search

TechnitiumSoftware / DnsServer

Technitium DNS Server
https://technitium.com/dns/
GNU General Public License v3.0
3.83k stars 399 forks source link

Application runs as root on Linux #887

Open mstorck opened 3 months ago

mstorck commented 3 months ago

When installing the app via the install script, the application will run as root user.

If possible make the application run as a non-privileged user.

Wrong-Code commented 3 months ago

AFAIK you can run Technitium DNS as an unprivileged user of your choice, but you will have to give that user/group permissions on the Technitium DNS directories (/etc/dns and /opt/technitium/dns), plus you will have to change the configuration of the service (systemd or any other way you start it) by specifying the new uid/gid.

However, the above works as long as you open a non-standard DNS port whose value is above 1024. If you need to open the standard DNS port (53) you will have to give the dotnet executable the capability to open privileged ports. Something like:

sudo setcap CAP_NET_BIND_SERVICE=+eip $(realpath $(which dotnet))

Be aware that by doing that you will give the privilege to any .NET application running on the host, not just to Technitium DNS.

ShreyasZare commented 3 months ago

Thanks for the request. Will get the script updated in later releases.

mstorck commented 3 months ago

I can confirm that the tips provided by @Wrong-Code do work when manually applied, @ShreyasZare I'm willing to test pre-release versions of a new install script.