Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 2 down vote favorite

I want to put a simple CGI script in my APACHE server. I'd like to write it possibly in C (but also in PERL, if I want).

The problem is that it must contain some lines that can be executed only by root (iptables for example), while webuser is the user running the server.

How can I make those lines executable by the root?

share|improve this question

2 Answers

up vote 4 down vote accepted

One solution might be to write a wrapper script for the relevant commands, heavily secure this script and allow a passwordless sudo for this.

Edit: A wrapper script is just some short shell script where you offload the critical commands. You can secure this (e.g. make it aceessible only be the Apache user).

For sudo, there are many questions already on Serverfault and elsewhere, also there is a man page for it: man sudo and man sudoers.

If you have difficulties with this after reading the available docs, you could still ask a question specific to your problem.

share|improve this answer
Thank you. Unfortunately I don't know how to do either of those things (wrapper script, passwordless sudo), but maybe I should ask different questions? – JustTrying Jan 3 at 15:23
@JustTrying: See my edit. – SvW Jan 3 at 18:26
up vote 0 down vote

You could use setuid on the script. An executable with setuid executes as the owner for any normal user. (/bin/ping for example.)

Be very, very careful with this. Make sure the script cannot be overwritten with malicious code, etc.

man setuid

share|improve this answer
Thank you. If I'm not wrong, I can use setuid only if I write the CGI in C, right? – JustTrying Jan 3 at 15:25
I think it works for any executable, as that's how the documentation is written. It doesn't say it specifically has to be a binary. (But admittedly, I didn't test it and have only experience with setuid binaries.) – Aaron Copley Jan 3 at 15:51
"Due to the increased likelihood of security flaws, many operating systems ignore the setuid attribute when applied to executable shell scripts." Well, it says might, so you might have some luck, or you might be able to enable it. Either way, it might not be recommended. People way smarter than me came up with the limitation. – Aaron Copley Jan 3 at 15:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.