Running nmap as an unprivileged user
Nmap can perform much of its functionality as a normal user, so it checks if it has permissions to perform certain actions before falling back to safer behaviours. For instance, performing a TCP SYN scan (-sS) requires opening raw sockets. If this fails and if the user didn't explicitly specify -sS, Nmap falls back to a normal TCP connect scan (-sT).
Nmap requires the following capabilities: CAP_NET_RAW, CAP_NET_ADMIN, CAP_NET_BIND_SERVICE. Some NSE scripts may require additional capabilities.
WARNING: This is dangerous. The Nmap Scripting Engine (NSE) allows scripts to sniff the network, change firewall roules and interface configuration, or exploit vulnerabilities including on localhost. It's possible, especially with elevated capabilities, for a clever person to use Nmap and NSE to escalate to full root privileges. If you do not understand these risks, do not do this.
Before setting capabilities, restrict Nmap access to certain groups. “adm” is a good choice for most distributions, as console users are generally members. Alternately, consider the group "sudo" (Ubuntu 12.04 or later), "admin" (Ubuntu before 12.04), or "wheel" (Red Hat systems).
chgrp adm /usr/bin/nmap chmod 750 /usr/bin/nmap
To set these capabilities, you must use the "setcap" command, which may not be installed. On Red Hat systems:
sudo yum install libcap
And on Debian/Ubuntu systems:
sudo apt-get install libcap2-bin
Then add the capabilities to Nmap. Be sure to specify the full path to wherever you installed Nmap:
sudo setcap cap_net_raw,cap_net_admin,cap_net_bind_service+eip /usr/bin/nmap
You must explicitly tell nmap that it has these capabilities:
nmap --privileged -sS 192.168.0.1
You can save the extra typing by setting the NMAP_PRIVILEGED environmental variable.
export NMAP_PRIVILEGED="" nmap -sS 192.168.0.1
You can set this permanently. Add the export line to one of the following:
- ~/.xsessionrc, for most graphical environments and inherited by all terminals and shells
- ~/.profile, for login shells
- ~/.bashrc, for bash
- ~/.gnomerc, for GNOME only
As long as it inherits NMAP_PRIVILEGED, Zenmap will run Nmap with these capabilities. However, Zenmap 6.25 and earlier will print a warning at startup:
"You are trying to run Zenmap with a non-root user! Some Nmap options need root privileges to work."
This can be ignored.