4

When running the following script as user ec2-user, I get the error message iptables v1.4.18: can't initialize iptables table filter: Permission denied (you must be root)

Script:

#!/bin/sh
# Offending IP as detected by mod_evasive
# Add the following firewall rule (block IP)
$IPTABLES -I INPUT -s $IP -j DROP

How can I run iptables as a non-root user to block a IP address?

NB: This script is usually called by mod_evasive

2
  • Be very careful with that, be sure that $IPTABLES var is the right absolute path to the binary. Oct 12, 2014 at 16:01
  • @XavierLucas: The path is correct: "IPTABLES="/sbin/iptables"
    – AlexR
    Oct 12, 2014 at 16:04

4 Answers 4

3

Set the setuid bit on the script, so that it always runs as root.

chown root myscript
chmod u+s myscript
6
  • Hi Michael, when trying to run the script, I do get the error message: command not found. What permissions would I need to change? Any idea?
    – AlexR
    Oct 12, 2014 at 16:02
  • What command is not found? Oct 12, 2014 at 16:09
  • The script itself: When I enter the command in bash: "sudo ban_ip.sh 94.201.234.1xx", I do get: "sudo: ban_ip.sh: command not found". But the script file is there.
    – AlexR
    Oct 12, 2014 at 16:11
  • @AlexR Why are you trying to sudo ? Also if it's not in your PATH you need to use the absolute path ./ban_ip.sh. Oct 12, 2014 at 16:17
  • @XavierLucas: With or without sudo: It does not work. I am in the same directory as the script when trying to execute it.
    – AlexR
    Oct 12, 2014 at 16:19
1

Based on another comment you made here the issue you're experiencing is bash cannot find the script you are trying to run.

When you are running a script or command that isn't in one of the paths defined in your $PATH environment setting you need to provide the absolute or relative path for it. For example:

  • If the script is in /usr/local/bin you need to run /usr/local/bin/scriptname.sh.
  • If the script is in your home directory you need to run either /home/username/scriptname.sh or ~/scriptname.sh.
  • Alternatively you can change into that directory and call it with ./ like so: ./scriptname.sh

Also you can update your $PATH environment setting with the path to the script by modifying .bash_profile, .bashrc, or .profile, depending on what env file you're using.

0

Just add sudo before the command:

#!/bin/sh
# Offending IP as detected by mod_evasive
# Add the following firewall rule (block IP)
sudo $IPTABLES -I INPUT -s $IP -j DROP
1
  • 3
    using sudo to gain root privileges is not the same as accomplishing the task without root privileges... Mar 2, 2016 at 12:44
0

If your script is:

/drop.sh

and looks like this:

#!/bin/sh
exec /sbin/iptables -I INPUT -s "$1" -j DROP

Then add a line to your /etc/sudoers file that looks something like:

www-data ALL=(root) NOPASSWD: /drop.sh

NB if Apache is running as a user besides www-data you'll need to use that username here. This lets the Apache user run your drop.sh

Then finally a wrapper for mod_evasive:

#!/bin/sh
exec sudo /drop.sh "$@"
2
  • What's the point putting the script at the root of the filesystem ? Also, you should always use visudo wrapper instead of editing any sudoers file, that's why it's read-only by default. Oct 12, 2014 at 18:19
  • You can put files wherever you want, but then you need to explain that all the other paths need to change.
    – geocar
    Oct 12, 2014 at 19:05

Not the answer you're looking for? Browse other questions tagged .