topic Re: Running Tomcat on port 80 without beeing system? in Operating System - OpenVMS

Running Tomcat on port 80 without beeing system?

Fredrik Israelsson — Wed, 22 Apr 2009 09:23:21 GMT

Is it posssible to give explicit permission to a non-privileged user to use a port below 1024?

If not, is it possible to transparently map port 80 to port 8080?

Re: Running Tomcat on port 80 without beeing system?

Joseph Huber_1 — Wed, 22 Apr 2009 09:53:26 GMT

The program image listening on the port needs to be INSTALLed with privileges (I think SYSPRV is enough), then the user running it doesn't have to be privileged.

Now I have no experience with Tomcat, but my (OSU-) http server is running from an account with no privileges, on the procedure doing the INSTALL is privileged (running from startup).

Re: Running Tomcat on port 80 without beeing system?

Wim Van den Wyngaert — Wed, 22 Apr 2009 10:13:08 GMT

WASD is installed with ALTPRI, CMKRNL, DETACH, PRMGBL, PRMMBX, PSWAPM, SYSGBL, SYSLCK, SYSPRV, SYSNAM, WORLD.

You try that if sysprv alone is not working.

Wim

Re: Running Tomcat on port 80 without beeing system?

Fredrik Israelsson — Wed, 22 Apr 2009 10:39:40 GMT

Hmm, isn't installing java.exe as a privileged image the same thing as giving java code system access?

Re: Running Tomcat on port 80 without beeing system?

Jim_McKinney — Wed, 22 Apr 2009 10:54:17 GMT

SYSPRV or BYPASS is required to open ports numbered 1024 and less. This is a security feature that guarantees an incoming client that the service associated with these ports is "the real thing".

Re: Running Tomcat on port 80 without beeing system?

Fredrik Israelsson — Wed, 22 Apr 2009 11:20:02 GMT

Yeah, virtual security :) The problem is that I don't want to give the Tomcat user any high privileges as any bug in it potentially may give someone system access, but I want the users to be able to enter an URL without port number which most users don't understand.

Is anything like iptables port rerouting available in OpenVMS? That would also be a solution.

Re: Running Tomcat on port 80 without beeing system?

Wim Van den Wyngaert — Wed, 22 Apr 2009 12:06:35 GMT

"The process must have a system user identification code (UIC) and the SYSPRV, BYPASS, or OPER privilege to bind port numbers 1 to 1023."

Oper is less than SYSPRV I would say (or at least different).

Wim

Re: Running Tomcat on port 80 without beeing system?

Hoff — Wed, 22 Apr 2009 12:21:34 GMT

The usual approach is to provide a way to launch the tool or to create environment with the necessary privileges.

Topic http://labs.hoffmanlabs.com/node/491 has some high-level information on this granting privileges topic, whether via Cerebrus or via DCL DECnet or batch processes or captive login or otherwise.

Tools including iptables and firewalls and such are not presently available with TCP/IP Services product. Check the third-party stacks and the OpenVMS roadmap, or check with your HP reseller or representative.

It can also be feasible to remap the incoming port requests at the firewall, given the capabilities of various external firewalls.

Re: Running Tomcat on port 80 without beeing system?

Wim Van den Wyngaert — Wed, 22 Apr 2009 12:43:20 GMT

May be your cat can be started on port 8080. Users just have to specify the port number then (like www.google.com:8080/xxx I think).

Wim

Re: Running Tomcat on port 80 without beeing system?

Colin Butcher — Thu, 23 Apr 2009 03:09:36 GMT

Typically people use port 8080 for Tomcat , then front-end that with an Apache served page (using port 80 for CSWS).

That can also help if you need to run multiple instances of Tomcat and so use a different port for each instance of Tomcat (eg: 8080, 8081, 8082 ...).

Do make sure you give Tomcat plenty of memory and set the process quotas accordingly.

Cheers, Colin (http://www.xdelta.co.uk).

Re: Running Tomcat on port 80 without beeing system?

Fredrik Israelsson — Thu, 23 Apr 2009 10:23:35 GMT

I am already running Tomcat 4.latest and 5.latest on other ports for Webservice integration with Fortran. Running a user interface directly accessed by the end users on other ports than port 80 will result in an increased support load though.

Maybe there are no other solution on OpenVMS than to put Apache in front of Tomcat even if I don't need it and it only will increase the number of applications I will need to maintain.

Re: Running Tomcat on port 80 without beeing system?

Colin Butcher — Thu, 23 Apr 2009 17:56:03 GMT

There are other web servers for OpenVMS that have a lot less overhead than Apache for just a single initial redirect page.

Look at WASD and OSU - also see the Digital Press book by Alan Winston titled OpenVMS with Apache, OSU and WASD.

I'd also recommend that you take a look at Jean-Francois Pieronne's OpenVMS related work as well.

Cheers, Colin (http://www.xdelta.co.uk).