Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Using Apache, I'd like to be able to start and stop a service on the same server. Essentially, I'm looking for a way to allow Apache (or some script called by Apache) to call sudo service XXXX start.

I realize there are severe security implications with this, and I'm looking to minimize the possible effects. There is only a single service that I need to do this for. I've seen some solutions that involve "hacking" the setuid (C/Perl wrapper), others involved editing the /etc/sudoers file.

Is there a better way?

many thanks, S.

share|improve this question
    
On the apache side, you want to protect this using digest authentication AND SSL. If at all possible, use a client certificate. –  adaptr Oct 24 '12 at 14:24

1 Answer 1

up vote 2 down vote accepted

I suggest letting the www-data-user use that one init.d-script as sudo without password by adding this to your /etc/sudoers

www-data ALL=(ALL) NOPASSWD: /etc/init.d/theinitscript

And then use sudo /etc/init.d/theinitscript start instead of the command service.

share|improve this answer
    
That did it. I changed "apache" to "www-data". THANKS! –  user142512 Oct 24 '12 at 14:33

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.