Admin Console fails to load with 'Permission denied' binding to port 80

Products

• DX Unified Infrastructure Management (Nimsoft / UIM)

Issue/Introduction

After updating Nimbus to run as a non-root user on the UIM Server, the Admin Console no longer loads and instead displays the browser error: "This site can’t be reached."

The wasp probe fails to start or stays in a red/stopped state.

The wasp.log contains the following error sequence:

ERROR [main, org.apache.catalina.util.LifecycleBase] handleSubClassException() Failed to initialize component [Connector["http-nio-80"]]
ERROR [main, org.apache.catalina.util.LifecycleBase] org.apache.catalina.LifecycleException: Protocol handler initialization failed
Caused by: java.net.BindException: Permission denied

Environment

Product: DX Unified Infrastructure Management (UIM)
Version: 20.4, 23.4+
OS: Linux / Unix
Probe: wasp

Cause

On Linux and Unix-based operating systems, ports below 1024 (such as port 80 or 443) are considered privileged ports. By default, only the root user has permission to bind a service to these ports. If the Nimbus service is configured to run as a non-root user (e.g., uim), the wasp probe will fail to initialize the HTTP connector on port 80, resulting in a Permission denied bind exception.

Resolution

Option 1: Revert Nimbus service user to root 

1. Log in to the Primary Hub server as root.
2. Stop the Nimbus service: /etc/init.d/nimbus stop.
3. Verify the ownership of the UIM directory is correct.
4. Restart the Nimbus service as the root user.

Option 2: Change the wasp HTTP port to a non-privileged port

1. Open Infrastructure Manager or Admin Console.
2. Locate the wasp probe on the Primary Hub.
3. Open Raw Configure for the wasp probe.
4. Navigate to the setup section.
5. Change the value of http_port from 80 to a port above 1024 (e.g., 8080).
6. Click OK to restart the probe.
7. Access the Admin Console using the new port (e.g., http://<hub_ip>:8080/adminconsoleapp).

Option 3: Grant capabilities to the Java binary 

1. Work with your Linux Administrator to use the setcap command to allow the Java binary used by UIM to bind to privileged ports without root access: setcap 'cap_net_bind_service=+ep' /path/to/uim/jre/bin/java
2. Restart the Nimbus service.