Explore information related to well known ports

Listen on Privileged Ports with Nagios Log Servers - How to set it up

This article covers how to configure Nagios Log Servers to listen on privileged ports. Now Nagios Log Server Administrators who would like configure Nagios Log Server to listen on ports below 1024 which are privileged in Linux. This can be useful if you have legacy devices that can only send on specific ports (e.g. syslog on port 514).

Ports below 1024 are privileged on Linux and only allow the root user to listen on them. 

This can be implemented via two solutions:

1. Run Logstash as root

2. Use setcap


To use Use setcap for Listening On Privileged Ports:

Here, you can use the logstash running as the nagios user but this method may be less secure in some environments as it will allow any Java process to listen on privileged ports.

i. The logstash init configuration file requires three lines to be added to the end of it, open the file with the following command:

On Debian | Ubuntu:

$ vi /etc/default/logstash

or

$ sudo /etc/default/logstash

2. Then, Add the following three lines to the end of the file:

echo $(dirname $(find /usr/lib -name libjli.so)) | awk '{print $1}'> /etc/ld.so.conf.d/java.conf

eval "$(which ldconfig)"

setcap 'cap_net_bind_service=+ep' $(readlink -f $(which java))

3. Save the file and close vi.

4. Restart Logstash Service

The logstash service needs to be restarted for these changes to apply:

$ sudo systemctl restart lagstash.service

Read More