Enabling shell script to run as different user with PHP

Question

I have shell script called copy.sh in my web root directory with following lines on it

rsync -rzv -e 'ssh -p 199'  test.txt [email protected]:/home/testuser/txt
ssh  [email protected] -p 199 . /home/testuser/lty.sh > ltylog.txt 2>&1

This script first copy text file to my remote server and run the shell script to sync that file across other two servers. I generate ssh public/private key for testuser in my current server and copy to the remote server. I can ssh to remote server without any password

ssh [email protected] -p 199 

I can run above command and can get in to my remote server. In my host machine when I'm in testuser I can execute that shell script without any issues. It copy the files and run the remote script. I set my script permission as 777 for now. But I need to run this script using PHP by running shell_exec like this

<?php
shell_exec('. /var/www/html/copy.sh');

echo "<pre>";
echo file_get_contents("ltylog.txt");
echo "<pre>";
?>

But when I run this PHP nothing happens. because I think the user who executing the shell script is Apache user instead of test user. but instead of running shell script when I shell_exec PWD or something it running flawlessly. I disabled the php safe mode and give 777 permissions for all the files. but still I can't get this worked.

P.S I know this is big security risk putting shell scripts on the web root with permissions. but this is not prod system and I'm testing small web application for our internal purposes. server I executing this has no internet access at all. could someone help me to fix this. I'm looking for small solution. since this small web app only used by one or two persons. thanks

Answer 1

If I understood your issue correctly and you don't care about security risks, you can install sudo, add "www-data" (www-data is a default user used by nginx/apache) to the sudoers file with all permission and no password required and use it to execute a command as another user.

You can do it like this:

Install sudo:

apt-get install sudo

Then add the user to the config:

nano /etc/sudoers

Add this in the last line:

www-data ALL=(ALL) NOPASSWD: ALL

And finally you can edit your php to perform a command with sudo:

shell_exec('sudo -u testuser /var/www/html/copy.sh');

@Edit

I have managed to make it work on my server. Just follow these steps and it should work for you as well.

1. Try replacing your PHP code with this:

   <?php
   echo shell_exec('/bin/sh /var/www/html/copy.sh'); #this will display the result in your browser
   
   echo "<pre>";
   echo file_get_contents("ltylog.txt");
   echo "<pre>";
   ?>
   

2. Then make sure that www-data has access to copy.sh file:

You can either give it a 777 chmod like this:

    chmod 777 /var/www/html/copy.sh

or you can make the file belong to user www-data (used by apache):

    chown www-data:www-data /var/www/html/copy.sh

but if you choose to use the second option, make sure that www-data still can execute the file by applying chmod like so:

    chmod 755 /var/www/html/copy.sh

3. Make the file executable:

   chmod +x /var/www/html/copy.sh
   

4. change the copy.sh code to this:

   rsync -rzv -e 'ssh -p 199'  test.txt [email protected]:/home/testuser/txt
   ssh  [email protected] -p 199 /bin/sh /home/testuser/lty.sh > ltylog.txt 2>&1
   

5. Finally, make sure that testuser hass access to the following files:

   • /home/
   • /home/testuser/
   • /home/testuser/lty.sh
   • /home/testuser/ltylog.txt

If you don't care about security, you can simply type this in the console of a remote server

    chmod 777 -R /home/

Or you can check each file manually to make sure that the permissions are set right.

Answer 2

If I understand correctly, you want to execute a script as the owner of the file, not as the current user (the apache user).

If that's what you want, you might be interested by setuid.

A brief summary of how it works was posted previously.