1

I am wanting to run some scripts which include iptables rules from Apache (running on port 81 on dd-wrt). I can't seem to get these to work because I lack the permissions. I'm hoping someone can point me at something I missed which does not require recompiling Apache.

I am running dd-wrt v3.0-r33525M kongac (10/16/17). I am running an instance of Apache on port 81.

I can't run Apache as root, because there appear to be compile directives/defaults preventing this behavior.

I can't run the scripts SUID (well, I can, but the SUID bit is being ignored because they are scripts).

I could be wrong, but the version of Busybox does not appear to have sudo functionality.

I can run the script from within the GUI running on port 80, but I would really like to build my own simple interface rather then giving more people access to this and having to run commands rather then just click on a link.

I expect I could do something with cron, but that I expect this will require cron to poll for a file, causing a delay which I would really like to avoid. Likewise I postulate I might be able to ssh to localhost and escalate my privs that way, but it would seem insecure and a lot of work.

Improve this question
8
  • 1
    You could change iptables to be setuid root, or if you prefer use setcap to set whatever capabilities it needs.
    – meuh
    May 17 '20 at 9:35
  • @meuh thank you for this. It was enough to get me over the hurdle. I copied iptables, and set it SUID, and then referred to the copy of iptables in the cgi directory and it worked. (There was another cgi output error which was throwing me off. Also, I cant change the iptables binary because its in an RO filesystem). If you make this into an answer I'll accept it.
    – davidgo
    Aug 1 '20 at 8:15
  • Uh oh. Commands in the cgi directory can be run directly
    – roaima
    Aug 1 '20 at 13:20
  • @roaima of-course, and I'm fine with the security risk posed in this environment - especially as the scripts are simple, well defined, have no user input and are only accessible on the LAN.
    – davidgo
    Aug 1 '20 at 20:20
  • It's not the scripts I'm worried about. It's iptables directly accessible in your cgi directory
    – roaima
    Aug 1 '20 at 20:23
2

As your system is restricted, there are probably few security implications in simply making the iptables binary setuid root. I don't know dd-wrt but the Linux equivalent would be, as root:

chmod u+s /sbin/iptables

assuming the file belongs to root. If the system supports capabilities, a more secure option might be to set the required capabilities:

setcap CAP_NET_ADMIN,CAP_NET_RAW+ep /sbin/iptables

(more might be needed).

As you said in your comment, since the binary is on a read-only filesystem, you need to use a copy of the file.

Improve this answer
1
  • Dd-wrt works as per standard Linux. There was an obstacle that the filesystem - except for a user area - is read-only, so I needed to copy the iptables binary to the user area and use that - giving it setuid. (Maybe I could have symlinked it - didn't try)
    – davidgo
    Aug 1 '20 at 20:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.