topic Re: allow sudo for www user to run root shell script in Operating System - Linux

allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 05:02:02 GMT

hi

howto allow sudo for www user to run root shell script:

I put in /usr/local/etc/sudores:
---------------------------------------------------
%www ALL=(ALL) NOPASSWD: ALL
www ALL=(root) ALL,!/bin/sh

---------------------------------------------------

but still get:
# sudo -u www sh /usr/local/www/cgi-bin/ntop/ntop.sh start
touch: /var/log/ntop.access.log: Permission denied
ntopbsd#

I know all security aspects, but I really need it.

kind regards
chris

Re: allow sudo for www user to run root shell script

Stuart Browne — Sat, 23 Jul 2005 05:58:37 GMT

'sudo -u www' will attempt to run the script as the 'www' user.

Your sudoers say:

Any user in the 'www' group can run any command without any password.

The user 'www' can run any command (except /bin/sh) as 'root' only.

So that's not going to work.

As the 'www' user, you just want to issue 'sudo /usr/local/www/cgi-bin/ntop/ntop.sh start'.

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 06:31:02 GMT

thanks,

but I cannot do:

# su www
This account is currently not available.

to try it.

I'd like to execute this root shell script via browser, using a perl script:
----------------------------------------------------------------------------------
#!/usr/bin/perl -w

use CGI::Carp qw(fatalsToBrowser);
use CGI;
my $query = new CGI;

# write the log
BEGIN
{
use CGI::Carp qw(carpout);
my $errorlog = "/var/tmp/errorlog.txt";
open(LOG, ">$errorlog") or die("Unable to open $errorlog: $!\n");
print LOG "Errors:\n";
carpout(*LOG);
}

print $query->header;
print "\n";
print "\n";
print "ntop startup script\n";
print "\n";
print "\n";
print "\n";
print "";
print "

";
print "

";

'sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh stop' or die "cannot stop ntop: $!";
sleep(8);
$cc = 'sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh start' or die "cannot start ntop: $!";
print "Status: ",$cc,"\n";

print "";
print "";

exit($cc);
----------------------------------------------------------------------------------

but it doesn't work

Re: allow sudo for www user to run root shell script

Stuart Browne — Sat, 23 Jul 2005 06:36:14 GMT

and the user/group that your apache runs CGI's as? www:www ?

Re: allow sudo for www user to run root shell script

Stuart Browne — Sat, 23 Jul 2005 06:41:58 GMT

Oh incidentally, as you've got both the group modifier and the user modifier in there, it will take the 'user' first, and thus prompt for a password, rather than take the 'group' (of which doesn't).

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 06:43:47 GMT

I think

user: www
group: www

how can I check them to be sure ?

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 06:54:23 GMT

I changed to only:

%www ALL=(ALL) NOPASSWD: ALL

but still doesn't work.

Re: allow sudo for www user to run root shell script

Stuart Browne — Sat, 23 Jul 2005 07:11:58 GMT

Those sudo settings work fine here as a CGI.

What is your apache 'error_log' saying?

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 08:15:42 GMT

[Sat Jul 23 13:51:33 2005] [error] [client 192.168.0.105] (13)Permission denied: exec of '/usr/local/www/cgi-bin/ntop/ntop4.cgi' failed
[Sat Jul 23 13:51:33 2005] [error] [client 192.168.0.105] Premature end of script headers: ntop4.cgi

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 08:30:22 GMT

sorry this was an old entry
I don't have any errors or entries in apache error log now, but still doesn't work.

Re: allow sudo for www user to run root shell script

Stuart Browne — Sat, 23 Jul 2005 08:33:53 GMT

From the command line, as root, does the CGI execute without issues, and output what's expected?

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 08:40:40 GMT

from command line as root:
--------------------------------------------------------------------
# perl ntop4.cgi
Content-Type: text/html; charset=ISO-8859-1

ntop startup script

Status: sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh start
bsd#
--------------------------------------------------------------------

but ntop doesn't start

Re: allow sudo for www user to run root shell script

Stuart Browne — Sat, 23 Jul 2005 08:44:20 GMT

*nod* yup, thought so.

If you look at your output, you can see the exact problem.

Around your sudo lines, you've got forward-single-quotes ('). You need back-tick's (`). Wrong character..

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 09:00:52 GMT

I don't understand what you mean, my sudoers looks:

# sudoers file.
#
# This file MUST be edited with the 'visudo' command as root.
#
# See the sudoers man page for the details on how to write a sudoers file.
#

# Host alias specification

# User alias specification

# Cmnd alias specification

# Defaults specification

# Runas alias specification

# User privilege specification
root ALL=(ALL) ALL

# Uncomment to allow people in group wheel to run all commands
# %wheel ALL=(ALL) ALL

# Same thing without a password
# %wheel ALL=(ALL) NOPASSWD: ALL

# Samples
# %users ALL=/sbin/mount /cdrom,/sbin/umount /cdrom
# %users localhost=/sbin/shutdown -h now

%www ALL=(ALL) NOPASSWD: ALL

Re: allow sudo for www user to run root shell script

Stuart Browne — Sat, 23 Jul 2005 09:04:16 GMT

In your perl routine, you've got:

'sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh stop' or die "cannot stop ntop: $!";
sleep(8);
$cc = 'sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh start' or die "cannot start ntop: $!";

These lines use the forward single quote ('). As you aren't using the system() call, it appears as if you want to subshell out, which means you should be using the back tick (`), not quote (').

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 09:13:50 GMT

how should I change that ?

can you post pls the correct syntax ?

Re: allow sudo for www user to run root shell script

Stuart Browne — Sat, 23 Jul 2005 09:24:59 GMT

You have these lines:

'sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh stop' or die "cannot stop ntop: $!";
sleep(8);
$cc = 'sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh start' or die "cannot start ntop: $!";

You need to change them to either:

`sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh stop` or die "cannot stop ntop: $!";
sleep(8);
$cc = `sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh start` or die "cannot start ntop: $!";

or use some form of system() and less control over it's output...

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 09:38:13 GMT

thanks,

I changed but now I get this error from the command line:

# perl ntop4.cgi
Content-Type: text/html; charset=ISO-8859-1

ntop startup script

Software error:

cannot stop ntop: No such file or directory at ntop4.cgi line 32.

For help, please send mail to this site's webmaster, giving this error message
and the time and date of the error.

Re: allow sudo for www user to run root shell script

Stuart Browne — Sat, 23 Jul 2005 10:07:16 GMT

Verify that this is the correct full path:

/usr/local/www/cgi-bin/ntop/ntop.sh

If it is, then change it from:

sudo sh /usr/local/www/cgi-bin/ntop/ntop.sh

to just:

sudo /usr/local/www/cgi-bin/ntop/ntop.sh

ensuring that /usr/local/www/cgi-bin/ntop/ntop.sh is executable (chmod +x /usr/local/www/cgi-bin/ntop/ntop.sh).

Re: allow sudo for www user to run root shell script

'chris' — Sat, 23 Jul 2005 10:21:16 GMT

I did these changes, but still get this error:

# perl ntop4.cgi
Content-Type: text/html; charset=ISO-8859-1

ntop startup script

Software error:

cannot stop ntop: No such file or directory at ntop4.cgi line 32.

For help, please send mail to this site's webmaster, giving this error message
and the time and date of the error.

I don't really understand the path is correct.