page sudo via web

cnperry

I've been trying to get this trick to work, but can't seem to:

I want a specific php script to run system commands not as apache, but as a specific user on the web server (our account on the hosting co's server).

in a terminal window, this is done with the sudo -u <username> command, wait for the PW prompt, enter pw and everything works.
How do you do this from a script when a password is required?

Thanks!
Cameron

bubblenut

This is made dificult for a reason. It's dangerous. If you su to root and then do some stuff but leave a hole in your software then any cracker out there has root access (a bad thing).
However, having said that it's sometimes necesarry. Have a look at expect, it may help. However, please be very carefull to make sure your script is 100% secure if it's going to be on a live server.

[edit]
OMFG, your-you're mistake. I am crap 🙁
[/edit]

cnperry

Thanks for the tip! Good news is that I don't have root permissions - just need to execute as a user. The script will simply copy a list of files from a QA server to our production server - all the paths hard-coded.

So is there no way to do this with just PHP (it looks like the link is to some kind of binary install)? I know the hosting provider probably won't install this for us, so is there any other way?

Thanks,
-Cameron

ednark

why not just have php execute a shell script .. and the make the 'sudo -u blah' part of the shell script.. or part of php's exec() call... do all your moving command line...

not as sexy as an all php solution.. but the problem of copying files from one server to another isn't exactly a php only solution...

or if you want do stay php.. make a .php file that does all the copying outside of the webserver... and do something like this

exec('sudo -u foo ./path/to/executable/php transferstuff.php');

as long as php didn't pass any variables like which user to become... and the list was hardcoded... there shouldn't be a problem with security.. as long as the php page the executes the shell script isn't accessible to the public

cnperry

I see exactly what you're saying. I've tried this approach before and it seems that no matter how you arrange it, the "user" executing the script is always going to be apache (if initiated from a web page). if you do the sudo -u junk, I don't see how you can enter that user's password so you can manhandle files owned by that user.

bubblenut

Well, you need to execute something with certain permissions. You have two options; either you change the permissions required at the program you're trying to run/files you're trying to copy with php or you changethe permissions provided by php by changing the user it is calling as. You seem to have got attached to the second option but don't discount the first until you have had a good think about it (it is quite possible that it is not possible but it's always good to check).

As ednark says the answer is in writing a BASH script to handle it. If the apache user doesn't have permissions to sudo to the particular users you want it to without providing a password then you'll have to provide a password (which is why I gave you a link to expect above, take a look at it). You will, of course, come accross the problem that somewhere you're going to have to have users passwords hardcoded into a file on the very system those users reside but there doesn't seem to be any way around this.

Cheers
Rob

cnperry

Please don't be frustrated with me. This problem is not as straightforward as it seems...

Our hosting company doesn't want us installing binaries on the server (for good reason), which is what we'd have to do with expect (the link you provided).

On my test machine, I wrote a shell script, changed its owner and group to "root", and have it take a password and filenames as arguments then copies the file from directory A to directory B. The problem is that file ownership is not maintained on the file from dir A to B. Whoever runs the script (be it me through the command line, or apache/php, or su/sudo) becomes the new owner. The only way to preserve ownership is with the following command:
sudo --preserve=all dirA/file dirB/file

now, that being said, how does one pass the password to the sudo password prompt at the right time (or at all) without using any additional software (i.e. cron or expect)? If it's not doable, fine. I'll work a little bit harder to come to a different compromise.

Thanks for the patience and for all your help!
Cameron

bubblenut

I'm afraid it's not, that's what expect is for. However, if you're working with a high enough user you could chown it. If you need to get hold of what the user was before you could pipe ls -l to awk. I can't remember what the sytax to pull out elements of a character seperated list is (in this case it would be space seperated) but I remember that it's quite simple. If anyone else knows please do chip in, otherwise, if you haven't found it by tomorrow when I'm in the office I'll have a hunt. I know I've got it lurking in a couple of scripts knocking around 🙂

cnperry

Thanks for the help, bubblenut! I so appreciate your efforts helping me (and inevitably others) figure out this problem...

I searched through the PHP manual information relating to files and found the functions fileowner() and posix_getpwuid(), which should give us all we need in that arena. That info can always be passed to any script - PHP or shell.

I'll try talking to the administrator to see what feels comfortable with us doing. It's not ideal, but maybe we'll just have to chgrp -R on everything to apache (username preserved) so that both can have equal access, then chmod -R everything to 764 or 774 and be set? That's not ideal, but it may be all we can do for now.

Thoughts?

~Cameron