Option to drop privileges after binding to port 53? about acme-dns

[joohoi]

Building this in acme-dns would make it very much tied to the underlying operating system.

Acme-dns however allows you to configure the port used for DNS, so you can bind it to an unprivileged port and use iptables rules to handle the portforwarding using the PREROUTING chain, for example:

-A PREROUTING -i eth0 -p udp -m udp --dport 53 -j REDIRECT --to-ports 5353

to forward public port 53 to unprivileged port 5353. Or do this directly from the edge firewall, depending of your infrastructure of course. This will allow you to run acme-dns as an unprivileged user.

[Daniel15]

Thanks. I ended up just granting the CAP_NET_BIND_SERVICE capability to the executable to allow it to bind to ports below 1024:

setcap 'cap_net_bind_service=+ep' /usr/local/bin/acme-dns