Provisioning Server balancers fail to start with Permission denied error on port 443 after Identity Manager migration.
Article ID: 450009
Updated On:
Products
Issue/Introduction
After upgrading to Identity Manager 15.0.1, Provisioning Server balancers fail to start. The logs indicate a socket binding failure due to insufficient permissions for privileged ports.
[NOTICE] (33959) : haproxy version is 3.2.18-99697c190
[NOTICE] (33959) : path to executable is /opt/brcm/iga/conda/envs/main/bin/haproxy
[ALERT] (33959) : Binding [/opt/brcm/iga/run/balancer/balancer.cfg:22] for frontend ft_iga: protocol tcpv6: cannot bind socket (Permission denied) for [:::443].
[ALERT] (33959) : [haproxy.main()] Some protocols failed to start their listeners! Exiting.
Environment
Identity Manager 15.X
Cause
Linux operating systems restrict non-root users from binding to privileged ports (any port below 1024). Since the Identity Manager environment runs HAProxy as a non-privileged user, the OS denies the request to bind to port 443.
Resolution
Grant the HAProxy binary the necessary Linux capabilities to bind to privileged ports or modify the configuration to use a non-privileged port.
- Log in to the affected node as a user with root or sudo privileges.
- Grant the
cap_net_bind_servicecapability to the HAProxy binary:setcap 'cap_net_bind_service=+ep' /opt/brcm/iga/conda/envs/main/bin/haproxy - Verify that the capability is correctly applied:
getcap /opt/brcm/iga/conda/envs/main/bin/haproxy - Confirm the output displays:
/opt/brcm/iga/conda/envs/main/bin/haproxy cap_net_bind_service=ep - Restart the balancer service.
If security policies prohibit the use of setcap, perform the following steps:
In IGX Xpress console - Services - Balancer consider changing "Port Number" to value above 1024.
In additional make sure that mount where application is installed (by default /opt/brcm/) does not have nosuid flag.
Feedback
