Classnotes | UNIX03 | RecentChanges | Preferences We have been talking about running all services as some sort of non-priviledged user to reduce the damage that a compromised service can cause and increase the difficulty for a cracker to gain root access. However, one of the core security principles behind UNIX is that there are certain protected ports that can only be openned by root.
Every port under 1024 must be created by root. This means the web-server (port 80), the SMTP server (port 25), the POP server (ports 109 and 110), and the SSH server (port 22) all must be bound by root (see a list of common ports [here]).
So how do we get around this requirement?
The most common method is to start the daemon (or a master daemon of a particular service) with root permissions, and then suid into a non-priviledged user once the port is open. This procedure is usually automatic (at least, it is with any respectable server ;-) meaning that all you must do as administrator is ensure that a particular server is non-root once it's ready to accept connections.
This is actually one of the big problems with Sendmail. Sendmail dates from a time when the internet was quite young and there just weren't that many malicious users on it yet. Thus, Sendmail runs as root and is quite difficult to force into something else. For servers that have to run as root, it is generally a good idea to chroot them.
