Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If we add the following lines to sudoers:

Defaults    requiretty
Defaults:apache !requiretty
apache ALL=NOPASSWD: /etc/init.d/httpd graceful

What are the security implications?
My understanding is that: "web users" can gracefully restart the httpd server if they can manage an injection?

Any other dangers?

share|improve this question
add comment

1 Answer

requiretty indicates that sudo may used even if there is no interactive shell/session.

The security impact depends on the system settings. If the apache user could write to /etc/init.d/httpd or change the behaviour of the init-script by changing some parameters in /etc/defaults an attacker could do just everything.

You should not give your web-server any higher privileges on the system as long as it is really needed.

share|improve this answer
    
What do we mean by "writing to /etc/init.d/httpd" ? –  Haluk Oct 12 '12 at 12:21
    
Writing like modifing the file @Haluk –  Thomas Berger Oct 12 '12 at 14:38
    
I still don't follow. Isn't httpd a compiled binary file. How can you write to it? I've googled "writing to httpd" and some other versions, no luck with that either. And more importantly, what "system setting" would grant me the access to write to httpd? –  Haluk Oct 12 '12 at 21:50
    
But the /etc/init.d/httpd is a script. You should learn the linux basic, before doing thinks like giving sudo to the www user! –  Thomas Berger Oct 12 '12 at 21:52
    
Thank you I didn't know this. I read the script now. From what I understand if someone could modify the httpd script they can pretty much mess up all web folders without any additional privileges? And since we are only giving privilege to the "graceful" option. The attacker would also need to be able to read our sudoers file to find out our vulnerability? Or is the danger coming from Defaults:apache !requiretty? –  Haluk Oct 13 '12 at 8:51
show 1 more comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.