I want to run a web server on my Mac as a non-root process. Normally only root processes can bind to port 80 (or to any port below 1024).
Can I open port 80 specifically so that non-root processes can listen on it?
I want to run a web server on my Mac as a non-root process. Normally only root processes can bind to port 80 (or to any port below 1024).
Can I open port 80 specifically so that non-root processes can listen on it?
This is difficult to do by design, and unless you have root access to your machine none of the following will work as they require root to setup the changes. Once changed, though, userspace programs will have access without having root.
There are two common ways to accomplish this, and which you choose will depend on why you're trying to work around the restriction:
By reconfiguring your machine to pass all port 80 traffic to port 8080, or any port of your choosing, then you can allow user space servers to receive root privilege ports in the area they are given access to.
The process is straightforward:
Step 1: View current firewall rules.
sudo ipfw show
Step 2: Add port forwarding rule (80 to 8080)
sudo ipfw add 100 fwd 127.0.0.1,8080 tcp from any to any 80 in
If you want to remove your firewall rules run:
sudo ipfw flush
(source)
This is a temporary change, and will revert once you reboot, or flush as indicated int he last line.
You can make the change permanent, or you could add the command as a startup line prior to starting your server, which is probably safer from the standpoint of security.
Authbind was designed specifically to allow one program access to lower level ports without giving it full root access.
There is a MacOSX port:
https://github.com/Castaglia/MacOSX-authbind
It may still be limited to IPv4 traffic, though, so you may have to do some additional investigation to find if it meets your needs
launchd
.plist
... ` "ProgramArguments": [ "path/to/authbind", "/usr/bin/php", "-c", "/www/.router.ini", "-S", "0.0.0.0:80", "-t", "/www", "/www/.router.php"]
Woohoo!
May 27, 2014 at 18:22
ipfw
. This gist describes an alternative solution using pf
.
Oct 17, 2014 at 14:31
ipfw
is not available in current version of macOS and the gist for using pf
as an alternative was deleted. Therefore, as it stands, this answer is no as useful.
You can use ncat
to forward traffic from a web server running on some other port:
sudo ncat -l -p 80 -c ' ncat -l -p 1234'
This will forward traffic on port 80 to localhost:1234. This is a bit of a kludge however, I wouldn't use it anywhere beyond quick testing and definitely not in production.
Note that this won't allow a non-root process to bind to it, but by picking a port the process can bind to, 1234 in this example, it will look like it is bound to port 80. This is doing the equivalent of forwarding port 80 to port 1234 with a firewall, but on a far more temporary basis.
ncat
comes with nmap
which can be installed via Mac Ports with sudo port install nmap
. MacPorts itself can be installed from macports.org/install.php.
Dec 19, 2013 at 6:03
You can also use ssh to do port forwarding. So if you have a server running on 8080, you can forward traffic from port 80. Here is a script I use, which stops native apache if it's running and forwards traffic:
forward8080to80.command:
echo "You may close this terminal and the forwarding will continue."
echo "To stop, kill the ssh process found by `sudo lsof -i ':80' | grep LISTEN`"
sudo apachectl stop
sudo ssh [email protected] -L 80:127.0.0.1:8080
The setuid method is the only thing I found that works on OS X Catalina (10.15).
For example, to run npm run serve --port 80
effectively, you would run
sudo chmod u+s $(which npm)
.
As of macOS 14 (14.1 to be more specific, although this has been around for a few releases), you can use BSD's pf (packet filter) command, which is part of macOS (macOS is based on FreeBSD).
For example, to use port 80 and 443 by redirecting them locally to port 8080 and 8090 respectively, you can create a port-forwarding.conf
file with the following contents:
rdr pass on lo0 inet proto tcp from any to self port 80 -> 127.0.0.1 port 8080
rdr pass on lo0 inet proto tcp from any to self port 443 -> 127.0.0.1 port 8090
(Note that the lo0 is redirecting the localhost interface; you may have to alter that depending on your use case.)
Then you can apply those settings:
sudo pfctl -evf port-forwarding.conf
Now your program can bind to 8080 and 8090 instead of binding to 80 and 443, but traffic coming on the specified interface at 80 and 443 will be locally routed to the listeners on 8080 and 8090.
What you should be able to do is open port 80 on your router and point it to the local IP address of your web server. Then on your Mac, enable Web Sharing from the System Preferences>Sharing preference pane and point it to the directory of your choosing. This has worked for me in the past until switched over to 10.6 Server.