ICM: Binding ports < 1024 on UNIX
SAP notes
Refer to the following SAP notes:
- 2354759 - Service not started in host <hostname/IP address>:<port> -- NIEMYHOST_VERIFY
- 421359 - ICM: Binding ports < 1024 on UNIX
Cause
The SAP Web Dispatcher is configured with the port 443
alemavt06:wd1adm 89> grep icm/server WD1_W03_alemavt06
icm/server_port_0 = PROT=HTTPS,PORT=443
During the start of the SAP Web Dispatcher, the following error appears
alemavt06:wd1adm 73> tail -f dev_webdisp
...
[Thr 139928454227712] *** ERROR => NiIBindSocket: SiBind failed for hdl 25/sock 10
(SI_EADDR_NAVAIL/13; I4; ST; 0.0.0.0:443) [nixxi.cpp 3831]
[Thr 139928454227712] *** ERROR => IcmBindService: You might not have the permissions to bind the service: alemavt06.alema.local:443 [icxxserv.c 3817]
[Thr 139928454227712] *** ERROR => IcmBindService: NiBuf2Listen failed for host alemavt06.alema.local:443 (rc=-16): NIEMYHOST_VERIFY [icxxserv.c 3822]
[Thr 139928454227712] *** WARNING => IcmAddService: Could not start service (rc=-1) PORT=443,PROT=HTTPS,TIMEOUT=60,PROCTIMEOUT=60,VCLIENT=1 [icxxserv.c 1311]
[Thr 139928454227712] IcmAddHiddenService: Hidden service WEBSOCKET started
[Thr 139928454227712] Started service PORT=8003,PROT=HTTP,TIMEOUT=60,PROCTIMEOUT=60
The SAP Web Dispatcher user cannot bind the port 443 because the process on Unix must have superuser authorization rights.
Procedure
Log on with the root user
Go inside SAP executable directory (CDEXE)
alemavt06:/usr/sap # cd /sapmnt/WD1/exe/uc/linuxx86_64
Check the existence of the binary "icmbnd.new"
alemavt06:/sapmnt/WD1/exe/uc/linuxx86_64 # ls -l | grep icmbnd
-rwxr-xr-x 1 wd1adm sapsys 2256990 Feb 6 20:28 icmbnd.new
Copy the binary from "icmbnd.new" to "icmbnd"
alemavt06:/sapmnt/WD1/exe/uc/linuxx86_64 # cp icmbnd.new icmbnd
Adapt the authorization of "icmbnd"
alemavt06:/sapmnt/WD1/exe/uc/linuxx86_64 # chown root:sapsys icmbnd
alemavt06:/sapmnt/WD1/exe/uc/linuxx86_64 # chmod 4750 icmbnd
Check the new authorizations for "icmbnd"
alemavt06:/sapmnt/WD1/exe/uc/linuxx86_64 # ls -l | grep icmbnd
-rwsr-x--- 1 root sapsys 2256990 Mar 6 13:59 icmbnd
-rwxr-xr-x 1 wd1adm sapsys 2256990 Feb 6 20:28 icmbnd.new
To prevent the ICM/SAP Web Dispatcher from attempting to bind the port
itself, an additional option must be specified when the ports are
configured with icm/server_port_: "EXTBIND=1".
alemavt06:wd1adm 91> grep icm/server WD1_W03_alemavt06
icm/server_port_0 = PROT=HTTPS,PORT=443, TIMEOUT=15, EXTBIND=1
Restart the SAP Web Dispatcher
alemavt06:wd1adm 92> stopsap ; startsap
Check the log
alemavt06:wd1adm 58> view dev_webdisp
...
[Thr 139773473732480] Started service PORT=443,PROT=HTTPS,TIMEOUT=15,PROCTIMEOUT=15,EXTBIND=1,VCLIENT=1
[Thr 139773473732480] SSL settings: verify_client: 1, cache_size: -1, cache_lifetime: -1, credfile: SAPSSLS.pse, ciphers: default
[Thr 139773235496704] IcmAddHiddenService: Hidden service WEBSOCKET started
