blocks|key|2798749|text|选项1要求您以root身份启动节点服务器。不是很理想。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2798750|选项2增加了每个已处理请求的开销，并将另一个故障点添加到堆栈中。|2798751|选项3是最简单和最有效的方法。|2798752|要实现选项3，请将以下内容添加到系统初始化脚本中。(亚马逊网络服务等基于RedHat的系统上的/etc/rc.d/rc.local)。|offset|length|style|CODE|2798753|iptables+-t+nat+-A+PREROUTING+-i+eth0+-p+tcp+--dport+80+-j+REDIRECT+--to-port+3000|code-block|syntax|javascript|2798754|这会将请求从端口80重定向到端口3000。|2798755|entityMap^0|0|0|0|1B|I|0|0|0^^$0|@$1|2|3|4|5|6|7|U|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|V|8|@]|9|@]|A|$]]|$1|D|3|E|5|6|7|W|8|@]|9|@]|A|$]]|$1|F|3|G|5|6|7|X|8|@$H|Y|I|Z|J|K]]|9|@]|A|$]]|$1|L|3|M|5|N|7|10|8|@]|9|@]|A|$O|P]]|$1|Q|3|R|5|6|7|11|8|@]|9|@]|A|$]]|$1|S|3|-4|5|6|7|12|8|@]|9|@]|A|$]]]|T|$]]

Option 1 requires you launch the node server as root. Not ideal.

Option 2 adds overhead to every handled request and adds another failure point to your stack.

Option 3 Is the simplest and most efficient method.

To implement Option 3, add the following to your system init scripts. (<code>/etc/rc.d/rc.local</code> on RedHat based systems like AWS).

<pre><code>iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3000
</code></pre>

That will redirect requests from port 80 to port 3000.

blocks|key|3011183|text|(我没有足够的名气来添加对Matt+Browne的评论，所以我写这篇文章作为答案。请随意编辑。)|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3011184|与Matt+Browne的链接中描述的方法相比，有一种更简单的方法可以在重新启动后自动加载iptables规则:可以使用apt-get从存储库中安装iptables-persistent：|3011185|apt-get+install+iptables-persistent|code-block|syntax|javascript|3011186|规则仍然需要手动保存，如下所示：|3011187|IPv4：|3011188|iptables-save+>+/etc/iptables/rules.v4|3011189|IPv6：|3011190|iptables-save+>+/etc/iptables/rules.v6|3011191|(来源：http://www.thomas-krenn.com/de/wiki/Iptables_Firewall_Regeln_dauerhaft_speichern+(德语))|offset|length|3011192|entityMap|0|LINK|mutability|MUTABLE|url|http://www.thomas-krenn.com/de/wiki/Iptables_Firewall_Regeln_dauerhaft_speichern^0|0|0|0|0|0|0|0|0|4|28|0|0^^$0|@$1|2|3|4|5|6|7|14|8|@]|9|@]|A|$]]|$1|B|3|C|5|6|7|15|8|@]|9|@]|A|$]]|$1|D|3|E|5|F|7|16|8|@]|9|@]|A|$G|H]]|$1|I|3|J|5|6|7|17|8|@]|9|@]|A|$]]|$1|K|3|L|5|6|7|18|8|@]|9|@]|A|$]]|$1|M|3|N|5|F|7|19|8|@]|9|@]|A|$G|H]]|$1|O|3|P|5|6|7|1A|8|@]|9|@]|A|$]]|$1|Q|3|R|5|F|7|1B|8|@]|9|@]|A|$G|H]]|$1|S|3|T|5|6|7|1C|8|@]|9|@$U|1D|V|1E|1|1F]]|A|$]]|$1|W|3|-4|5|6|7|1G|8|@]|9|@]|A|$]]]|X|$Y|$5|Z|10|11|A|$12|13]]]]

(I haven't got enough reputation to add a comment the the one of Matt Browne, so I write this as an answer. Feel free to edit.)

There is a simpler method to load iptables rules automatically after a reboot than the one described in the link of Matt Browne: One can install iptables-persistent from the repositories using apt-get:

<pre><code>apt-get install iptables-persistent
</code></pre>

Rules still need to be saved manually like this:

IPv4:

<pre><code>iptables-save &gt; /etc/iptables/rules.v4
</code></pre>

IPv6:

<pre><code>iptables-save &gt; /etc/iptables/rules.v6
</code></pre>

(Source: <a href="http://www.thomas-krenn.com/de/wiki/Iptables_Firewall_Regeln_dauerhaft_speichern" rel="noreferrer">http://www.thomas-krenn.com/de/wiki/Iptables_Firewall_Regeln_dauerhaft_speichern</a> (german))

blocks|key|3011210|text|我喜欢这种解决方法的简单性：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3011211|sudo+setcap+'cap_net_bind_service=%2Bep'+`which+node`|code-block|syntax|javascript|3011212|它也适用于nodejs+btw以外的程序。|3011213|基本上，作为第二个参数，你输入程序可执行文件的路径(就像Ubuntu上的/usr/bin/nodejs一样)，在上面的例子中，which+node应该动态地提供它，从而使这项工作独立于Linux发行版。|offset|length|style|CODE|3011214|但是要注意，当您升级nodejs或可执行文件由于其他原因而被覆盖时，您将不得不再次执行相同的命令。|3011215|资料来源：|3011216|3011217|How+to:+Allow+Node+to+bind+to+port+80+without+sudo，|unordered-list-item|3011218|Is+there+a+way+for+non-root+processes+to+bind+to+"privileged"+ports+on+Linux?|3011219|3011220|entityMap|0|LINK|mutability|MUTABLE|url|https://gist.github.com/firstdoit/6389682|1|https://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-on-linux/414258#414258^0|0|0|0|10|F|1R|A|0|0|0|0|0|1E|0|0|0|25|1|0|0^^$0|@$1|2|3|4|5|6|7|19|8|@]|9|@]|A|$]]|$1|B|3|C|5|D|7|1A|8|@]|9|@]|A|$E|F]]|$1|G|3|H|5|6|7|1B|8|@]|9|@]|A|$]]|$1|I|3|J|5|6|7|1C|8|@$K|1D|L|1E|M|N]|$K|1F|L|1G|M|N]]|9|@]|A|$]]|$1|O|3|P|5|6|7|1H|8|@]|9|@]|A|$]]|$1|Q|3|R|5|6|7|1I|8|@]|9|@]|A|$]]|$1|S|3|-4|5|6|7|1J|8|@]|9|@]|A|$]]|$1|T|3|U|5|V|7|1K|8|@]|9|@$K|1L|L|1M|1|1N]]|A|$]]|$1|W|3|X|5|V|7|1O|8|@]|9|@$K|1P|L|1Q|1|1R]]|A|$]]|$1|Y|3|-4|5|6|7|1S|8|@]|9|@]|A|$]]|$1|Z|3|-4|5|6|7|1T|8|@]|9|@]|A|$]]]|10|$11|$5|12|13|14|A|$15|16]]|17|$5|12|13|14|A|$15|18]]]]

I love the simplicity of this workaround:

<pre><code>sudo setcap 'cap_net_bind_service=+ep' `which node`
</code></pre>

It also works for programs other than nodejs btw. 

Basically as 2nd parameter you type the path to the program executable (like <code>/usr/bin/nodejs</code> on Ubuntu), in the above case <code>which node</code> should provide it dynamically, thus making this work independently from Linux distro.

Beware though that when you upgrade nodejs or the executable gets overwritten for some other reason you would have to execute that same command again.

Sources:

<ul>
<li><a href="https://gist.github.com/firstdoit/6389682" rel="nofollow noreferrer">How to: Allow Node to bind to port 80 without sudo</a>,</li>
<li><a href="https://stackoverflow.com/questions/413807/is-there-a-way-for-non-root-processes-to-bind-to-privileged-ports-on-linux/414258#414258">Is there a way for non-root processes to bind to &quot;privileged&quot; ports on Linux?</a></li>
</ul>

I'm running a node.js server, that will serve requests on port 80 amongst others. Clearly this requires the application running as root (on Linux).

Looking at this post (<a href="http://syskall.com/dont-run-node-dot-js-as-root" rel="noreferrer">http://syskall.com/dont-run-node-dot-js-as-root</a>) as an example it's clear that there are simple ways to allow node to be run as a non-root user, but I'm wondering if anyone has views on the advantages/disadvantages of the different methods suggested:

<ol>
<li>code: use setuid() to drop down from root to non-priviledged user after listening on port 80 is established.</li>
<li>using a proxy server of some sort to redirect requests to a port >1024 (and so not need node to run as root)</li>
<li>using IP tables to forward to another port (ditto node would not run as root)</li>
</ol>

Thanks

How to run node.js as non-root user?

服务器

Ubuntu

Linux

我正在运行一个node.js服务器，它将在端口80等端口上为请求提供服务。显然，这需要应用程序以root身份运行(在Linux上)。以这篇文章()为例，很明显有一些简单的方法可以让node以非根用户的身份运行，但我想知道是否有人对所建议的不同方法的优缺点有看法：setuid代码:侦听端口80 is establishe...

问如何以非根用户身份运行node.js？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何以非根用户身份运行node.js？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何以非根用户身份运行node.js？
EN