Coturn: After update of coturn can not connect to 443

[marcelrouw]

Hi,

After I updated my Coturn server on AWS from version 4.5.0.7-1+b1 to 4.5.1.0-1~bpo9+1 I get error on connection to port 443. I used the Debian Stretch backports for the installation of Coturn. If I remove alt-listening-port=443 from the config file. It seems to work correctly.

0: log file opened: /var/log/turn/turn_2019-07-29.log
0: pid file created: /run/turnserver/turnserver.pid
0: IO method (main listener thread): epoll (with changelist)
0: Wait for relay ports initialization...
0:   relay 10.0.1.125 initialization...
0:   relay 10.0.1.125 initialization done
0:   relay ::1 initialization...
0:   relay ::1 initialization done
0: Relay ports initialization done
0: IO method (general relay thread): epoll (with changelist)
0: turn server id=0 created
0: IPv4. TLS/SCTP listener opened on : 127.0.0.1:3478
0: IPv4. TLS/TCP listener opened on : 127.0.0.1:3478
0: IPv4. TLS/SCTP listener opened on : 127.0.0.1:3479
0: IPv4. TLS/TCP listener opened on : 127.0.0.1:3479
0: Trying to bind fd 16 to <127.0.0.1:443>: errno=13
0: Cannot bind TLS/TCP listener socket to addr 127.0.0.1:443
0: Trying to bind TLS/TCP listener socket to addr 127.0.0.1:443, again...
0: IO method (general relay thread): epoll (with changelist)
0: turn server id=1 created
0: IPv4. TLS/TCP listener opened on : 127.0.0.1:3478
0: IPv4. DTLS/UDP listener opened on: 127.0.0.1:3478
0: IPv4. TLS/TCP listener opened on : 127.0.0.1:3479
0: Trying to bind fd 25 to <127.0.0.1:443>: errno=13
0: IPv4. DTLS/UDP listener opened on: 127.0.0.1:3479
0: Cannot bind TLS/TCP listener socket to addr 127.0.0.1:443
0: Trying to bind TLS/TCP listener socket to addr 127.0.0.1:443, again...
0: Trying to bind fd 28 to <127.0.0.1:443>: errno=13
0: Cannot bind DTLS/UDP listener socket to addr 127.0.0.1:443
0: Trying to bind DTLS/UDP listener socket to addr 127.0.0.1:443, again...
0: Trying to bind fd 16 to <127.0.0.1:443>: errno=13
0: Cannot bind TLS/TCP listener socket to addr 127.0.0.1:443
0: Trying to bind TLS/TCP listener socket to addr 127.0.0.1:443, again...
0: Trying to bind fd 25 to <127.0.0.1:443>: errno=13
0: Cannot bind TLS/TCP listener socket to addr 127.0.0.1:443
0: Trying to bind TLS/TCP listener socket to addr 127.0.0.1:443, again...
0: Trying to bind fd 28 to <127.0.0.1:443>: errno=13
0: Cannot bind DTLS/UDP listener socket to addr 127.0.0.1:443
0: Trying to bind DTLS/UDP listener socket to addr 127.0.0.1:443, again...
0: Trying to bind fd 16 to <127.0.0.1:443>: errno=13
0: Cannot bind TLS/TCP listener socket to addr 127.0.0.1:443
0: Trying to bind TLS/TCP listener socket to addr 127.0.0.1:443, again...
0: Trying to bind fd 25 to <127.0.0.1:443>: errno=13
0: Cannot bind TLS/TCP listener socket to addr 127.0.0.1:443
0: Trying to bind TLS/TCP listener socket to addr 127.0.0.1:443, again...
0: Trying to bind fd 28 to <127.0.0.1:443>: errno=13
0: Cannot bind DTLS/UDP listener socket to addr 127.0.0.1:443

Is there still a way to directly connect to port 443 by Coturn or do I need to use something like iptables to fix this issue?

[bradleythughes]

I'm not sure if you noticed the errno=13 in the log you posted. This is EACCES, aka "Permission denied", which makes me wonder if the turnserver is not running as a privileged user (like root) that is allowed to bind to low ports. Perhaps something changed in the startup script as part of the upgrade?

[marcelrouw]

/etc/turnserver.conf for both servers the user and group set

proc-user=turnserver
proc-group=turnserver

The /etc/init.d/coturn seems to be the same for both servers. After a quick inspection by eye.

Only the new server has a /lib/systemd/system/coturn.service

[Unit]
Description=coTURN STUN/TURN Server
Documentation=man:coturn(1) man:turnadmin(1) man:turnserver(1)
After=network.target

[Service]
User=turnserver
Group=turnserver
Type=forking
RuntimeDirectory=turnserver
PIDFile=/run/turnserver/turnserver.pid
ExecStart=/usr/bin/turnserver --daemon -c /etc/turnserver.conf --pidfile /run/turnserver/turnserver.p
id
#FixMe: turnserver exit faster than it is finshing the setup and ready for handling the connection.
ExecStartPost=/bin/sleep 2
Restart=on-failure
InaccessibleDirectories=/home
PrivateTmp=yes

[Install]
WantedBy=multi-user.target

ps -ef new server:
turnser+ 14080 1 0 Jul29 ? 00:00:08 /usr/bin/turnserver --daemon -c /etc/turnserver.conf

ps -ef old server:
turnser+ 10654 1 0 Jul29 ? 00:00:45 /usr/bin/turnserver -c /etc/turnserver.conf -o -v

After removing the coturn systemd config everything seems to be in as it used to be

sudo rm /lib/systemd/system/coturn.service
sudo systemctl daemon-reload

Now the ps -ef on the new server looks exactly as on the old server.
I also had some issues with reading certificate files. This is also resolved.

So this issue seems to be in the systemd coturn.service going back to the init.d version resolved it for me.

[TimoHess]

sudo rm /lib/systemd/system/coturn.service
sudo systemctl daemon-reload

Thx. You saved my day.

[zhu]

Add AmbientCapabilities=CAP_NET_BIND_SERVICE to the [Service] section will solve this problem.

[pdarcos]

Thanks @zhu
That fixed it.

Cheers

[artooro]

In my case the turnserver user did not have access to the private key so the TLS listening port was not binding.
There were no errors logged by coturn even in verbose mode making this difficult to troubleshoot.