为处理来自 html（网页）的输入而开发的 Python 脚本未执行 shell 命令

Question

Please help me people!请帮助我的人！ I have setup a xcat server so that I can manage my many nodes therefrom.我已经设置了一个 xcat 服务器，以便我可以从中管理我的许多节点。 I want to stop running python scripts directly from within my xcat server.我想停止直接从我的 xcat 服务器中运行 python 脚本。 I figured it would be better for simplicity to create a webpage as my interface and use python as the server-side script from the xcat server I am finding that my underlying python script is not really doing everything I want it to do.我认为为了简单起见，创建一个网页作为我的界面并使用 python 作为来自 xcat 服务器的服务器端脚本会更好我发现我的底层 python 脚本并没有真正完成我想要它做的所有事情。 For example, my script is unable to power up or down my nodes defined on the xcat server.例如，我的脚本无法启动或关闭在 xcat 服务器上定义的节点。 To illustrate better, my node (hs22n12 ) is defined on my xcat server (xcatmn5).为了更好地说明，我的节点 (hs22n12) 是在我的 xcat 服务器 (xcatmn5) 上定义的。 I am able to use “nodels |我能够使用“nodels | grep hs22n12” to locate that node on xcatmn5 and operate it which ever way I see fit such as power up (“rpower hs22n12 on”) or power down (“rpower hs22n12 off”). grep hs22n12” 在 xcatmn5 上定位该节点并以我认为合适的任何方式操作它，例如通电（“rpower hs22n12 on”）或断电（“rpower hs22n12 off”）。 However, when I build this commands into my python scripts such that they are operated when I provide input from html, The operation is not successful.但是，当我将此命令构建到我的 python 脚本中以便在我提供来自 html 的输入时操作它们时，操作不成功。 Some specs are indicated here: I am using apache and I have confirmed that this is running My python scripts are in my var/www/cgi-bin and I am able to run them My htnl files are located in /var/www/html Please find below my code snippets First html code (which is currently okay for me and is working well)此处显示了一些规范：我正在使用 apache，并且我已确认它正在运行我的 python 脚本在我的 var/www/cgi-bin 中，我可以运行它们我的 htnl 文件位于 /var/www/html请在我的代码片段下方找到第一个 html 代码（目前对我来说没问题并且运行良好）

****<!DOCTYPE html>
    <html>
    <head>
    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
    </head>
    <body>
    <div id="title">
    <title> Node Provisioning Application </title>
    </div>
    <form action='cgi-bin/powerOff11.py' method="post">
     Enter Node:  <input type="text"  name ="Node"/>
     <input type="submit" value="submit">
    </form>
    </body>
    </html>**

I will add my python code shortly Here's my python code我将很快添加我的 python 代码这是我的 python 代码

#!/usr/bin/python
import cgi
import cgitb
import subprocess
import os
import sys
cgitb.enable()

print "Content-type: text/html\n"

form = cgi.FieldStorage()

Node = form.getvalue('Node')
print"<p>%s</p>"% Node

if Node == None:
    print"<p>No node provided</p>"
else:
    find_node = subprocess.call('nodels | grep ' + Node, shell=True)
    if find_node == 0:
        print("<p>Node not defined yet!</p>")
    else:
        if find_node > 0:
            print"<p>%s</p>"% Node
            p_off = subprocess.call('rpower ' + Node + ' on',shell=True)
            print"<p>%s powering on...</p>"% Node 
        else:
            sys.exit()

update: After some diggging around, I was able to enable the HTTPS protocol for REST API and also enabled the certificate of HTTPs by following the instruction here: https://xcat-docs.readthedocs.io/en/stable/advanced/restapi/restapi_setup/restapi_setup.html更新：经过一番挖掘，我能够为 REST API 启用 HTTPS 协议，并按照以下说明启用 HTTPs 证书： https : //xcat-docs.readthedocs.io/en/stable/advanced/restapi /restapi_setup/restapi_setup.html

After i did this, I was actually able to access different resources, such as the repository of my xcat server via https.在我这样做之后，我实际上能够通过 https 访问不同的资源，例如我的 xcat 服务器的存储库。 However, original problem has become clearer.然而，原来的问题变得更加清晰。 The new response I am getting from http whenever I try to run a command that needs root priviledge is:每当我尝试运行需要 root 权限的命令时，我从 http 得到的新响应是：

"Error: Permission denied for request warning: the client certificates under /usr/share/httpd/.xcat/ are not setup correctly, please run '/opt/xcat/share/xcat/scripts/setup-local-client.sh ' as 'root' to generate the client certificates; otherwise, the SSL connection between xcat client and xcatd will be setup without certificate verification and open to Man-In-The-Middle attacks." “错误：请求权限被拒绝警告：/usr/share/httpd/.xcat/ 下的客户端证书未正确设置，请运行'/opt/xcat/share/xcat/scripts/setup-local-client.sh'以‘root’身份生成客户端证书；否则，xcat 客户端和 xcatd 之间的 SSL 连接将在没有证书验证的情况下建立，并容易受到中间人攻击。”

This leads me to believe that my problem is how to configure /etc/httpd/conf/httpd.conf to be able to request root access and also make requests from there.这让我相信我的问题是如何配置 /etc/httpd/conf/httpd.conf 以便能够请求 root 访问并从那里发出请求。 Mind you I am able to get response to all binary commdans such as (ls, cd etc) that are in the /usr/bin directory (these commands do not require root priviledge to be made. Can someone point me to how to configure httpd.conf such that my request can be legitimately made from /root to xcat? Thank you all for your helps.请注意，我能够响应 /usr/bin 目录中的所有二进制命令，例如（ls、cd 等）（这些命令不需要获得 root 权限。有人可以指点我如何配置 httpd .conf 这样我的请求就可以合法地从 /root 到 xcat？谢谢大家的帮助。

Answer 1

This is xCAT2, I assume?这是 xCAT2，我猜？
If so, did you give correct permission to the apache process to execute xCAT commands?如果是这样，您是否授予 apache 进程执行 xCAT 命令的正确权限？

xCAT policy table serves as ACL (access control list) for xCAT. xCAT 策略表用作xCAT 的ACL（访问控制列表）。

You can do something like:您可以执行以下操作：

mkdef -t policy -o 7.0 name=apache rule=allow

7.0 is just an example - use any other number as long as it doesn't conflict with any preexisting rule - tabdump policy can be convenient as there shouldn't be too many lines in the policy table. 7.0只是一个例子 - 使用任何其他数字，只要它不与任何预先存在的规则冲突 - tabdump policy可能很方便，因为策略表中不应该有太多行。

for name use the apache process owner. name使用 apache 进程所有者。

By default unless limited with commands= flag, all commands are allowed by this new policy rule.默认情况下，除非受commands=标志限制，否则此新策略规则允许所有命令。

Answer 2

Thank you again for taking the time to respond to my issue.再次感谢您抽出时间回答我的问题。 I have tried it out.我已经试过了。 It appears that this is not the problem, however you have nudged me in the right direction of thinking beyond the actual code to the entire web service configuration of httpd and how it makes requests from xcatd.看起来这不是问题，但是您已经将我推向了正确的思考方向，超越了实际代码，考虑了 httpd 的整个 Web 服务配置以及它如何从 xcatd 发出请求。 I was able to do some adjustment and noticed that I am able to get response from xcatd to all binary commands in /usr/bin/python (eg ls) but I am unable to get response to such commands that needs root access like lsdef.我能够进行一些调整，并注意到我能够从 xcatd 获得对 /usr/bin/python 中所有二进制命令的响应（例如 ls），但我无法获得对需要像 lsdef 这样的 root 访问权限的命令的响应。 This leads me to believe that the problem I am having is that I am not given permission to request root priviledge (run root commands) from http client.这让我相信我遇到的问题是我没有被授予从 http 客户端请求 root 权限（运行 root 命令）的权限。 I need someone who has done web service configuration to look ino this.我需要一个已经完成 Web 服务配置的人来看看这个。 I believe the problem is most likely in httpd.conf (Still reading up on it) But tanks again.我相信问题很可能出在 httpd.conf （仍在阅读它）但又是坦克。

为处理来自 html（网页）的输入而开发的 Python 脚本未执行 shell 命令

问题描述

2 个解决方案

解决方案1
0 2021-02-21 22:46:07

解决方案2
0 2021-03-02 12:43:19

为处理来自 html（网页）的输入而开发的 Python 脚本未执行 shell 命令

问题描述

2 个解决方案

解决方案1 0 2021-02-21 22:46:07

解决方案2 0 2021-03-02 12:43:19

解决方案1
0 2021-02-21 22:46:07

解决方案2
0 2021-03-02 12:43:19