I asked this on "ask Ubuntu" and had much luck yet, so I thought I might try here as well https://askubuntu.com/questions/409660/dnscrypt-proxy-works-but-with-incorrect-permissions

I have successfully installed and find myself in the middle of configuring dnscrypt-proxy on ubuntu 13.10 x64. However, I am running into some issues with permissions in general.

I have added a user with the following commmand:

sudo adduser --system --quiet --home /run/dnscrypt --shell /bin/false --group --disabled-password --disabled-login dnscrypt

and issued dnscrypt-proxy --daemonize --user=dnscrypt but without success. So i tried just --daemonize and finally just dnscrypt-proxy which resulted in a UDP bind permission error. Ran it as root and the error goes away. dnscrypt-proxy --user=dnscrypt results in the error returning. I'm guessing its failing because of some permission, but don't have a clue where to start or what to change at this point.

also i would like to run this at network startup or after login. which i think i can manage, but if you have a suggestion it would just save me time. I don't understand why I can't run this as --user=dnscrypt but root works fine. (I mean, I understand why root works ;D)

edit: Just to clarify a little more, I'm actually running elementary OS luna 0.2, which is based on ubuntu 13.10 (I believe)


You need to create an init script that should use start-stop-daemon to drop the privileges.

The app probably requires raw socket access and for such an operation root (or CAP_SOCK) is required. It is not possible as a normal user.

This link should be quite usefull: http://linuxmint.tumblr.com/post/29714225010/installing-dnscrypt

  • Couldn't it also be that ports under 1024 can't be used by non-root users? – LawrenceC Jan 24 '14 at 15:55

The solution is to correctly set cap_net_bind_service on the dnscrypt-proxy binary so that it can bind to port 53 while running as the non root (dnscrypt) user:

setcap cap_net_bind_service=+pe /path/to/dnscrypt-proxy

If you run dnscrypt-proxy inside an lxc container the above command will need to be executed from the host.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.