从PHP使用sudo运行shell脚本

Question

I currently have a PHP file on my ubuntu box that i want to use to create users on the machine from a web interface (security blablabla, its all on an internal network completely inaccessible from anyone who would accidentally/purposefully cause harm to the system) I initially tried using this:

    shell_exec("sudo mkdir -m 755 ".escapeshellarg($directory));

    shell_exec("sudo useradd -s /bin/false -d ".escapeshellarg($directory)." -p ".crypt($pass,$salt)." ".escapeshellarg($servername));

but obviously this exposes both mkdir and useradd to be passwordless sudo'd, so instead of doing this i decided to reduce complications by create a shell script in /etc called 'newserver.sh', now in that i have this;

#!/bin/bash
#Var 1 = Directory, Var 2 = Username Var 3 = Password
mkdir "$1"
chmod 755 "$1"
useradd -s /bin/false -d "$1" -p "$3" "$2"
chown "$2" "$1"

which seemed to work abit better, and works pretty fine when i run it it from terminal, but when the PHP exexutes it using

shell_exec("sudo sh /etc/newserver.sh /home/testuser testuser testpass");

it doesnt seem to do anything (ive even tested with the same parameters as when i run it from the terminal.

FYI my sudoers file has this line in it www-data ALL=(root) NOPASSWD: /etc/newserver.sh

Answer 1

First of all, the password must be cryptographed, like this:

/etc/newserver.sh /home/testuser testuser "$6$VP9.GI9D$nVjpXIlgoTCLYICNW9ijPqg07opPrjTU2ilYULaT4rut8S9CAmWggMXuOhJ27C5ltwCRfzSxEVgSlReA2i/rH1"

And I think, you should use "-c" as argument.

shell_exec("sudo sh -c \"/etc/newserver.sh /home/testuser testuser testpass\"");

Answer 2

Running as root can be done in two ways :

• Using sudo (making www-data a sudoer is nothing like a good idea...)
• Setting a setuid

Take a look a /bin/ping :

-rwsr-xr-x 1 root root /bin/ping

It belongs to root, but the 's' replacing the 'x' (execute) means that this program is setuid : it'll always be executed with the owner's identity : root. ping is a program that needs to build ICMP packets, and only root can manipulate those until the end.

You can create a similar environement : place your commands in a shell script (let's say myscript.sh ) and :

chown root:root myscript.sh # Give it to root.
chmod u+s myscript.sh # Use setuid on it.

Now, when you run it, even as a regular user (or www-data for the web server...), the processes will be created under root's identity.

Danger Giving setuid (as root) to a script is very dangerous. You should be careful with permissions : don't allow anyone but people you're interested in to run it. For instance, create a group called myscriptexec for people allowed to run this script :

addgroup myscriptexec
chgrp myscriptexec myscript.sh
chmod g+x # Group can execute.
chmod o= myscript.sh # No one executes except root and group members.

Then, add users to this group, as you need.

If you need to check your script, I'd suggest you use a temporary log file, for debugging purposes :

exec > /tmp/mylog.log
exec 2> /tmp/mylog.log