Running Tomcat on port 80 without beeing system?

[Fredrik Israelsson]

Is it posssible to give explicit permission to a non-privileged user to use a port below 1024?

If not, is it possible to transparently map port 80 to port 8080?

[Joseph Huber_1]

The program image listening on the port needs to be INSTALLed with privileges (I think SYSPRV is enough), then the user running it doesn't have to be privileged.

Now I have no experience with Tomcat, but my (OSU-) http server is running from an account with no privileges, on the procedure doing the INSTALL is privileged (running from startup).

[Wim Van den Wyngaert]

WASD is installed with ALTPRI, CMKRNL, DETACH, PRMGBL, PRMMBX, PSWAPM, SYSGBL, SYSLCK, SYSPRV, SYSNAM, WORLD.

You try that if sysprv alone is not working.

Wim

[Fredrik Israelsson]

Hmm, isn't installing java.exe as a privileged image the same thing as giving java code system access?

[Jim_McKinney]

SYSPRV or BYPASS is required to open ports numbered 1024 and less. This is a security feature that guarantees an incoming client that the service associated with these ports is "the real thing".

[Fredrik Israelsson]

Yeah, virtual security :) The problem is that I don't want to give the Tomcat user any high privileges as any bug in it potentially may give someone system access, but I want the users to be able to enter an URL without port number which most users don't understand.

Is anything like iptables port rerouting available in OpenVMS? That would also be a solution.

[Wim Van den Wyngaert]

"The process must have a system user identification code (UIC) and the SYSPRV, BYPASS, or OPER privilege to bind port numbers 1 to 1023."

Oper is less than SYSPRV I would say (or at least different).

Wim

[Hoff]

The usual approach is to provide a way to launch the tool or to create environment with the necessary privileges.

Topic http://labs.hoffmanlabs.com/node/491 has some high-level information on this granting privileges topic, whether via Cerebrus or via DCL DECnet or batch processes or captive login or otherwise.

Tools including iptables and firewalls and such are not presently available with TCP/IP Services product. Check the third-party stacks and the OpenVMS roadmap, or check with your HP reseller or representative.

It can also be feasible to remap the incoming port requests at the firewall, given the capabilities of various external firewalls.

[Wim Van den Wyngaert]

May be your cat can be started on port 8080. Users just have to specify the port number then (like www.google.com:8080/xxx I think).

Wim

[Colin Butcher]

Typically people use port 8080 for Tomcat , then front-end that with an Apache served page (using port 80 for CSWS).

That can also help if you need to run multiple instances of Tomcat and so use a different port for each instance of Tomcat (eg: 8080, 8081, 8082 ...).

Do make sure you give Tomcat plenty of memory and set the process quotas accordingly.

Cheers, Colin (http://www.xdelta.co.uk).

[Fredrik Israelsson]

I am already running Tomcat 4.latest and 5.latest on other ports for Webservice integration with Fortran. Running a user interface directly accessed by the end users on other ports than port 80 will result in an increased support load though.

Maybe there are no other solution on OpenVMS than to put Apache in front of Tomcat even if I don't need it and it only will increase the number of applications I will need to maintain.

[Colin Butcher]

There are other web servers for OpenVMS that have a lot less overhead than Apache for just a single initial redirect page.

Look at WASD and OSU - also see the Digital Press book by Alan Winston titled OpenVMS with Apache, OSU and WASD.

I'd also recommend that you take a look at Jean-Francois Pieronne's OpenVMS related work as well.

Cheers, Colin (http://www.xdelta.co.uk).