Take the 2-minute tour ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I want to run a web server on my Mac as a non-root process. Normally only root processes can bind to port 80 (or to any port below 1024).

Can I open port 80 specifically so that non-root processes can listen on it?

share|improve this question
    
Related: link1, link2 –  Nathan Farrington Jan 21 '12 at 7:34

3 Answers 3

up vote 15 down vote accepted

This is difficult to do by design, and unless you have root access to your machine none of the following will work as they require root to setup the changes. Once changed, though, userspace programs will have access without having root.

There are two common ways to accomplish this, and which you choose will depend on why you're trying to work around the restriction:

Point port 80 to another port, such as 8080

By reconfiguring your machine to pass all port 80 traffic to port 8080, or any port of your choosing, then you can allow user space servers to receive root privilege ports in the area they are given access to.

The process is straightforward:

Step 1: View current firewall rules.

sudo ipfw show

Step 2: Add port forwarding rule (80 to 8080)

sudo ipfw add 100 fwd 127.0.0.1,8080 tcp from any to any 80 in

If you want to remove your firewall rules run:

sudo ipfw flush

(source)

This is a temporary change, and will revert once you reboot, or flush as indicated int he last line.

You can make the change permanent, or you could add the command as a startup line prior to starting your server, which is probably safer from the standpoint of security.

Use Authbind

Authbind was designed specifically to allow one program access to lower level ports without giving it full root access.

There is an OS X port:

https://github.com/Castaglia/MacOSX-authbind

It may still be limited to IPv4 traffic, though, you may have to do some additional investigation to find if it meets your needs.

share|improve this answer
    
LOVE MacOSX-authbind... It lets you run, for example, a web server on port 80 - as a "regular Administrator". i.e. in your launchd .plist... ` "ProgramArguments": [ "path/to/authbind", "/usr/bin/php", "-c", "/www/.router.ini", "-S", "0.0.0.0:80", "-t", "/www", "/www/.router.php"] Woohoo! –  alex gray May 27 at 18:22
    
OS X Yosemite removes ipfw. This gist describes an alternative solution using pf. –  lyschoening Oct 17 at 14:31

You can use ncat to forward traffic from a web server running on some other port:

sudo ncat -l -p 80 -c ' ncat -l -p 1234'

This will forward traffic on port 80 to localhost:1234. This is a bit of a kludge however, I wouldn't use it anywhere beyond quick testing and definitely not in production.

Note that this won't allow a non-root process to bind to it, but by picking a port the process can bind to, 1234 in this example, it will look like it is bound to port 80. This is doing the equivalent of forwarding port 80 to port 1234 with a firewall, but on a far more temporary basis.

share|improve this answer
1  
This is a good workaround. NB. ncat comes with nmap which can be installed via Mac Ports with sudo port install nmap. MacPorts itself can be installed from macports.org/install.php. –  William Denniss Dec 19 '13 at 6:03

What you should be able to do is open port 80 on your router and point it to the local IP address of your web server. Then on your Mac, enable Web Sharing from the System Preferences>Sharing preference pane and point it to the directory of your choosing. This has worked for me in the past until switched over to 10.6 Server.

share|improve this answer
    
I'm looking for this as a solution for my own dev machine. Since I have to work at places where I don't have control over the router, this solution could not work for me. I suspect it should work if you're setting up a server and for some reason do not have root access. –  Avner Jan 18 '12 at 22:55
    
So, just to be clear, you're trying to set up a web server at different client sites, but don't have the access to open port 80? How will you get the port open on the router if you don't have access? Am I understanding correctly or am I way off base? –  Matt Love Jan 18 '12 at 23:01
    
I'm just trying to use port 80 on my own development machine not on a production server. I deploy on heroku anyway. –  Avner Jan 18 '12 at 23:07

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.