topic root account to configure SAS in Redhat server in Administration and Deployment

root account to configure SAS in Redhat server

ranjan_gandhi — Fri, 22 May 2020 05:05:40 GMT

Hi Guys,

We are trying to configure SAS using the document LINK.

In that document i can see below notes, please help me to understand did this applicable for REDHAT also.

"Note: Be aware that on UNIX platforms, you must start SAS Web Server as root in order to listen on ports below 1024."

Thanks

Ranjan

Re: root account to configure SAS in Redhat server

Kurt_Bremser — Fri, 22 May 2020 06:28:08 GMT

On UNIX systems, IP ports with a number below 1024 are "privileged" ports, and only processes run by the superuser may listen on them. So if you want to configure the SAS web server to also service the "standard" ports 80 (http) and 443 (https), it must be started as root.

I have two web server instances running:

the SAS web server as-is out of the box, listening on port 7980, started from the SAS installation user
a simplified configuration, using the same binaries, started as root to handle the "main" ports, redirecting SAS-related requests to 7980

Re: root account to configure SAS in Redhat server

JuanS_OCS — Sat, 23 May 2020 20:42:26 GMT

Hi Ranjan,

yes, it is applicable for all UNIX and Linux systems, included RHEL. The operating system will protect, as best practice, all ports from 0 to 1024 from being opened by non-root users.

You have some options:

* you can create an exception to this rule, at OS level, although not recommended
* You can indeed modify the sas.servers and sas.servers.mid scripts to start web server as root (or sudo if sasinst is in the sudo whitelist)
* You can use an external Web Server (IIS, Apache, the SAS Websetver as proposed above...) and configure SAS to use it. The external web server can listen in 89 or 443, then leave the SAS one listening on default port 7980.

To be honest, I recommend you to look up on the SAS documentation, the SAS Middle-tier Administration guide, for the Configuring SAS to use an external Reverse Proxy, which is the 3rd option in my bullet list, as best practice.