn on the IP forward function

vi /etc/sysctl.conf#修改net.ipv4.ip_forward = 1#重新加载sysctl -p /etc/sysctl.conf

3. setuid

Execution under Root account

chown root:root nginxchmod 4755 nginx

You can see from the picture that Nginx can run, but the main process is still running as root, which is not safe.

4.cap_net_bind_service

Starting with version 2.1, the Linux kernel has the power concept, which allows ordinary users to do work that only superuser can do, including using ports.

Get cap_net_bind_service capability, even if the service program runs under a non-root account, it can be banding to a low-end port. The method used:
Execution under Root account

setcap cap_net_bind_service=+eip /home/tengine/nginx/tengine/sbin/nginx

Switch to the Tengine account
Information is as follows

[Root@centos7 Sbin]# Setcap Cap_net_bind_service=+eip/home/tengine/nginx/tengine/sbin/nginx[root@centos7 Sbin]# su Tengine[tengine@centos7 Sbin]$ stat Nginx File:"Nginx" Size:6054330 Blocks:11832IO BLOCK:4096 common file Equipment: fd00h/64768dInode:397136 Hard Links:1 Permissions: (0755/-rwxr-xr-x)Uid: (1001/tengine)Gid: (1001/tengine) recently visited:2016-10-1118:43:05.402239835 +0800 Recent Changes:2016-10-1118:25:47.273183401 +0800 Recent Changes:2016-10-1118:48:23.084257104 +0800 creation Time:-[tengine@centos7 Sbin]$./nginx[tengine@centos7 Sbin]$ ps-aux| grep nginxtengine180140.00.1455001124?Ss18:490:00Nginx:master process./nginxtengine180150.00.1459601596?S : 0:xx nginx:worker processtengine 18017 0.  0 0.  0 112664 984 pts/0 r+ : 0: Agrep--color=auto nginx[tengine  @centos7 Sbin]$               

Finally, don't forget how to erase this power.

-r nginx

Linux normal users use ports below 1024 (80)