PHP writing to /etc

[Peter Simpson]

Hello everybody.

I'm trying to set up a simple web interface to maintain the rules
configuration for Shorewall.

This entails writing to at least one of several root-owned files in
/etc/shorewall.

Can anyone, please explain how I allow a script to write to one of these
files when apache is running as www-run.nobody (on debian stable) ?

I appreciate that it's probably about permissions, but I should like to
be able to minimise the risk of abuse because it is for a charity that I
work for.

Apache is set up to be visible internally only and I shall ensure that
no-one can make it visible via the interface!!

Thank you for any help that anyone can give.

Regards,
Pete

[CountScubula]

Re: PHP writing to /etc

chmod 777

--
Mike Bradley
http://www.gzentools.com -- free online php tools
"Peter Simpson" <peter@tiverton .demon.co.uk> wrote in message
news:c08t2v$ao3 $1$830fa17d@new s.demon.co.uk.. .[color=blue]
> Hello everybody.
>
> I'm trying to set up a simple web interface to maintain the rules
> configuration for Shorewall.
>
> This entails writing to at least one of several root-owned files in
> /etc/shorewall.
>
> Can anyone, please explain how I allow a script to write to one of these
> files when apache is running as www-run.nobody (on debian stable) ?
>
> I appreciate that it's probably about permissions, but I should like to
> be able to minimise the risk of abuse because it is for a charity that I
> work for.
>
> Apache is set up to be visible internally only and I shall ensure that
> no-one can make it visible via the interface!!
>
> Thank you for any help that anyone can give.
>
> Regards,
> Pete[/color]

[TreeBoy]

Re: PHP writing to /etc

Hi.

I was hoping for something a little less prone to abuse.

I guess what I really mean is: "Is there a way to make a script execute
as someone other than www-run" ?

Regards,
Peter

CountScubula wrote:[color=blue]
> chmod 777
>
> --
> Mike Bradley
> http://www.gzentools.com -- free online php tools
> "Peter Simpson" <peter@tiverton .demon.co.uk> wrote in message
> news:c08t2v$ao3 $1$830fa17d@new s.demon.co.uk.. .
>[color=green]
>>Hello everybody.
>>
>>I'm trying to set up a simple web interface to maintain the rules
>>configurati on for Shorewall.
>>
>>This entails writing to at least one of several root-owned files in
>>/etc/shorewall.
>>
>>Can anyone, please explain how I allow a script to write to one of these
>>files when apache is running as www-run.nobody (on debian stable) ?
>>
>>I appreciate that it's probably about permissions, but I should like to
>>be able to minimise the risk of abuse because it is for a charity that I
>>work for.
>>
>>Apache is set up to be visible internally only and I shall ensure that
>>no-one can make it visible via the interface!!
>>
>>Thank you for any help that anyone can give.
>>
>>Regards,
>>Pete[/color]
>
>
>[/color]

[Jim Thomas]

Re: PHP writing to /etc

TreeBoy wrote:[color=blue]
> Hi.
>
> I was hoping for something a little less prone to abuse.[/color]

Whew! I would hope so! Do you know about sudo?


--
Jim Thomas Principal Applications Engineer Bittware, Inc
jthomas@bittwar e.com http://www.bittware.com (703) 779-7770
The secret to enjoying your job is to have a hobby that's even worse
- Calvin's Dad

[TreeBoy]

Re: PHP writing to /etc

Hi.

I'm confident about using sudo at the command line - but I'm not sure
about applying this to an Apache-hosted PHP page.

The simplest thing that I could think of in this scenario is to "chgrp"
the relevant files to "nogroup" which is what Apache is running at - but
I'm not sure if that leaves me open to yet more abuse.

Otherwise, how do I sudo from within PHP - I've played vaguely with
suEXEC in Apache, but I am petrified of the consequences of trying that.

I hope I'm getting the idea of my paranoia across ;-)

Peter

Jim Thomas wrote:[color=blue]
> TreeBoy wrote:
>[color=green]
>> Hi.
>>
>> I was hoping for something a little less prone to abuse.[/color]
>
>
> Whew! I would hope so! Do you know about sudo?
>
>[/color]

[CountScubula]

Re: PHP writing to /etc

ok, here are 2 aproaches.

1:
write a wrapper in C, that changes the running user, and does what you want.

2:
Create a dir called, for example: webcron, and make it writable by only your
webserver. This directory can be anywhere you want, perhaps /etc/webcron

Now, depending on your server, and your needs, add an entry into
/etc/crontab, such as this:
*/2 * * * * root run-parts /etc/webcrons

This will cause the server to run whatever scripts are in that folder every
2 minutes. So when you need something done have your php page write a simple
script to that directory, and and the end of the script, have it erase it
self.

Ok, its a hack, but it works if you can't figure out option 1

--
Mike Bradley
http://www.gzentools.com -- free online php tools
"TreeBoy" <tree_news@tive rton.DELETE_ME. demon.co.uk> wrote in message
news:c0ap7o$ddm $1$8302bc10@new s.demon.co.uk.. .[color=blue]
> Hi.
>
> I was hoping for something a little less prone to abuse.
>
> I guess what I really mean is: "Is there a way to make a script execute
> as someone other than www-run" ?
>
> Regards,
> Peter
>
> CountScubula wrote:[color=green]
> > chmod 777
> >
> > --
> > Mike Bradley
> > http://www.gzentools.com -- free online php tools
> > "Peter Simpson" <peter@tiverton .demon.co.uk> wrote in message
> > news:c08t2v$ao3 $1$830fa17d@new s.demon.co.uk.. .
> >[color=darkred]
> >>Hello everybody.
> >>
> >>I'm trying to set up a simple web interface to maintain the rules
> >>configurati on for Shorewall.
> >>
> >>This entails writing to at least one of several root-owned files in
> >>/etc/shorewall.
> >>
> >>Can anyone, please explain how I allow a script to write to one of these
> >>files when apache is running as www-run.nobody (on debian stable) ?
> >>
> >>I appreciate that it's probably about permissions, but I should like to
> >>be able to minimise the risk of abuse because it is for a charity that I
> >>work for.
> >>
> >>Apache is set up to be visible internally only and I shall ensure that
> >>no-one can make it visible via the interface!!
> >>
> >>Thank you for any help that anyone can give.
> >>
> >>Regards,
> >>Pete[/color]
> >
> >
> >[/color][/color]

[Jim Thomas]

Re: PHP writing to /etc

TreeBoy wrote:[color=blue]
> Hi.
>
> I'm confident about using sudo at the command line - but I'm not sure
> about applying this to an Apache-hosted PHP page.
>
> The simplest thing that I could think of in this scenario is to "chgrp"
> the relevant files to "nogroup" which is what Apache is running at - but
> I'm not sure if that leaves me open to yet more abuse.
>
> Otherwise, how do I sudo from within PHP - I've played vaguely with
> suEXEC in Apache, but I am petrified of the consequences of trying that.
>
> I hope I'm getting the idea of my paranoia across ;-)[/color]

Yes you are. This is, as you know, very dangerous ground to tread. But
if the command you wish to run is static, you can invoke it with
something like system("sudo rm -rf /"). (This example is contrived ;-)

With sudo you can specify a very precise command, including acceptable
arguments.

Be careful!

--
Jim Thomas Principal Applications Engineer Bittware, Inc
jthomas@bittwar e.com http://www.bittware.com (703) 779-7770
The secret to enjoying your job is to have a hobby that's even worse
- Calvin's Dad

[TreeBoy]

Re: PHP writing to /etc

Jim Thomas wrote:[color=blue]
> TreeBoy wrote:
>[color=green]
>> Hi.
>>
>> I'm confident about using sudo at the command line - but I'm not sure
>> about applying this to an Apache-hosted PHP page.
>>
>> The simplest thing that I could think of in this scenario is to
>> "chgrp" the relevant files to "nogroup" which is what Apache is
>> running at - but I'm not sure if that leaves me open to yet more abuse.
>>
>> Otherwise, how do I sudo from within PHP - I've played vaguely with
>> suEXEC in Apache, but I am petrified of the consequences of trying that.
>>
>> I hope I'm getting the idea of my paranoia across ;-)[/color]
>
>
> Yes you are. This is, as you know, very dangerous ground to tread. But
> if the command you wish to run is static, you can invoke it with
> something like system("sudo rm -rf /"). (This example is contrived ;-)
>
> With sudo you can specify a very precise command, including acceptable
> arguments.
>
> Be careful!
>[/color]

Thanks for the clue.

I'm now happy to be able to do what I want.

I just didn't know about the "system" command.

All the very best.
Pete

BTW: I shall be *very* careful.

[TreeBoy]

Re: PHP writing to /etc

Thanks Monsieur le Count.

The wrapper thing is not really something that I want to consider - I
believe that I could achieve the same thing by making a SUID or SGID
shell script to achieve the same and relying on my security skills at
that level is not too appealing :-(

The cron tab thing is a nice cludge, which I had not considered. Running
it every two minutes may have a significant impact on overall
performance for the office - but I certainly have nothing to lose in
trying it.

Thank you very much for your assistance.

Regards,
Peter


CountScubula wrote:[color=blue]
> ok, here are 2 aproaches.
>
> 1:
> write a wrapper in C, that changes the running user, and does what you want.
>
> 2:
> Create a dir called, for example: webcron, and make it writable by only your
> webserver. This directory can be anywhere you want, perhaps /etc/webcron
>
> Now, depending on your server, and your needs, add an entry into
> /etc/crontab, such as this:
> */2 * * * * root run-parts /etc/webcrons
>
> This will cause the server to run whatever scripts are in that folder every
> 2 minutes. So when you need something done have your php page write a simple
> script to that directory, and and the end of the script, have it erase it
> self.
>
> Ok, its a hack, but it works if you can't figure out option 1
>
> --
> Mike Bradley
> http://www.gzentools.com -- free online php tools
> "TreeBoy" <tree_news@tive rton.DELETE_ME. demon.co.uk> wrote in message
> news:c0ap7o$ddm $1$8302bc10@new s.demon.co.uk.. .
>[color=green]
>>Hi.
>>
>>I was hoping for something a little less prone to abuse.
>>
>>I guess what I really mean is: "Is there a way to make a script execute
>>as someone other than www-run" ?
>>
>>Regards,
>>Peter
>>
>>CountScubul a wrote:
>>[color=darkred]
>>>chmod 777
>>>
>>>--
>>>Mike Bradley
>>>http://www.gzentools.com -- free online php tools
>>>"Peter Simpson" <peter@tiverton .demon.co.uk> wrote in message
>>>news:c08t2v$ ao3$1$830fa17d@ news.demon.co.u k...
>>>
>>>
>>>>Hello everybody.
>>>>
>>>>I'm trying to set up a simple web interface to maintain the rules
>>>>configurati on for Shorewall.
>>>>
>>>>This entails writing to at least one of several root-owned files in
>>>>/etc/shorewall.
>>>>
>>>>Can anyone, please explain how I allow a script to write to one of these
>>>>files when apache is running as www-run.nobody (on debian stable) ?
>>>>
>>>>I appreciate that it's probably about permissions, but I should like to
>>>>be able to minimise the risk of abuse because it is for a charity that I
>>>>work for.
>>>>
>>>>Apache is set up to be visible internally only and I shall ensure that
>>>>no-one can make it visible via the interface!!
>>>>
>>>>Thank you for any help that anyone can give.
>>>>
>>>>Regards,
>>>>Pete
>>>
>>>
>>>[/color][/color]
>
>[/color]