From owner-freebsd-security@FreeBSD.ORG Fri Oct 20 16:24:14 2006 Return-Path: X-Original-To: freebsd-security@freebsd.org Delivered-To: freebsd-security@freebsd.org Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125]) by hub.freebsd.org (Postfix) with ESMTP id 32CFF16A407 for ; Fri, 20 Oct 2006 16:24:14 +0000 (UTC) (envelope-from quetzal@zone3000.net) Received: from mx1.sitevalley.com (sitevalley.com [209.67.60.43]) by mx1.FreeBSD.org (Postfix) with SMTP id C0E3B43D46 for ; Fri, 20 Oct 2006 16:24:13 +0000 (GMT) (envelope-from quetzal@zone3000.net) Received: from unknown (HELO localhost) (217.144.69.37) by 209.67.61.254 with SMTP; 20 Oct 2006 16:24:12 -0000 Date: Fri, 20 Oct 2006 19:23:43 +0300 From: Nikolay Pavlov To: Fabian Keil Message-ID: <20061020162343.GA27287@zone3000.net> Mail-Followup-To: Nikolay Pavlov , Fabian Keil , freebsd-security@freebsd.org References: <20061020140456.GA25717@zone3000.net> <20061020165706.367b0302@localhost> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20061020165706.367b0302@localhost> User-Agent: Mutt/1.4.2.1i X-Operating-System: FreeBSD 6.1-RELEASE-p10 Cc: freebsd-security@freebsd.org Subject: Re: Binding Squid to reserved port (was: mac_portacl) X-BeenThere: freebsd-security@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: "Security issues \[members-only posting\]" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 20 Oct 2006 16:24:14 -0000 On Friday, 20 October 2006 at 16:57:06 +0200, Fabian Keil wrote: > Nikolay Pavlov wrote: > > > I am trying to implement reverse proxy using squid with mac_portacl, > > but i have problem while binding squid to port 80. > > Am i missed something? > > > > Here is my mac_portacl variables: > > > > # sysctl security.mac.portacl. > > security.mac.portacl.enabled: 1 > > security.mac.portacl.suser_exempt: 1 > > security.mac.portacl.autoport_exempt: 1 > > security.mac.portacl.port_high: 1023 > > security.mac.portacl.rules: uid:100:tcp:80 > > > > And squid user info: > > > > # grep squid /etc/passwd > > squid:*:100:100:squid caching-proxy pseudo > > user:/usr/local/squid:/usr/sbin/nologin > > > > Also here is cache.log: > > > > 2006/10/20 09:55:59| Starting Squid Cache version 2.5.STABLE14 for > > i386-portbld-freebsd6.1... > > 2006/10/20 09:55:59| Process ID 6584 > > 2006/10/20 09:55:59| With 11072 file descriptors available > > 2006/10/20 09:55:59| DNS Socket created at 0.0.0.0, port 59879, FD 5 > > 2006/10/20 09:55:59| Adding nameserver 206.53.60.10 from > > /etc/resolv.conf > > 2006/10/20 09:55:59| User-Agent logging is disabled. > > 2006/10/20 09:55:59| Unlinkd pipe opened on FD 10 > > 2006/10/20 09:55:59| Swap maxSize 102400000 KB, estimated 7876923 > > objects > > 2006/10/20 09:55:59| Target number of buckets: 393846 > > 2006/10/20 09:55:59| Using 524288 Store buckets > > 2006/10/20 09:55:59| Max Mem size: 1048576 KB > > 2006/10/20 09:55:59| Max Swap size: 102400000 KB > > 2006/10/20 09:55:59| Rebuilding storage in /cache (DIRTY) > > 2006/10/20 09:55:59| Using Least Load store dir selection > > 2006/10/20 09:55:59| Set Current Directory to /usr/local/squid/cache > > 2006/10/20 09:55:59| Loaded Icons. > > 2006/10/20 09:55:59| commBind: Cannot bind socket FD 12 to *:80: (13) > > Permission denied > > FATAL: Cannot open HTTP Port > > Squid Cache (Version 2.5.STABLE14): Terminated abnormally. > > CPU Usage: 0.035 seconds = 0.000 user + 0.035 sys > > Maximum Resident Size: 9528 KB > > Page faults with physical i/o: 0 > > I assume you aren't starting Squid with root privileges? > > If you aren't, you'll have to lower: > net.inet.ip.portrange.reservedhigh if you want > it to bind to port 80. > > I don't use mac_portacl, but from the name I assume > security.mac.portacl.port_high does something similar. > > Port redirection with your packet filter of choice > would be another option. Yes. I am aware of this, but want something simple, as portacl. I am configuring it like described in handbook, and curious why it's not working. According to man security.mac.portacl.port_high is: "The highest port number mac_portacl will enforce rules for." So my mac rules should work, but not working :) > > Followup-To: freebsd-questions@freebsd.org set. > > Fabian > -- > http://www.fabiankeil.de/ -- ====================================================================== - Best regards, Nikolay Pavlov. <<<----------------------------------- ======================================================================