Re: Binding Squid to reserved port (was: mac_portacl)

On 20/10/06, Nikolay Pavlov <quetzal@xxxxxxxxxxxx> wrote:
On Friday, 20 October 2006 at 16:57:06 +0200, Fabian Keil wrote:
> Nikolay Pavlov <quetzal@xxxxxxxxxxxx> wrote:
>
> > I am trying to implement reverse proxy using squid with mac_portacl,
> > but i have problem while binding squid to port 80.
> > Am i missed something?
> >
> > Here is my mac_portacl variables:
> >
> > # sysctl security.mac.portacl.
> > security.mac.portacl.enabled: 1
> > security.mac.portacl.suser_exempt: 1
> > security.mac.portacl.autoport_exempt: 1
> > security.mac.portacl.port_high: 1023
> > security.mac.portacl.rules: uid:100:tcp:80
> >

The mac_portacl page in the handbook says that you need to disable normal
UNIX bind restrictions on ports. Have you tried this:

# sysctl net.inet.ip.portrange.reservedlow=0
# sysctl net.inet.ip.portrange.reservedhigh=0

MC
_______________________________________________
freebsd-security@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-security
To unsubscribe, send any mail to "freebsd-security-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Binding Squid to reserved port (was: mac_portacl)
    ... but i have problem while binding squid to port 80. ... # sysctl security.mac.portacl. ... FATAL: Cannot open HTTP Port ...
    (FreeBSD-Security)
  • mac_portacl
    ... I am trying to implement reverse proxy using squid with mac_portacl, ... but i have problem while binding squid to port 80. ... FATAL: Cannot open HTTP Port ...
    (FreeBSD-Security)
  • transparent Squid + pf
    ... I am trying Transparent Squid with FreeBSD 6.2. ... rdr on $ext_if proto tcp from any to any port 80 -> ... packets going out through $ext_if with source ...
    (freebsd-questions)
  • FreeBSD Ports Security Advisory FreeBSD-SA-02:12.squid
    ... The Squid Internet Object Cache is a web proxy/cache. ... The FreeBSD port does not normally include this code, ... correction date, ...
    (FreeBSD-Security)
  • Re: My customers are going back to NT if I cant get this fixed!!!
    ... I allow some domains to just pass through without using the squid, ... acl specific-site dstdomain .specific-site.com ... > its authentication information over port 4000. ... Everything I'm reading tells me that this communication ...
    (comp.os.linux.security)