Homebridge-config-ui-x: Can't access to the UI on the 80 tcp port

[topiga]

Describe Your Problem:
I can't access to the UI on the 80 tcp port, and I already configured my Homebridge in init.d. What can I do to have my UI below a 1024 port, in init.d ?

Logs:

Homebridge.log

[2019-8-3 12:08:50 PM] Homebridge is running on port 51826.
[2019-8-3 12:08:56 PM] Got SIGTERM, shutting down Homebridge...
[2019-8-3 12:20:21 PM] Loaded config.json with 1 accessories and 1 platforms.
[2019-8-3 12:20:21 PM] ---
[2019-8-3 12:20:21 PM] Loaded plugin: homebridge-config-ui-x
[2019-8-3 12:20:21 PM] Registering platform 'homebridge-config-ui-x.config'
[2019-8-3 12:20:21 PM] ---
[2019-8-3 12:20:21 PM] Loaded plugin: homebridge-raspberrypi-temperature
[2019-8-3 12:20:21 PM] Registering accessory 'homebridge-raspberrypi-temperature.RaspberryPiTemperature'
[2019-8-3 12:20:21 PM] ---
[2019-8-3 12:20:21 PM] Loading 1 platforms...
[2019-8-3 12:20:21 PM] [Config] Initializing config platform...
[2019-8-3 12:20:21 PM] [Config] Spawning homebridge-config-ui-x with PID 2645
[2019-8-3 12:20:21 PM] Loading 1 accessories...
[2019-8-3 12:20:21 PM] [RaspberryPi CPU Temperature] Initializing RaspberryPiTemperature accessory...
Setup Payload:
X-HM://0023SNU9E11HG
Scan this code with your HomeKit app on your iOS device to pair with Homebridge:
Or enter this code with your HomeKit app on your iOS device to pair with Homebridge

    ┌────────────┐
    │ XXX-XX-XXX │
    └────────────┘

[2019-8-3 12:20:22 PM] Homebridge is running on port 51826.
[2019-8-3 12:20:27 PM] Got SIGTERM, shutting down Homebridge...

Homebridge.err

[2019-8-3 12:20:27 PM] ^[[36m[homebridge-config-ui-x]^[[0m ^[[31mError: listen EACCES: permission denied :::80^[[0m
[2019-8-3 12:20:27 PM] ^[[36m[homebridge-config-ui-x]^[[0m ^[[31mThe process owner does not have permission to run services on port 80. Please change the homebridge-config-ui-x port to something above 1024.

Homebridge Config:

{
    "bridge": {
        "name": "Homebridge",
        "username": "XX:XX:XX:XX:XX:XX",
        "port": 51826,
        "pin": "XXX-XX-XXX"
    },
    "description": "Ce Homebridge est à jour sur un RPi 3, afin d'utiliser tout les appareils connectés sur HomeKit, l'interface de domotique de Apple.",
    "ports": {
        "start": 52100,
        "end": 52150,
        "comment": "This section is used to control the range of ports that separate accessory (like camera or television) should be bind to."
    },
    "accessories": [
        {
            "accessory": "RaspberryPiTemperature",
            "name": "RaspberryPi CPU Temperature"
        }
    ],
    "platforms": [
        {
            "name": "Config",
            "port": 80,
            "auth": "form",
            "theme": "dark-mode",
            "tempUnits": "c",
            "sudo": true,
            "log": {
                "method": "file",
                "path": "/var/log/homebridge.log"
            },
            "platform": "config"
        }
    ]
}

Environment:

• Node.js Version: v10.16.1
• NPM Version: 6.9.0
• Homebridge Version: 0.4.50
• Homebridge Config UI X Version: 4.5.1
• Operating System: Raspbian
• Process Supervisor: init.d

[oznu]

Hi @pwn4dfra,

I'm not sure about init.d, but if you switch to systemd as per the guide in the wiki, that configuration will allow you to bind on ports lower than 1024 as it runs Homebridge with the CAP_NET_BIND_SERVICE flag.

https://github.com/oznu/homebridge-config-ui-x/wiki/Homebridge-&-Systemd-(Raspbian,-Ubuntu,-Debian)

CAP_NET_BIND_SERVICE
Bind a socket to Internet domain privileged ports (port numbers less than 1024).

[topiga]

Hi @oznu,

Thank you for this quick reply. I know about systemd, the problem is that I don't want to run Homebridge as root for security reasons. In init.d, I don't run Homebridge as a root user. I am searching for an alternative, and I was asking if anyone knows an alternative for init.d, like giving a special authorization for nodejs, but I don't know where to find that.

[oznu]

The systemd guide in the wiki sets up homebridge to run as its own service user, not root, it just requests systemd to grant extra permissions to the process to allow it to bind to ports below 1024.

Systemd config:

cat >/etc/systemd/system/homebridge.service <<EOL
[Unit]
Description=Homebridge
After=syslog.target network-online.target

[Service]
Type=simple
User=homebridge
EnvironmentFile=/etc/default/homebridge
ExecStart=$(which homebridge) \$HOMEBRIDGE_OPTS
Restart=on-failure
RestartSec=3
KillMode=process
CapabilityBoundingSet=CAP_IPC_LOCK CAP_NET_ADMIN CAP_NET_BIND_SERVICE CAP_NET_RAW CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_CHOWN CAP_FOWNER CAP_DAC_OVERRIDE CAP_AUDIT_WRITE CAP_SYS_ADMIN
AmbientCapabilities=CAP_NET_RAW

[Install]
WantedBy=multi-user.target
EOL

Note the "User=homebridge" line.

[topiga]

Okayyyyyy ! I'm going to modify it a bit and I'll tell you what I did. Thanks !

[oznu]

Sorry I can't help with init.d - I haven't touched it in years 😄.

[topiga]

That's cool don't worry, I'm switching to systemd

[topiga]

I got it working ! I may do an install.sh file to have an automated installation file with/without systemd, with a custom port etc

[ctcampbell]

In Feb 2020 on Raspbian (Linux pi4 4.19.66-v7l+ #1253 SMP Thu Aug 15 12:02:08 BST 2019 armv7l GNU/Linux) this doesn't appear to work.

https://stackoverflow.com/questions/38321220/script-with-cap-net-bind-service-cant-listen-on-port-80

[abrahamduran]

Hey @oznu, do you think anything changed? I can't access when using port 80.

[jasonkarns]

Are there directions for getting the UI onto port 80 on macOS? I've installed using hb-service as instructed. I've attempted with both config.json set to use port 80 (for the UI), and specifying --port to the hb-service install command. Still getting EACCESS errors in my hb-service logs output.

I've read through the systemd guides on the wiki, but those seem to only apply to *nix. I presume hb-service doesn't use systemd on macOS? I also took a gander in my launchctl services, but didn't find any (I just grepped for 'bridge') nor did I find any homebridge LaunchAgents in my ~/Library...

[rubenstolk]

On your Raspberry PI you can run sudo setcap CAP_NET_BIND_SERVICE=+eip /usr/bin/node. Please note impact of degraded security.