Discussion Locked

Run root command through web page

0 helpful
9 replies
Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

i am using linux as a web server,
i want to use a web page to run command as root such as netstat, useradd etc...

9 replies

by andy

What web server are you using? Apache runs as wwwrun nogroup so only has access to the web root. If you give you server access to run as root you are opening the whole system up to be hacked.
The web page could create a parm file and you could havea CRON job pick up the data to process but again think about the security implications.

Apache does have the ability to SU with SUEXEC, http://httpd.apache.org/docs/suexec.html for details.

Andy

by eugen prokopiev

I STRONGLY NOT RECOMMEND you to do such things!!! But if you still want...
Files on Linux's filesystem have SUID and SGID attributes. If they are set (by chmod command - see man chmod) and file is owned by root, it can be executed with root privileges by any user. There is one exception: it MUST be not the shell script - on kernel level shell scripts are not allowed to be SUID. All ok with Perl. But BE VERY CAREFUL (!!!), SUID programs are possible security hole.
If you still want to do what you want...
Create something like CGI Perl script which will run needed command with correct parameters (probably specified in arguments of CGI script), place it in CGI directory of your HTTP-server and make it SUID. Then write web-interface to it and enjoy :)

HTH
Eugen

This discussion is closed to new replies.