<story><title>Dear Linux, Privileged Ports Must Die</title><url>https://ar.al/2022/08/30/dear-linux-privileged-ports-must-die/</url></story><parent_chain><item><author>antimeme</author><text>This article is nonsense.  Privileged ports are a security feature.  They have literally nothing to do with mainframes.  On multi-user systems, they&amp;#x27;re incredibly important because they give external clients confidence that the services provided on them are authorized by the system and not just by any user -- some of whom may not be as trustworthy as others.  Most systems in this era of cheap hardware are single user, BUT NOT ALL SYSTEMS.  It&amp;#x27;s fine for Windows and Mac OS to do without them and it&amp;#x27;s fine to configure your own Linux system to disable them if that&amp;#x27;s what you want, but it&amp;#x27;s completely insane to argue that they&amp;#x27;re a security flaw because some people work around them using insecure practices.  There are plenty of secure ways to work around them, most obviously by USING A NON-PRIVILEGED PORT.  Start your service on port 8080, for example, and give out a URL like &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;example.com:8080&amp;#x2F;path&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;example.com:8080&amp;#x2F;path&lt;/a&gt;.  It&amp;#x27;s really that simple.  Take the time to understand the actual purpose of a feature before urging others to abolish it.</text></item></parent_chain><comment><author>ttiurani</author><text>&amp;gt; Most systems in this era of cheap hardware are single user, BUT NOT ALL SYSTEMS&lt;p&gt;OP quite clearly argues that multi-user systems can still have the old behavior if they so choose with explicit configuration. OP makes an argument about what should be the sensible default in 2022, and who should do explicit configuration.&lt;p&gt;I think the point that nowadays easy single user linux configuration should be preferred over multi-user configurations is good.&lt;p&gt;IMO distros could make this easy by turning privileged ports into an (advanced) installation question. Then the clearly single-user-focused distros would default to 80, and the more server-oriented or conservative distros would default to the current behavior, but both could do which ever.&lt;p&gt;&amp;gt; Start your service on port 8080, for example.&lt;p&gt;In the era of Let&amp;#x27;s Encrypt, this is really about 80 and 443. The background for the OP is probably to host &amp;quot;normal&amp;quot; sites on single user hardware.&lt;p&gt;If you were to give out to non-technical users addresses like &amp;quot;&lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;example.org:8080&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;example.org:8080&lt;/a&gt;&amp;quot; which then transform into &amp;quot;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;example.org:8443&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;example.org:8443&lt;/a&gt;&amp;quot;, that&amp;#x27;s just horrible UX. Those kinds of numbers in the URL probably also look to many people like someone is trying to hack them. Furthermore addresses are also communicated word-of-mouth &amp;quot;go to example dot org&amp;quot;.&lt;p&gt;So no, using unprivileged ports is not an actual workaround for the use cases OP is referring to.</text></comment>
<story><title>Dear Linux, Privileged Ports Must Die</title><url>https://ar.al/2022/08/30/dear-linux-privileged-ports-must-die/</url></story><parent_chain><item><author>antimeme</author><text>This article is nonsense.  Privileged ports are a security feature.  They have literally nothing to do with mainframes.  On multi-user systems, they&amp;#x27;re incredibly important because they give external clients confidence that the services provided on them are authorized by the system and not just by any user -- some of whom may not be as trustworthy as others.  Most systems in this era of cheap hardware are single user, BUT NOT ALL SYSTEMS.  It&amp;#x27;s fine for Windows and Mac OS to do without them and it&amp;#x27;s fine to configure your own Linux system to disable them if that&amp;#x27;s what you want, but it&amp;#x27;s completely insane to argue that they&amp;#x27;re a security flaw because some people work around them using insecure practices.  There are plenty of secure ways to work around them, most obviously by USING A NON-PRIVILEGED PORT.  Start your service on port 8080, for example, and give out a URL like &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;example.com:8080&amp;#x2F;path&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;example.com:8080&amp;#x2F;path&lt;/a&gt;.  It&amp;#x27;s really that simple.  Take the time to understand the actual purpose of a feature before urging others to abolish it.</text></item></parent_chain><comment><author>foldr</author><text>This was covered in the article, albeit a little sarcastically:&lt;p&gt;&amp;gt;And for the three folks in Finland who administer multi-user Linux instances and rely on privileged ports for their mainframe-era security properties, they can always run sysctl and set their port limit to 1024 as it was before.&lt;p&gt;If you wanted to block non-root users binding certain ports, you&amp;#x27;d still be able to do so. It just doesn&amp;#x27;t make sense to have this as the default anymore, as it tends to cause more security issues that it prevents.</text></comment>