Date: Fri, 20 Oct 2006 20:09:32 +0300 From: Nikolay Pavlov <quetzal@zone3000.net> To: mal content <artifact.one@googlemail.com> Cc: freebsd-security@freebsd.org, Fabian Keil <freebsd-listen@fabiankeil.de> Subject: Re: Binding Squid to reserved port (was: mac_portacl) Message-ID: <20061020170932.GA28347@zone3000.net> In-Reply-To: <8e96a0b90610200938j21dab6d6h42b64e2193504eee@mail.gmail.com> References: <20061020140456.GA25717@zone3000.net> <20061020165706.367b0302@localhost> <20061020162343.GA27287@zone3000.net> <8e96a0b90610200938j21dab6d6h42b64e2193504eee@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
On Friday, 20 October 2006 at 17:38:59 +0100, mal content wrote: > On 20/10/06, Nikolay Pavlov <quetzal@zone3000.net> wrote: > >On Friday, 20 October 2006 at 16:57:06 +0200, Fabian Keil wrote: > >> Nikolay Pavlov <quetzal@zone3000.net> wrote: > >> > >> > I am trying to implement reverse proxy using squid with mac_portacl, > >> > but i have problem while binding squid to port 80. > >> > Am i missed something? > >> > > >> > Here is my mac_portacl variables: > >> > > >> > # sysctl security.mac.portacl. > >> > security.mac.portacl.enabled: 1 > >> > security.mac.portacl.suser_exempt: 1 > >> > security.mac.portacl.autoport_exempt: 1 > >> > security.mac.portacl.port_high: 1023 > >> > security.mac.portacl.rules: uid:100:tcp:80 > >> > > > The mac_portacl page in the handbook says that you need to disable normal > UNIX bind restrictions on ports. Have you tried this: > > # sysctl net.inet.ip.portrange.reservedlow=0 > # sysctl net.inet.ip.portrange.reservedhigh=0 > > MC Oh.. Man sure it works. Thank you. How i've missed this in man: In order to enable the mac_portacl policy, MAC policy must be enforced on sockets (see mac(4)), and the port(s) protected by mac_portacl must not be included in the range specified by the net.inet.ip.portrange.reservedlow and net.inet.ip.portrange.reservedhigh sysctl(8) MIBs. -- ====================================================================== - Best regards, Nikolay Pavlov. <<<----------------------------------- ======================================================================
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20061020170932.GA28347>