Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I am programming a small webinterface to control samba on Debian (kernel 2.6.32-5-686). I started by writing simple scripts to add users, create folders, etc. They worked fine when run as root. However, when run via web (apache + php) by using php: shell_exec() some of them didn't work. They look like this:

#!/bin/sh
#archive the userprofile
cp /home/samba/profile/$1 /home/samba/archive/$1
smbpasswd -LU $1 -x
userdel $1 
exit 0

I tried using sudo to run the scripts, which doesn't seem to work. I added this line: (jupiter is the servers name)

%sudo jupiter=(ALL)NOPASSWD:/bin/<script>

to the /etc/sudoersfile, gave my www-data user the sudo group, nothing.

Then I read somewhere I should chmod 4755 and chown the scripts. It still didn't work.

At this point I was curious what the problem was and I redirected the STDERR to a file. I ran one of the small scripts, which would call cp, smbpasswdand userdel to delete the user and archive his share. All calls returned the exitcode 1, which AFAIK indicates that something went wrong. STDERR gave me a little clue:

userdel: cannot lock /etc/passwd; try again later.

This seems to be caused by some *.lock files, but there are none in my /etc/ folder.

At this point I got kinda frustrated and tried giving the www-data more root rights by adding it to the root group. Things still didn't work.

So far for my progress, I have no idea what to do next. My question is: How do I get simple scripts which seem to need root priveliges to run via the www-data user? I think it might be a problem with the /etc/passwd file, as I can imagine only the root-user has the right to alter it.

share|improve this question
    
Also you shouldn't put custom scripts in /bin. Custom scripts should be going into /usr/local/bin instead. This is to prevent possible conflicts with the package manager and also because it's the standard path as defined by the FHS. The world won't explode if you don't, but it's a good practice. –  Patrick Sep 11 '12 at 12:14
    
Thank you @Patrick, I fixed it. –  skiddo Sep 11 '12 at 13:00

1 Answer 1

up vote 1 down vote accepted

my answer is only related to the line

sudo jupiter=(ALL)NOPASSWD:/bin/<script>

With this line you allow user sudo to run /bin/<script> on host juptier as any user without authentication. I don't think that you want this.

If i have understood correctly you want the user www-data to execute /bin/<script> as root. In this case the appropriate line looks like

www-data jupiter=(root) NOPASSWD:/bin/<script>

Now you can execute /bin/<script> as www-data with root privileges by invoking

www-data:~ $ sudo /bin/<script>

or via shell_exec("sudo /bin/<script>") in your php-script (I hope you cared about security issues).

For further details look at man sudoers or the online version sudoers.man. For a quick understanding i recommend to take a look at the EXAMPLES section.

share|improve this answer
    
Thank you for pointing out my mistake. I corrected the sudoers file. However, I now get the message sudo: no tty present and no askpass program specified. BTW: I forgot the % in my first post. –  skiddo Sep 11 '12 at 11:45
    
Maybe requiretty is set in your /etc/sudoers? For more information see man sudoers as well. –  user1146332 Sep 11 '12 at 11:55
    
requiretty is not set, but there was a ` symbol in my etc/sudoers, because I forgot to edit it with visudo. It works now. Thank you. –  skiddo Sep 11 '12 at 13:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.