Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need for support personnel to be able to open firewall holes via the web. I know this is a permissions nightmare but I have to do it. I have gotten as far as creating a perl program which can do it, but when I run an iptables-restore command from a perl script run from apache through the web I get,

 FATAL: Module ip_tables not found. ... 
 iptables-restore v1.4.3.1: 
 iptables-restore: unable to initialize table 'filter' ... 

I use iptables all the time on this box but apparently without needing the ip_tables module. If I run the same script from the console as root there is no problem. Any help is appreciated.

share|improve this question
    
Are you running this via sudo? or what? –  stew Aug 21 '12 at 18:26
    
No. But I have this as the first line of perl: #!/usr/bin/perl -wT ... then I set the environment ... $ENV{'PATH'} = '/bin:/usr/bin:/sbin:/var/www/cgi-bin:/scripts:'; –  xivix Aug 21 '12 at 18:58
add comment

2 Answers 2

up vote 0 down vote accepted

I would suggest running the perl script using lighthttpd or something similar that will be setup to run as root rather then apache, and also listen on a non-standard port like 12345.

Here is a howto on configurating lighthttpd with perl: http://www.cyberciti.biz/tips/lighttpd-howto-setup-cgi-bin-access-for-perl-programs.html

Also don't forget to comment out server.username and server.groupname in lighthttpd.

To get the security a little better would be good to introduce at least http authentication and limit the IP's that can access this port.

share|improve this answer
    
Thanks :) can lighthttpd run simultaneously with apache? –  xivix Aug 21 '12 at 18:56
    
nevermind ... a quick google search indicates it can ... thanks for the info –  xivix Aug 21 '12 at 19:27
    
Sure it can. Just configure it not to run on the same ports as apache. –  Logic Wreck Aug 21 '12 at 21:10
add comment

I would deploy WebMin for this.

share|improve this answer
    
WebMin used to have a variety of security holes ... is it safe now? –  xivix Aug 21 '12 at 18:59
    
It's a philosophical question, @xivix, nothing can be considered absolutely safe and there can hardly be a piece of software with no security holes. Moreover, no offence, but I doubt a DIY solution is going to be safer. –  Ivan Aug 21 '12 at 19:00
    
how would I do this via WebMin? –  xivix Aug 21 '12 at 19:02
    
That's intuitive - just log-in to WebMin and find the place. I used to do it once, had no problems finding it (but can't remember it now - I need to see it to find it). –  Ivan Aug 21 '12 at 19:04
    
I cannot give support personnel access to webmin which in turn would give them total control of the server. –  xivix Aug 21 '12 at 19:19
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.