11

Lots of solutions to this problem e.g. here and here but in order to decide which is best I'd need to know more about the security implications of each solution (or at least in general).

My context: I'm looking into running a rootless Docker/Podman Nginx container (on an Ubuntu Server 20.04 LTS host). Podman gives the following solution with this error message Error: rootlessport cannot expose privileged port 80, you can add 'net.ipv4.ip_unprivileged_port_start=80' to /etc/sysctl.conf (currently 1024).

6
  • 10
    "Privileged ports" is a bit of an antiquated ("trust-based") security mechanism... note that Windows doesn't impose limitations on listening to low ports and manages to limp along semi-securely :)
    – gowenfawr
    Jan 3, 2021 at 20:25
  • Found in the linked SO topic: staldal.nu/tech/2007/10/31/…
    – Bergi
    Jan 4, 2021 at 16:43
  • "Risk" to my mind is from fact that non-root user can impersonate or launch well known services. A server compromise in such scenario does not require privilege escalation to, for example, start SSH server for attacker to persist. There are other mechanisms to circumvent this (like using higher port) but if a third network allows only port based traffic (more common than you think), then attacker cannot use compromised server as C&C or for proliferation if he listens on port 5000 for SSH or incoming web requests.
    – RedBaron
    Jan 5, 2021 at 4:39
  • authbind (manpages.ubuntu.com/manpages/xenial/man1/authbind.1.html) didn't work for me resulting in the same error for the Podman executable on Ubuntu (from man page: authbind is ineffective with setuid programs?) Jan 7, 2021 at 15:31
  • setcap cap_net_bind_service (stackoverflow.com/a/414258/4023953) also didn't work for me, same result as authbind (don't knwo why). Shame because to me it looks like the Linux best practice option when combined with limiting execution privileges using chown and chmod (limits privileged port exposure to a program and user). Jan 7, 2021 at 15:36

2 Answers 2

14

When you're using rootless Docker/Podman, the risks of allowing users to bind ports < 1024, generally depend on what else is happening on the system.

TBH the old restriction on low ports doesn't really apply that much any more, as loads of sensitive ports are over 1024 (e.g. Docker itself which will default to listening on 2375 or 2376).

There could be a risk where, for example, you had a sensitive service which you wanted to listen on a low port, and you were concerned that a user launched service would clash with it, or if you have multiple users who may want to bind a port on a host, and a malicious user could try to get access to it, before the "expected" user.

However where that's not the case, you're probably fine to allow this. Docker's recommended solution here is to allow this for all low ports, which is less fine grained than the podman recommendation you mention.

12

It depends on your system.

If it's a multi-user system with multiple users able to run docker, you may fall victim to a race attack, where a malicious docker container is started when your legitimate docker is restarting for some reason.

However, it's worth noting that becoming root if you can access docker is generally trivial, and securing your docker installation is something you should consider if you use it in production.

So allowing docker to bind directly to port below 1024 may be a convenient feature worth the security trade off on a single user system - or you may decide that it's not worth it in other scenarios. One alternative is to set up a web server (e.g. nginx or Apache) as reverse proxy in front of the docker service. The web server will face the world, and can handle tls termination, while the docker doesn't need to care about certificates - and can listen on a unprivileged port.

2
  • 6
    FWIW , OP is using rootless Docker/Podman so the becoming root via Docker piece does not apply. Jan 3, 2021 at 18:08
  • @vidarlo thanks for your Nginx solution but in the end I did not use it because of performance/complexity reasons Jan 7, 2021 at 15:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .