37

I'm trying to build a firewall manager in PHP, but when I execute, <?php exec('iptables -L'); ?>, the result array is empty.

I have tried, <?php echo exec('whoami'); ?>, and the response is www-data (the user that Apache is using). What can I do to execute the exec function as root? (Preferably without changing the Apache user.)

5
  • simply run apache as root? that seems to be the only solution.
    – mauris
    Commented Oct 21, 2009 at 1:13
  • @Mauris to do that... you need run apache as root.. are you sure thats is what you want to do? Commented Oct 21, 2009 at 1:17
  • yeah that's why i really doubt if we want to do that.
    – mauris
    Commented Oct 21, 2009 at 2:06
  • 31
    Just the title alone had already made me very very afraid!
    – bobince
    Commented Oct 21, 2009 at 2:21
  • You should not give www-data root permissions this is a massive security risk, please see my answer below as an alternative
    – confused
    Commented Aug 20, 2021 at 8:55

8 Answers 8

38

Don't do it! You will leave yourself wide open to all sorts of malicious hackery.

Have a look at the "sudo" documentation.

You should be able to set up all the commands you need as "sudo"able scripts. It is much better to write specific scripts with limited functions than to expose the underlying priviledged command.

As in:

exec ('sudo getIpTables.ksh')
5
  • you can limit sudo functions.
    – LiraNuna
    Commented Oct 21, 2009 at 1:26
  • 2
    Sudo is the solution I used when faced with a similar problem. These SO questions served as useful references: stackoverflow.com/questions/113728/… stackoverflow.com/questions/349884/… Commented Oct 21, 2009 at 2:07
  • 1
    sudo asks a password. How can I give it the password via PHP? Seems impossible... Commented Nov 12, 2013 at 2:09
  • 1
    @Fredrico -- take a good look at the "sudoers" documentation you can specifiy NOPASSWD for a combination of user/group and command Commented Nov 12, 2013 at 7:18
  • 1
    I think that even sudo is limited when You have to do with stuff like change a password for another user different then httpd user using for example passwd command. It just won't work because some commands require root privileges and doesn't rely on sudoers Commented Mar 3, 2018 at 19:19
16

I know this is an old question

add the user php runs on to the sudo group if it is not already assigned

use sudo -S, so you can pass the password via echo

$exec = "echo your_passwd | /usr/bin/sudo -S your command";
exec($exec,$out,$rcode);

if you have trouble with the paths - use

"bash -lc 'echo your_passwd | /usr/bin/sudo -S your command'"

so you get a new bash that acts like a login shell and has the paths set

check the man pages of sudo

2
  • 1
    Lifesaver! Thanks lumos!
    – GTodorov
    Commented Apr 18, 2016 at 3:50
  • I use Cpanel, login to SSH via a user, get me: -bash: /usr/bin/sudo: No such file or directory Commented Aug 13, 2021 at 23:48
13

You can run sudo through phpseclib, a pure PHP SSH implementation:

<?php
include('Net/SSH2.php');

$ssh = new Net_SSH2('www.domain.tld');
$ssh->login('username', 'password');

$ssh->read('[prompt]');
$ssh->write("sudo command\n");
$ssh->read('Password:');
$ssh->write("Password\n");
echo $ssh->read('[prompt]');
?>
4

You can put the required commands in a separate script/executable file (sh, PHP, a real executable, doesn't matter), change its owner to root, and apply "setuid" to it.

This will allow anything and anyone to run this script as root, so you need to make sure that it has it's own security rules for seeing if this is allowed, and is very restricted in what it does.

3

This is very unsafe and a bad idea. Rethink your design. If you really want to do this use sudo as advised. An alternative solution might be to go ahead and run as root but do so inside a chroot or a vm image (both of which can be broken out of but still).

Or best of all run as sudo inside a chroot!

3

Unless you use suphp and configure it to run as root you wont be able to run any PHP script on behalf of any other system user besides who is running PHP.

Edit:

Just an small idea. Add a queue process in some way and run a cron process in the root's crontab.

Please please be really careful about this. Any injection can literally destroy the system.

2

I recently published a project that allows PHP to obtain and interact with a real Bash shell. Get it here: https://github.com/merlinthemagic/MTS

After downloading you would simply use the following code:

$shell    = \MTS\Factories::getDevices()->getLocalHost()->getShell('bash', true);
$return1  = $shell->exeCmd('iptables -L');
//the return will be a string containing the return of the command
echo $return1;
-2

Just an assumption - Is this a PHP web app that will do this? This doesn't sound too safe. The app that needs root - could you build that separately and then invoke it from PHP? If not, maybe you can sudo the process so it can run as root.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.