2

I have shell script called copy.sh in my web root directory with following lines on it

rsync -rzv -e 'ssh -p 199'  test.txt [email protected]:/home/testuser/txt
ssh  [email protected] -p 199 . /home/testuser/lty.sh > ltylog.txt 2>&1

This script first copy text file to my remote server and run the shell script to sync that file across other two servers. I generate ssh public/private key for testuser in my current server and copy to the remote server. I can ssh to remote server without any password

ssh [email protected] -p 199 

I can run above command and can get in to my remote server. In my host machine when I'm in testuser I can execute that shell script without any issues. It copy the files and run the remote script. I set my script permission as 777 for now. But I need to run this script using PHP by running shell_exec like this

<?php
shell_exec('. /var/www/html/copy.sh');

echo "<pre>";
echo file_get_contents("ltylog.txt");
echo "<pre>";
?>

But when I run this PHP nothing happens. because I think the user who executing the shell script is Apache user instead of test user. but instead of running shell script when I shell_exec PWD or something it running flawlessly. I disabled the php safe mode and give 777 permissions for all the files. but still I can't get this worked.

P.S I know this is big security risk putting shell scripts on the web root with permissions. but this is not prod system and I'm testing small web application for our internal purposes. server I executing this has no internet access at all. could someone help me to fix this. I'm looking for small solution. since this small web app only used by one or two persons. thanks

2 Answers 2

2

If I understood your issue correctly and you don't care about security risks, you can install sudo, add "www-data" (www-data is a default user used by nginx/apache) to the sudoers file with all permission and no password required and use it to execute a command as another user.

You can do it like this:

Install sudo:

apt-get install sudo

Then add the user to the config:

nano /etc/sudoers

Add this in the last line:

www-data ALL=(ALL) NOPASSWD: ALL

And finally you can edit your php to perform a command with sudo:

shell_exec('sudo -u testuser /var/www/html/copy.sh');

@Edit

I have managed to make it work on my server. Just follow these steps and it should work for you as well.

  1. Try replacing your PHP code with this:

    <?php
    echo shell_exec('/bin/sh /var/www/html/copy.sh'); #this will display the result in your browser
    
    echo "<pre>";
    echo file_get_contents("ltylog.txt");
    echo "<pre>";
    ?>
    
  2. Then make sure that www-data has access to copy.sh file:

You can either give it a 777 chmod like this:

    chmod 777 /var/www/html/copy.sh

or you can make the file belong to user www-data (used by apache):

    chown www-data:www-data /var/www/html/copy.sh

but if you choose to use the second option, make sure that www-data still can execute the file by applying chmod like so:

    chmod 755 /var/www/html/copy.sh
  1. Make the file executable:

    chmod +x /var/www/html/copy.sh
    
  2. change the copy.sh code to this:

    rsync -rzv -e 'ssh -p 199'  test.txt [email protected]:/home/testuser/txt
    ssh  [email protected] -p 199 /bin/sh /home/testuser/lty.sh > ltylog.txt 2>&1
    
  3. Finally, make sure that testuser hass access to the following files:

    • /home/
    • /home/testuser/
    • /home/testuser/lty.sh
    • /home/testuser/ltylog.txt

If you don't care about security, you can simply type this in the console of a remote server

    chmod 777 -R /home/

Or you can check each file manually to make sure that the permissions are set right.

5
  • Not working !! I think testuser still need passwors. www-data may cant switch to testuser for executing script
    – sameera
    Aug 25, 2017 at 3:17
  • Can i please ask you to explain more clearly what exactly do you want to achieve. Do you want to run a php script via browser to execute an .sh file?
    – Bumba laga
    Aug 25, 2017 at 3:20
  • yes exactly. but that shell script need to connect remote host to run another shell script. for that I create testuser with password less auth. I can run copy.sh with testuser but not with php
    – sameera
    Aug 25, 2017 at 3:41
  • make sure that "testuser has access to the following files/directories: /home/ /home/testuser/ /home/testuser/txt /home/testuser/lty.sh /var/ /var/www/ /var/www/html/ /var/www/html/copy.sh
    – Bumba laga
    Aug 25, 2017 at 3:58
  • As you know it's possible to restrict sudoers such as www-data to only be able to execute certain files such as /usr/bin/mail. Is there a way to do this in this situation? This would be better than ALL. Also, if my server is completely locked down and nobody can access it without SSH PKA then is there anything to worry about giving www-data ALL access? What, if any, security hole does this open up if there are no users with SSH access to the server? Does this make NGINX or Apache vulnerable in any way on port 80 or 443 when giving www-data ALL sudo rights?
    – mcmacerson
    Apr 8, 2021 at 18:25
0

If I understand correctly, you want to execute a script as the owner of the file, not as the current user (the apache user).

If that's what you want, you might be interested by setuid.

A brief summary of how it works was posted previously.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .