using sudo with ExecStart (systemd)

Question

I am trying to get a node.js site live on port 80 (I am using Digital Ocean). I doing this using systemd with in service file

...
ExecStart=/usr/bin/nodejs /var/www/bin/app.js
...

On localhost this works fine on port 80 if I use sudo to start the site, but not without sudo. Apparently you need to run as root for ports below 1024.

How do I allow sudo in the ExecStart? Or am I going completely the wrong way here and if so, how do I get the express app on port 80?

Cheers, Mike

nassan · Accepted Answer · 2018-11-29 10:56:07Z

27

Systemd starts the executable stated in ExecStart= as root by default.

However, if you have specified User= or Group= in your service file overriding that default, and still need to run an executable that requires sudo, prepend the command with the absolute path to your sudo location:

...
ExecStart=/usr/bin/sudo /usr/bin/nodejs /var/www/bin/app.js
...

answered Nov 29, 2018 at 10:56

nassan

7467 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

seraph Oct 30 at 11:52

This results in Unable to locate executable '/usr/bin/sudo': Permission denied on Bluefin

Umut · Accepted Answer · 2016-05-01 17:44:41Z

8

Systemd starts the executable stated in ExecStart= as root by default. This means if you haven't specified User= or Group= in our service file, your binary is started privileged.

You can verify this by starting id, or whoami program. Ex: ExecStart=/usr/bin/id or ExecStart=/usr/bin/whoami (note the path for the programs might be different for you)

answered May 1, 2016 at 17:44

Umut

2,5873 gold badges22 silver badges20 bronze badges

4 Comments

Mike Over a year ago

I have indeed specified a Group (non-root), but I would like to keep it that way as it is good practice not to run websites as root. How can I work around my problem?

Umut Over a year ago

You need to have a .socket unit for the port which listens on it as privileged user. Then systemd passes your service the socket. It needs code modifications on nodejs to make it systemd socket activation though.

Mike Over a year ago

I tried require('systemd'); var port = process.env.LISTEN_PID > 0 ? 'systemd' : 3050; app.set('port', port); but no luck so far.

Mike Over a year ago

in the end I used sudo setcap cap_net_bind_service=+ep /usr/bin/nodejs to allow nodejs to publish on ports below 1024

Collectives™ on Stack Overflow

using sudo with ExecStart (systemd)

2 Answers 2

1 Comment

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related