Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Problem is I cannot run "ifconfig" or similar commands via browser.

Environment:

Programming language : python
Server : lighttpd(CGI) , running on busybox.

Well machine is really small and so I am really restricted.

Tried techniques:

chown every script to root. But there is no differences.

Why?

Because lighttpd runs under another user, I mean not under root. As it is not root, when I try to run script from browser it always calls the python file with its uid. So it makes it impossible to run "ifconfig eth0 192.168.2.123" like commands via web browser. I get "ifconfig: SIOCSIFADDR: Permission denied" error.

What can I do?

I do not have any sudoers file, so cannot modify sudo command. Well, I don't even have "sudo" command :)

Thanks for your help

share|improve this question

2 Answers 2

Build ifconfig from net-tools and set suid bit(not safe):

chmod +s /sbin/ifconfig

setuid

setuid and setgid (short for set user ID upon execution and set group ID upon execution, respectively) are Unix access rights flags that allow users to run an executable with the permissions of the executable's owner or group. They are often used to allow users on a computer system to run programs with temporarily elevated privileges in order to perform a specific task. While the assumed user id or group id privileges provided are not always elevated, at a minimum they are specific.

Or build busybox with CONFIG_FEATURE_SUID_CONFIG option and try use runtime SUID/SGID configuration via /etc/busybox.conf

config CONFIG_FEATURE_SUID_CONFIG
    bool "Runtime SUID/SGID configuration via /etc/busybox.conf"
    default y if CONFIG_FEATURE_SUID
    depends on CONFIG_FEATURE_SUID
    help
      Allow the SUID / SGID state of an applet to be determined runtime by
      checking /etc/busybox.conf.  The format of this file is as follows:

      <applet> = [Ssx-][Ssx-][x-] (<username>|<uid>).(<groupname>|<gid>)

      An example might help:

      [SUID]
      su = ssx root.0 # applet su can be run by anyone and runs with euid=0/egid=0
      su = ssx        # exactly the same

      mount = sx- root.disk # applet mount can be run by root and members of group disk
                            # and runs with euid=0

      cp = --- # disable applet cp for everyone

      The file has to be owned by user root, group root and has to be
      writeable only by root:
        (chown 0.0 /etc/busybox.conf; chmod 600 /etc/busybox.conf)
      The busybox executable has to be owned by user root, group
      root and has to be setuid root for this to work:
        (chown 0.0 /bin/busybox; chmod 4755 /bin/busybox)

      Robert 'sandman' Griebl has more information here:
      <url: http://www.softforge.de/bb/suid.html >.
share|improve this answer
    
Well, I tried and learned that it does not work. As ifconfig is only as symlink to busybox. That is why I broke my environment. Thank you for your advice –  savruk Feb 23 '11 at 15:42
    
@savruk I update answer –  ooshro Feb 23 '11 at 15:54
    
Making tools like ifconfig setuid root is a terrible idea -- Yes it accomplishes what you asked (you can now run the tool from your browser/CGI scripts), but it also means any user on your system can run the tool & muck about with your network configuration. There are far better ways to go about this, such as a well-written, carefully-controlled intermediate process running as root, or installing sudo. –  voretaq7 Feb 23 '11 at 16:02

What you are asking (exposing SA functions via a web browser) is, in my opinion, a TERRIBLE idea -- You are taking tasks that by their very nature should be under tight security (and in the case of ifconfig have the chance of knocking the machine off the network if you screw up) and opening them up to a broad range of potential attack vectors.

That said, there are a few options open to you, at least 2 of which spring immediately to mind:

  1. Install sudo (this isn't hard), and give your web server user rights to run the commands you need.
    A better option would be to write intermediate scripts that restrict what the user can do and allow the web user to run those. Also you probably want the web server or CGI processes that can use sudo to run as a separate user from your normal web stuff.

  2. Install Webmin or something similar & customize it if needed.
    I'm not a fan of webmin, or really any other web-based interfaces to system administration tasks, but this code is pretty mature and well-tested. If you absolutely must have a web based admin interface you should probably go this route.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.