I have a home webserver I muck around with, mainly for learning and testing. I use Apache2 on Debian Bullseye.
One of the things I have been playing around with is running Bash scripts from the webserver with php. Some of these scripts require sudo as they do things like kill a users session, or start or stop a virtual server in apache.
The scripts are all outside of the public directories and are owned by a user account, with www-data the group. The permissions are; owner=rwx, group=x, other=nothing.
The www-data user has sudo access with the line
www-data ALL=(root) NOPASSWD: /path/to/scripts.sh
I have read on a few posts that it is a bad idea to give the webserver sudo access, but cant think of a better (safer?) way. I have considered setuid but unsure if this considered a safer alternative.
If I have to run a script with elevated privileges what would be the secure way? Or is sudo with only specific scripts allowed the best way?