Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I asked this question about six months ago and I thought I might get better responses here.

I have a website written almost exclusively in javascript (HTML canvas), and a MySQL database managed via PHP. Serverside, scripts I execute are axecuted as user www-data. Now suppose I want to create a new linux account as well as adding the user's name/password to the database. How would I automate this?

The actual functionality I would like extends to also creating groups for the user, creating a skeleton directory for the home folder, and having read/write access to their home folder and sub folders. In essence, I need to execute certain commands as root but I obviously can not type them in from a keyboard.

One idea I had was to set up a /home/www-data/.ssh/ folder with keyless ssh login to root, but I am worried that is giving too much power.


Mad Hatter pointed out that this is a potential duplicate of this question so I am refining my original question.

In my website each user is allowed to create their own scripts and execute them. There is a complex library created, which can dynamically load javascript scripts, execute them, almost always redrawing the HTML Canvas element. In addition to this, they can create PHP scripts.

Because the user can create their own PHP scripts, I can't just hand over root access for creating new users to www-data (by editing the /etc/sudoers file). What I want is a way to execute the below command/PHP script when the user is registering (therefore connecting as user www-data)

shell_exec("sudo useradd J.C.Denton");

But avoid the situation where, afterwards, a user writes a PHP script to use the above PHP file to start creating their own users.

My ideal scenario would be to be able to log in a user not only as a PHP session and give him access to only elements of the SQL database he/she has rights to, but to actually log him into the Apache server as, in this case, J.C.Denton

share|improve this question
1  
Does incron help? –  quanta Nov 4 '11 at 7:04
    
possible duplicate of how do i perform root actions from non-root account? –  MadHatter Nov 4 '11 at 7:17
    
I suppose that's a way to get around it. It's not ideal, however, to listen for changes to every table. –  puk Nov 4 '11 at 7:20
    
@MadHatter you are right, it is a duplicate. I will refine my question. –  puk Nov 4 '11 at 7:26

2 Answers 2

Have you considered using something like pam_mysql or pam_ldap and put the user account information to database? That way you can separate your system accounts (local /etc/passwd) from your user accounts, increasing both flexibility and security. Managing your users would happen via MySQL, no root access needed.

pam_mkhomedir would then create the home dir (and needed skeleton files) upon first login.

Thanks to PAM most of the services I can imagine (shell access, e-mail, [s]ftp, www...) can use pam_mysql or pam_ldap transparently, your end users will not notice that in any way.

share|improve this answer
    
I googled pam_mysql and pam_ldap but they were no help. I take it what you are suggesting is I copy file permissions to the database...right? –  puk Nov 4 '11 at 8:01
    
No. What I'm suggesting is that you would use pam_mysql to store user information, just like it usually goes to /etc/passwd and /etc/shadow. –  Janne Pikkarainen Nov 4 '11 at 8:11
    
For what purpose? I need to, for example, call /home/J.C.Denton/helloWorld.php or rm /home/J.C.Denton/helloWorld.php. How would having password access move me in that direction. –  puk Nov 4 '11 at 8:15
    
unrelated, do you know why sometimes I can respond to someone's comment with the ampersat sign (ie. _AT_Janne Pikkarainen) but at other time's I can't? –  puk Nov 4 '11 at 8:16
    
For exactly that purpose. PAM (Pluggable Authentication Module) is taking care for everything that is related to security: authentication, authorization and so on. Using pam_mysql IS same than storing your information to /etc/passwd and so on. /etc/passwd, /etc/shadow and /etc/group are much more than "having password access". They are used for mapping filesystem UIDs to user/group names and so on. Just believe me when I say pam_mysql and pam_ldap are widely used; they make life lots easier when you have more than one server and access rights need to be consistent. –  Janne Pikkarainen Nov 4 '11 at 8:24

You can't "actually log him into the Apache server as, in this case, J.C.Denton" because unless you implement the relevant constructs within your application the functionality does not exist. While you can use HTTP authentication - this does not provide all the other parts necessary for a security model.

You're trying to deal with 3 different security models here

  • unix user security for filesystem access
  • mysql security for data access
  • application security within the web application

Yes, rationalizing these potentially conflicting models should be high on your list of design priorities - but should you really be basing it around the Unix permissions model? There are tools for extending this into the application domain using PHP - but it's not the only solution.

Leaving that aside for the moment, on a Unix/Linux/POSIX system creating users from the command line is simple - but there are some caveats. Similarly you can create mysql users using SQL. But note that the pam_mysql module which I know about does not use MySQL's authentication and user management functionality - but merely provides a repository for authentication data.

Bundling all this into a single shell or php script is trivial. The only caveat is that if you want to invoke this from something other than a shell owned by root, then you should still make it only readable/executable by root, but configure sudo to allow it to be run, e.g. from the webserver.

So to make your model work, you need to plan out how you're going to structure the Unix permissions in a bit more details and use suPHP.

share|improve this answer
    
I guess I could go with suPHP and compare the MySQL user's name/groups and see if they have read/write/execute permissions over that file, and if they do, give them access to it. –  puk Nov 4 '11 at 9:18
    
No - you've missed the point - either you implement the security yourself (in which case your code would "see if they have read/write/execute permissions over that file, and if they do, give them access to it") or you use an existing security system. –  symcbean Nov 7 '11 at 11:57
    
I think my comment was valid. I will use an existing security system (in this case suPHP) and implement some of the security myself (in this case, the initial check in MySQL to ensure logged in user has rights to file they are accessing). –  puk Nov 7 '11 at 17:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.