Don't want php script to execute the shell command as apache user when it is executed through browser? Don't want php script to execute the shell command as apache user when it is executed through browser? unix unix

Don't want php script to execute the shell command as apache user when it is executed through browser?


Sudo normally requires an interactive shell to enter your password. That's obviously not going to happen in a PHP script. If you're sure you know what you're doing and you've got your security issues covered, try allowing the Apache user to run sudo without a password, but only for certain commands.

For example, adding the following line in your sudoers file will allow Apache to run sudo without a password, only for the gzip command.

nobody ALL=NOPASSWD: gzip

Adjust the path and add any arguments to suit your needs.

Caution:

  1. There might still be complications due to the way PHP calls shellcommands.
  2. Remember that it's very risky to allow the web server torun commands as root!

Another alternative:

Write a shell script with the suid bit to make it run as root no matter who calls it.

Probably a better alternative:

Write the commands to a queue and have cron pick them up, validate them (only allow known good requests), and run them, then mark that queue complete with the date and result.

Your end-user can then click/wait for update using ajax.

Hope it helps resolve your answer.