Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

Running Tomcat on port 80 without beeing system?

Fredrik Israelsson
Occasional Advisor

Running Tomcat on port 80 without beeing system?

Is it posssible to give explicit permission to a non-privileged user to use a port below 1024?

If not, is it possible to transparently map port 80 to port 8080?
11 REPLIES
Joseph Huber_1
Honored Contributor

Re: Running Tomcat on port 80 without beeing system?

The program image listening on the port needs to be INSTALLed with privileges (I think SYSPRV is enough), then the user running it doesn't have to be privileged.

Now I have no experience with Tomcat, but my (OSU-) http server is running from an account with no privileges, on the procedure doing the INSTALL is privileged (running from startup).
http://www.mpp.mpg.de/~huber
Wim Van den Wyngaert
Honored Contributor

Re: Running Tomcat on port 80 without beeing system?

WASD is installed with ALTPRI, CMKRNL, DETACH, PRMGBL, PRMMBX, PSWAPM, SYSGBL, SYSLCK, SYSPRV, SYSNAM, WORLD.

You try that if sysprv alone is not working.

Wim
Wim
Fredrik Israelsson
Occasional Advisor

Re: Running Tomcat on port 80 without beeing system?

Hmm, isn't installing java.exe as a privileged image the same thing as giving java code system access?
Jim_McKinney
Honored Contributor

Re: Running Tomcat on port 80 without beeing system?

SYSPRV or BYPASS is required to open ports numbered 1024 and less. This is a security feature that guarantees an incoming client that the service associated with these ports is "the real thing".
Fredrik Israelsson
Occasional Advisor

Re: Running Tomcat on port 80 without beeing system?

Yeah, virtual security :) The problem is that I don't want to give the Tomcat user any high privileges as any bug in it potentially may give someone system access, but I want the users to be able to enter an URL without port number which most users don't understand.

Is anything like iptables port rerouting available in OpenVMS? That would also be a solution.

Wim Van den Wyngaert
Honored Contributor

Re: Running Tomcat on port 80 without beeing system?

"The process must have a system user identification code (UIC) and the SYSPRV, BYPASS, or OPER privilege to bind port numbers 1 to 1023."

Oper is less than SYSPRV I would say (or at least different).

Wim
Wim
Hoff
Honored Contributor

Re: Running Tomcat on port 80 without beeing system?

The usual approach is to provide a way to launch the tool or to create environment with the necessary privileges.

Topic http://labs.hoffmanlabs.com/node/491 has some high-level information on this granting privileges topic, whether via Cerebrus or via DCL DECnet or batch processes or captive login or otherwise.

Tools including iptables and firewalls and such are not presently available with TCP/IP Services product. Check the third-party stacks and the OpenVMS roadmap, or check with your HP reseller or representative.

It can also be feasible to remap the incoming port requests at the firewall, given the capabilities of various external firewalls.


Wim Van den Wyngaert
Honored Contributor

Re: Running Tomcat on port 80 without beeing system?

May be your cat can be started on port 8080. Users just have to specify the port number then (like www.google.com:8080/xxx I think).

Wim
Wim
Colin Butcher
Esteemed Contributor

Re: Running Tomcat on port 80 without beeing system?

Typically people use port 8080 for Tomcat , then front-end that with an Apache served page (using port 80 for CSWS).

That can also help if you need to run multiple instances of Tomcat and so use a different port for each instance of Tomcat (eg: 8080, 8081, 8082 ...).

Do make sure you give Tomcat plenty of memory and set the process quotas accordingly.

Cheers, Colin (http://www.xdelta.co.uk).
Entia non sunt multiplicanda praeter necessitatem (Occam's razor).
Fredrik Israelsson
Occasional Advisor

Re: Running Tomcat on port 80 without beeing system?

I am already running Tomcat 4.latest and 5.latest on other ports for Webservice integration with Fortran. Running a user interface directly accessed by the end users on other ports than port 80 will result in an increased support load though.

Maybe there are no other solution on OpenVMS than to put Apache in front of Tomcat even if I don't need it and it only will increase the number of applications I will need to maintain.
Colin Butcher
Esteemed Contributor

Re: Running Tomcat on port 80 without beeing system?

There are other web servers for OpenVMS that have a lot less overhead than Apache for just a single initial redirect page.

Look at WASD and OSU - also see the Digital Press book by Alan Winston titled OpenVMS with Apache, OSU and WASD.

I'd also recommend that you take a look at Jean-Francois Pieronne's OpenVMS related work as well.

Cheers, Colin (http://www.xdelta.co.uk).
Entia non sunt multiplicanda praeter necessitatem (Occam's razor).