0

I've recently been struggling with ways to make a easy way for my father to both mount and unmount a harddrive on a linux based system. I thought of a way to execute a shell script with PHP. The following is what I came up with:

First I made 2 scripts which will take care of mounting and unmounting the harddrive:

unmount_script.sh:

#!/bin/bash

MOUNT="/home/media/externalHardDrive"

if grep -qs "$MOUNT" /proc/mounts; then
  umount "$MOUNT"
  if [ $? -eq 0 ]; then
    echo "HardDrive kan veilig worden verwijderd :D"
  else
    echo "Er is iets mis gegaan, blijf overal vanaf :("
  fi
else
  echo "Er is geen HardDrive gemount op $MOUNT, deze kan daarom niet verwijderd worden!"
fi

mount_script.sh

#!/bin/bash

MOUNT="/home/media/externalHardDrive"

if grep -qs "$MOUNT" /proc/mounts; then
  echo "HardDrive is al gemount op $MOUNT ;)"
else
  mount /dev/sdc1 "$MOUNT"
  if [ $? -eq 0 ]; then
    echo "HardDrive is succesvol gemount :D"
  fi
fi

These 2 scripts will simply check if /dev/sdc0 is currently mounted and perform their tasks if not.

/etc/sudoers:

#
# This file MUST be edited with the 'visudo' command as root.
#
# Please consider adding local content in /etc/sudoers.d/ instead of
# directly modifying this file.
#
# See the man page for details on how to write a sudoers file.
#
Defaults        env_reset
Defaults        mail_badpass
Defaults        secure_path="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"

# Host alias specification

# User alias specification

# Cmnd alias specification

# User privilege specification
root    ALL=(ALL:ALL) ALL

# Allow members of group sudo to execute any command
# %sudo ALL=(ALL:ALL) ALL

# See sudoers(5) for more information on "#include" directives:

#includedir /etc/sudoers.d

www-data ALL=(ALL) NOPASSWD: /home/media/mount_script.sh
www-data ALL=(ALL) NOPASSWD: /home/media/unmount_script.sh
www-data ALL=NOPASSWD: /bin/sh

I've eddited /etc/sudoers in a way so only www-data has permissions to use sh to execute the scripts. Other groups and/or users should not have access to any sudo command.

PHP file:

<?php
if ((substr($_SERVER['REMOTE_ADDR'],0,10) == "192.168.0.") || ($_SERVER['REMOTE_ADDR'] == "127.0.0.1")) {
        if(isset($_POST['mount'])) {
                        $output = shell_exec('sudo sh /home/media/mount_script.sh');
        }

        if(isset($_POST['unmount'])) {
                        $output = shell_exec('sudo sh /home/media/unmount_script.sh');
        }
?>

        <html>
                <head>
                        <title>Control panel</title>
                </head>
                <body style="text-align:center;">
                        <h2>HardDisk Control Panel</h2>
                        <p>Status:</p>
                        <textarea cols="33" rows="10"><?php if(isset($output)) { echo $output; } ?></textarea><br /><br />
                        <form method="post">
                                <input type="submit" name="mount" value="mount" />
                                <input type="submit" name="unmount" value="unmount" />
                        </form>
                </body>
        </html>

<?php } ?>

In this file I assure that requests made from another ip-range than 192.168.0.* are bieing ignored. If the user is within the 192.168.0.* ip-range I allow the user to execute the script with sudo privileges.

Can somebody please check this configuration for security concerns that I should fix?

I am running all this on a Debian Server

2

You should make an entry in your /etc/fstab file (as per your other question) with a UUID=xyz or LABEL=somelabel identifying your drive instead of using /dev/sdc1 in your scripts (BTW, in the other post you use /dev/sdc0).

On that line you also specify noauto,user as options, so that a normal user on the system can mount the drive. That takes care of the largest security concern that I can see, namely that you need to run some script with root priviliges.

After that you can just concentrate on nobody getting access to the PHP pages that is not allowed to, but at least if your security there fails, then there are not scripts that could contain a trapdoor (which is probably more likely than mount, which is run SUID root and used anyway, having one)

I haven't looked at the actual scripts, so they might contain errors, these are just general principles which I think you should observe. Hopelijk helpt je dat een beetje.

| improve this answer | |
  • Well the scripts are working properly and they're not very complex so I assume there are no errors there. Furthermore Thank you very much for the answer on this question and the other question i've asked. noauto,user is a very good idea :D I will be trying this tonight :) – Sander Koenders Nov 7 '14 at 8:54
  • This issue was solved thanks to this post, for more information also see link – Sander Koenders Nov 7 '14 at 9:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.