HAProxy error: Some configuration options require full privileges, so global.uid cannot be changed

Question

After adding the line to /etc/haproxy/haproxy.cfg as part of creating a transparent proxy,

    source 0.0.0.0 usesrc clientip

restarting haproxy starts giving an error

~# service haproxy reload
 * Reloading haproxy haproxy                                                     
       [ALERT]     230/153724 (1140) : [/usr/sbin/haproxy.main()] Some configuration options require full privileges, so global.uid cannot be changed.

I'm already running service haproxy reload as root. What else do we have to do? Thank you!

Answer 1

Comment out following lines in your haproxy.cfg:

    user        haproxy
    group       haproxy

and restart haproxy.

Answer 2

The better way to fix this issue with privileges is to execute the below commands:

1. Fix haproxy capabilities

   setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip /usr/sbin/haproxy
   

2. Fix haproxy.pid file rights

   touch /var/run/haproxy.pid; chown haproxy:haproxy /var/run/haproxy.pid
   

3. Comment out from haproxy.conf:

   User haproxy
   Group haproxy
   

4. Execute daemon as haproxy user:

   sudo -u haproxy /sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -D -q
   

5. Check haproxy process

   ps -ef | grep haproxy
   

   the result should be:

   haproxy  12800     1  0 фев12 ?     00:00:58 /sbin/haproxy -f /etc/haproxy/haproxy.cfg -p /var/run/haproxy.pid -D -q
   

6. You can put these commands in rc.local in order to start automatically with the system