Best practices when running Node.js with port 80 (Ubuntu) in Linux

Running Node.js applications on port 80 is a common requirement for web servers, but it presents security challenges on Linux systems. Port 80 is a privileged port that requires root access to bind to, creating potential security vulnerabilities when applications run with elevated privileges.

The Root Privilege Problem

Most Linux distributions require root privileges to bind to ports below 1024, including port 80. The naive approach is to run the application with superuser privileges:

sudo node server.js

While this solves the immediate problem, it creates significant security risks. If an attacker compromises your Node.js application, they gain root access to the entire system. This violates the principle of least privilege and is considered a major security anti-pattern.

Best Practice: Drop Privileges After Binding

The recommended approach is to start with root privileges to bind to port 80, then immediately drop to a less privileged user. Node.js provides two methods for this:

• setgid() − Changes the group ID of the process

• setuid() − Changes the user ID of the process

Implementation Example

const http = require('http');

function dropRootPrivileges() {
    // Drop to a specific non-root user
    process.setgid('nodejs');  // Change to nodejs group
    process.setuid('nodejs');  // Change to nodejs user
}

const server = http.createServer((req, res) => {
    res.writeHead(200, { 'Content-Type': 'text/plain' });
    res.end('Server running securely on port 80!');
});

server.listen(80, () => {
    console.log('Bound to port 80 as:', process.getuid(), process.getgid());
    
    // Drop privileges immediately after binding
    dropRootPrivileges();
    
    console.log('Dropped to user:', process.getuid(), process.getgid());
    console.log('Server listening on port 80');
});

Alternative Approaches

System Setup Requirements

Before using the privilege-dropping approach, create a dedicated user account:

# Create nodejs user and group
sudo adduser --system --group nodejs

# Ensure proper permissions for your application files
sudo chown -R nodejs:nodejs /path/to/your/app

Conclusion

Never run Node.js applications as root for the entire session when binding to port 80. Use the setuid/setgid approach to drop privileges immediately after binding, or better yet, use a reverse proxy setup. This ensures your application remains secure while still serving on the standard HTTP port.