1

I'm creating a web app which will allow me to setup shared hosting environments. Everything has to be done programmatically and i'm questioning whether i'm approaching things in a completely insecure way.

At the moment i'm creating bash scripts to install and configure each user, and then executing those scripts from the webserver. However, I keep having to run commands as sudo in the scripts.

For example, after creating a user, I need to log in as that user and download something with wget. In order to get to this point I'm running adduser as sudo, then piping in the password from an environment variable, and then running sudo su to log in as that user. All of that feels very questionable, but I have yet to figure out an alternative.

Any help at all would be much appreciated!

  • You're not the first to do this, but I assume you have reasons you cannot use existing software for some reason. – Ulrich Schwarz Jan 28 at 8:02
  • 1
    sudo can be configured to let you run only certain commands (in your case, adduser), and to not ask you for either the root or user password. You should definitely do this. Even if your configuration machine is entirely safe, it would be another place to fix when you change the password. – Ulrich Schwarz Jan 28 at 8:04
  • 1
    I'm not sure why you need to log in as the new user. root can use chown (or install, which is roughly cp + mkdir -p + chmod + chown) to give files to another user, and this does not require the user to have a valid password at all. Whether anybody ever needs ssh newuser@yourhost with passwords depends on your use case. – Ulrich Schwarz Jan 28 at 8:08
0

The possible solution contains 2 steps:

  • Setup sudo access without a password
  • Use sudo to login as the desired user

Step 1 is described widely.

E.g., https://askubuntu.com/questions/147241/execute-sudo-without-password

Let's assume your user name is "mark" and the target user name is "john":

Execute:

sudo visudo

and add to the end of the file:

mark ALL=(ALL) NOPASSWD: ALL

then save the file

Step 2 is much easier:

sudo -i -u john

That's all. Don't thank :-)

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.