2

I have an Ubuntu 12 web server running apache2, I developed a graphic interface using PHP to make users able to create their own email account by themselves ( exec() function), so I used visudo to let apache only execute some commands ( useradd) with root privileges as follow

www-data ALL=NOPASSWD:/usr/sbin/useradd

I wonder if someone can show me security impact on the server of such manipulation

  • I would say that is a very bad idea. Your web i/f is allowed to create system accounts with whatever UID/GID it wants. This means that a user could create an account that has root privileges, and would be able to own your box. – slm Feb 17 '14 at 21:03
  • Games can also be played if you're not cautious in what usernames are allowed to be passed in. Someone could do a username like this: "username; rm -fr /" for example, and this command would finish off the useradd, and then run their tag along command of rm -fr *. – slm Feb 17 '14 at 21:05
  • 1
    @slm I have a function to valid inputs so special char are not allowed – ISMAIL Feb 18 '14 at 15:18
  • There are often times libraries for sanitizing input, I would encourage you to use one of those if you can. – slm Feb 18 '14 at 17:17
  • @slm give me a shine please. – ISMAIL Feb 18 '14 at 23:23
2

You can create other users with uid=0, gid=0 and a shell. So they are just the same as root but with different name and have not password assigned.

Normally you'd need a wrapper: A shell script for users with a special group and /bin/false as shell.

  • what about security impact of my method ? – ISMAIL Feb 17 '14 at 20:09
  • it depends on your requirements, if you don't want to have many users with root rights then it is a security flaw. – user55518 Feb 17 '14 at 20:39
  • i used visudo so apache can only execute specified cmds, in my case "adduser" – ISMAIL Feb 18 '14 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.