Under a controlled environment, I will try to execute some calls to shell, some of such commands will include sudo privileges.
I tried this php code line:
$out = shell_exec('sudo -u root -S ls < /home/user/.y/.qqz');
Where at last .qqz is a file containing actual password.
However apache log shows this output:
[sudo] password for www-data:
Like the password file is not being passed to the command stdi?
I already made www-data part of the sudo group. How can I get my objective done?
Related
I have a script which I want to call from my PHP code. The following is the script file I have:
listwifi.sh
sudo iwlist wlp1s0 scan | grep SSID
To this I've also given executable permission by using sudo chmod +x listwifi.sh
The following I've added at the end pf my sudoers file (using visudo):
apache ALL = NOPASSWD: /var/www/html/mypath/osscripts/listwifi.sh *
www-data ALL = NOPASSWD: /var/www/html/mypath/osscripts/listwifi.sh *
I had also tried with :
apache ALL = NOPASSWD: /usr/bin /var/www/html/mypath/osscripts/listwifi.sh *
www-data ALL = NOPASSWD: /usr/bin /var/www/html/mypath/osscripts/listwifi.sh *
I'm using the following PHP code to call this file:
exec(getenv('BASE_DIR') . "/osscripts/listwifi.sh", $output);
var_dump($output);
But I keep getting the following error:
sudo: a terminal is required to read the password; either use the -S option to read from standard input or configure an askpass helper
How can I make PHP execute this file as root without having to enter the password?
Take the sudo out of the script and call the script as
sudo /var/www/html/mypath/osscripts/listwifi.sh
The sudoers configuration is for the command being invoked via sudo, not where it's invoked from...
I am using ubuntu server 20.04 LTS, where I have multiple shell files, using php from apache I need to run multiple shell files from a browser but need to run as root.
I have tried the command shell_exec and added sudoers (www-data) and none works, which I can put in the code to enter as root and be able to execute the shell script.
<?php
$code = shell_exec('echo "passwd" | sudo -u root -S sh /home/user/name.sh');
echo "<pre>$code</pre>";
?>
Because your are executing this script as www-data and www-data doesn't have the required privilege to execute any sudo commands.
You can try the following steps.
Modify www-data in /etc/sudoers to be able to execute a script as the superuser. This is a sensitive file and you have to use visudo as the editor to make the changes.
$ sudo visudo -f /etc/sudoers
www-data ALL=(ALL) NOPASSWD: /home/user/name.sh
This will allow www-data to execute the script as the superuser without a password.
In your PHP code change the command in your shell_exec() as follows:
$code = shell_exec(sudo sh /home/user/name.sh');
Make sure your name.sh is set up with proper file modes to protect yourself.
I get this error when running a program from www-data.
Error
sudo: no tty present and no askpass program specified
But I have added the following to sudo visudo
www-data ALL = NOPASSWD: /var/bin/poppler-0.65.0/build/utils/pdfimages
The path /var/bin/poppler-0.65.0/build/utils/pdfimages is correct.. I have tested it from a terminal.
Command
sudo /var/bin/poppler-0.65.0/build/utils/pdfimages -list
data/scan_voucher/17.pdf
As you said that already setting up sudo visudo correctly, I will first take a look at Tarun Lalwani links, specially the part about disable requiring tty in your sudoers :
Defaults !requiretty
Try to do the same command but with flag -S actived (sudo -S yourcommand)
The -S (stdin) option causes sudo to read the password from the
standard input instead of the terminal device.
If it doesn't work for you, you can try a trick that seems to work like this one (from here):
echo '' | sudo -S your_command
That will send an empty password to first prompt to enter password.
How are you executing this from PHP? Try with:
#exec("sudo /var/bin/poppler-0.65.0/build/utils/pdfimages -list data/scan_voucher/17.pdf");
Hope that it helps!
I am trying to run a shell script from a PHP script.
PHP code :
<? php
$sss = escapeshellarg('virtualbox');
$result = shell_exec("/home/hani/Desktop/launchscript.sh '$sss' 2>&1 ");
echo "<pre>$result</pre>";
echo "<br />";
echo (shell_exec('whoami'));
?>
my shell script :
#!/bin/bash
sss=$1
echo 'the sudo password' |sudo -S service $1 restart
After I run the PHP code in a web server (Xampp), I got this output :
[sudo] password for daemon: Sorry, try again.
[sudo] password for daemon:
sudo: 1 incorrect password attempt
daemon
Although, I haven't set any password for the daemon user.
And after I checked the current user running the PHP code I found it is daemon.
After many researches here and in the net, I found that daemon can't run sudo commands.
I also found that I can fix this by editing the sudoers file and giving permissions to the daemon user to run sudo commands. However this is not a secured solution.
so my question is : How to run that script via the PHP code but not as a daemon?
PS : I tried this in order to change the current user running the PHP file :
$result = shell_exec(" sudo -u hani /home/hani/Desktop/launchscript.sh '$sss' 2>&1 ");
But I got this output in the browser :
sudo: no tty present and no askpass program specified
and the user remains daemon.
I am using Xampp in Ubuntu 16.04
Another information, I run this command in the terminal to know the owner of the 'httpd' service :
ps -ef | egrep '(httpd)' | grep -v `whoami` | grep -v root | head -n1 | awk '{print $1}'
the output is : daemon
I think i found a solution ( but still not sure about the security issues).
It only needs to change the default user (owner) and group of the httpd service. This can be done by editing the httpd.conf located in /opt/lampp/etc (if you are using Xampp). The default user, as I mentioned in the question, is daemon. However it has not permissions to run sudo commands, so it only needs to change that user by another one who has the permissions to run sudo commands (obviously the root user or your deafult user in Ubuntu).
a better way is give daemon access to run the one particular script you want
edit the sudoers file
sudo visudo
add in the following line (change the path to the script you want to run)
daemon ALL=(ALL) NOPASSWD: /home/ubuntu/scripts/script.sh
If I am executing multiple commands like this
'sudo -s && cd /apps/10.0.10.200/wso2am-1.7.0/repository/logs && tail wso2carbon.log'
But when i'm login to the server with my user, i have to get the root permission by executing following command
sudo -s
And then I have to reenter the password also.
So my issue is when I execute above command, how can I pass my password.Because I have to execute the command and wait until it asks to enter the password.
please guide me on that to solve.
this is my code.
include('Net/SSH2.php');
$ssh = new Net_SSH2('10.0.10.200');
$ssh->login('xxxxx', 'xxxx') or die("Login failed");
echo $ssh->exec('sudo -s && cd /apps/10.0.10.200/wso2am-1.7.0/repository/logs && tail wso2carbon.log');
This is a very bad idea as long as you will need to keep the user's password in your code which represent a non-negligible security issue (full remote access to the ssh server). You should have a special account on the ssh server you are connecting to that would only allow access to the log file you want to show.
However if you take a look at this superuser question or run sudo --help. You'll see that you can use sudo -S to get the sudo command to read the password from stdin.
so this should do the trick:
$echo <password> | sudo -S <command>
using php:
echo $ssh->exec('echo '.$password.'| sudo -S tail /apps/10.0.10.200/wso2am-1.7.0/repository/logs/wso2carbon.log');
Go to your server and provide sudoers permission without password to your user.
This is highly insecure but you can edit you /etc/sudoers by using command sudo visudo
This command will open the /etc/sudoers file in the terminal now you can add you user entry in it using below line for executing sudoers command without password :
<user_name> ALL=NOPASSWD:ALL
Replace user_name with your user name in above line.
If your syntax goes wrong you can damage your sudoers file and hence won't be able to execute the sudo command.
If that happens use this command to rebuild your sudo file:
pkexec visudo
Then enter the sudo password.