Icecast - Feb 2015 - icecast and proxy

On 02/25/2015 11:07 AM, Rafael Gomes wrote:
> I use iptables to either redirect the port packages
>
> iptables -A PREROUTING -t nat -p tcp -d 192.168.2.32 --dport 80 -j 
> REDIRECT --to-port 8000
I do NOT recommend this. This tends to break in obscure ways, just as
reverse-proxies.
Icecast will happily listen on port 80 directly.

There are people who claim that it isn't possible, but that's because
they aren't capable to reverse the distro packaging breakage.
All it takes is to start the process as root and use the <changeowner>
directive to pass the information to which user to pivot after claiming
the privileged port.


Cheers

Thomas

OK!

I made this solution because it is not suitable
to run as root applications that use ports below 1000


Em 2015-02-25 08:18, Thomas B. R?cker escreveu:
> On 02/25/2015 11:07 AM, Rafael Gomes wrote:
>> I use iptables to either redirect the port packages
>> 
>> iptables -A PREROUTING -t nat -p tcp -d 192.168.2.32 --dport 80 -j
>> REDIRECT --to-port 8000
> I do NOT recommend this. This tends to break in obscure ways, just as
> reverse-proxies.
> Icecast will happily listen on port 80 directly.
> 
> There are people who claim that it isn't possible, but that's
because
> they aren't capable to reverse the distro packaging breakage.
> All it takes is to start the process as root and use the
<changeowner>
> directive to pass the information to which user to pivot after claiming
> the privileged port.
> 
> 
> Cheers
> 
> Thomas
> _______________________________________________
> Icecast mailing list
> Icecast at xiph.org
> http://lists.xiph.org/mailman/listinfo/icecast

On 02/25/2015 11:28 AM, Rafael Gomes wrote:
> OK!
>
> I made this solution because it is not suitable
> to run as root applications that use ports below 1000
Did you read my statement?
I address exactly this misconception.

As this seems to mostly happen to people who run Debian or its
derivatives, here are the #exactsteps to make Icecast listen to port 80
and as a bonus advertize this properly on YP without breaking:

* edit two lines in /etc/default/icecast2:
USERID=root
GROUPID=root
* edit the following lines in /etc/icecast2/icecast.xml:
 - this must be the *first* <listen-socket> entry:
    <listen-socket>
        <port>80</port>
    <listen-socket>
 - in the security section:
        <changeowner>
            <user>icecast2</user>
            <group>icecast</group>
        </changeowner>
 - for yp listings, make sure <hostname> resolves to your Icecast server
(not your homepage!) and remove the <!-- --> around the <directory>
section.
* start Icecast through its init script / systemd

What this does:
Instead of changing the user in the init script, it gets changed during
start-up. At no point will Icecast actually keep running as root, it
only uses this to bind to privileged ports, <1024.
It _starts_ as "root", but _runs_ as "icecast2", just as
*every* other
service binding to a port below 1024 does too, e.g. Apache HTTPD or NginX.
Security wise this is almost identical, BUT it enables Icecast to bind
to port 80 (and 443 too if you'd enable SSL support, but on debian that
would mean recompiling Icecast).

What this avoids:
We see hundreds of servers trying to list on YP that claim to be
"localhost" or to be listening on port 8000 while they are only
reachable on port 80 or some other port. All these radio streams are
automatically rejected from the YP directory at http://dir.xiph.org as
unreachable.
Also there are some other cases where Icecast will either use the first
listener port or the hostname and this will break a port redirect or a
reverse proxy setup.

Cheers

Thomas