3

Situation:

I'd like to execute a shellscript directly from a web-gui. The shellscript belongs to the user "tux". Since my webserver is running as apache, I can't execute tux's shellscript. OS: CENTOS

What I've tried:

su -c "/opt/tomcat/bin/shutdown.sh" -s /bin/sh tux

I tried different ways, the mentioned one is how it worked when i was logged in as root user.

Question:

Is there a way to do the same while not being root? Something like a command where I can pass the user AND its password to execute the script.

I can't just change the ownership of the script because it's depending on tux's profile (other files, directories).

Thanks very very much in advance for your help!

Yanik
  • 143
  • 1
  • 11

2 Answers2

1

Try this:

echo "$pass" | sudo -S -u $user script

$pass is you password, $user is the user who wants to run the script. (This user must have permission to run the script.)

If your user doesn't have permission, then try running as group:

echo "$pass" | sudo -S -g $group script

This group must have permission to run the script.

Note: Passing password like this isn't a good idea.

If your user can't use sudo:

If your user can't use sudo then you can't run the script by switching users with sudo. You should consider executing the script with this non-sudo user account. And for that, this user must have permission to execute the script.

One way to do that is to change permission of the script to 755 (from sudo user):

Then you can execute the script by entering the path in terminal. (if your script depends on relative path, make sure to cd to the parent directory of the script before running it)

Note: This will permit any user to execute the script (without any authentication)

Another way is to add the non-sudo user into a group which has permission to execute the script:

In this case, permissions like:

chmod ug+rwx,o-x+r script
#read write xecute permission to user and group and readonly to others

and

chmod u+rwx,g+rx,o-x+r
#read write xecute to user and rx to group and readonly to others

and so on where group have the right to execute the file will do the trick. It's more secure than using a 755 permission.

The steps to go through with this process:

1.Log in to the user account which has sudo privillege.

2.Change permission of the script as only user and group will be permitted to execute the script.

Example:

chmod u+rwx,g+rx,o-x path/to/the/script

3.Add the non-sudo user to the current user group:

sudo usermod -g $USER non_sudo_user_name
#you don't need to edit $USER, only non_sudo_user_name

4.Do a new login in the non sudo user account.

Now you can execute the script by running:

/path/to/the/script

Note: If your script depends on relative path, then you might need to cd to the parent directory of the script before running it.

Jahid
  • 21,542
  • 10
  • 90
  • 108
  • Thank you very much for your answer. Unfortunately it didn't work. – Yanik Apr 30 '15 at 14:01
  • are you passing tux as the user or other? if other it won't work. – Jahid Apr 30 '15 at 14:04
  • If you have a group that have permission to run tux's script, you can use that group to run the script. – Jahid Apr 30 '15 at 14:09
  • Thank you again, but it still did not work as I like it to. It works when I am logged in as an user with root rights. I'd like to execute the other users script without sudo, by passing a password. If this is even possible. – Yanik May 05 '15 at 11:33
  • If your user can't use sudo, then I don't think there's any way you could provide password and execute that script. The only way I know of is to give permission to execute the script explicitly. You can simply add the sudo user to non sudo user as a group. In that way you will be able t o execute the script withou sudo and without passwords – Jahid May 05 '15 at 14:13
  • @th1nk, edited and given a detailed process of executing it without password but with enough security margin. hope it helps you... – Jahid May 05 '15 at 15:46
  • Good Sir, thank you very much. It's still not what I am looking for but it would probably be a workaround for others. I don't have the possiblity to change the rights or the ownership of the script. – Yanik May 06 '15 at 13:31
1

You can add your user tux to /etc/sudoers with NOPASSWD to allow it to run sudo without password prompt.

E.g. add this to the end of /etc/sudoers to allow elevated execution of any command without password (note, there's a special tool for that - visudo):

tux    ALL=(ALL) NOPASSWD:  ALL

Or, a more restricted way - only allow this for your script:

tux    ALL = NOPASSWD: /opt/tomcat/bin/shutdown.sh

After that check that the changes are in effect by running any command from terminal, e.g.:

sudo id

and it should not prompt for root password.

UPDATE:

To make Apache run a script that belongs to another user (e.g. tux) add this line to sudoers:

www-data ALL=(ALL) NOPASSWD: /bin/bash /opt/tomcat/bin/shutdown.sh

Then you should be able to run it without password like so:

sudo -u tux /opt/tomcat/bin/shutdown.sh

Also, check these:

Community
  • 1
  • 1
dekkard
  • 6,121
  • 1
  • 16
  • 26
  • The idea is good, I didn't have it, thank you. But there are still some issues with it: If I give permission to execute everything this will lead to security issues. If I only allow to execute the script I have problems with dependencies. – Yanik May 05 '15 at 11:30
  • I'm not sure about the dependencies and I'd better run an experiment with just allowing ```shutdown.sh``` and see if any dependencies inherit its privileges. Unfortunately I don't have a shell with root access under my hands at the moment to test this. – dekkard May 05 '15 at 11:40
  • The problem is, that the shutdown-script, which shuts down the webserver, need to have access to the logfiles. They have been created before by the user who is owner of the script. I tried to allow access to these files, sadly no success. Best would be to really execute the script as tux by passing a password! – Yanik May 05 '15 at 11:46
  • When you run a command with sudo without specifying a user, you run it as root. Thus you should have access to everything. ```NOPASSWD``` simply disables the password prompt you usually get in this case. – dekkard May 05 '15 at 11:58
  • I think you got me wrong on this one. I want to be able to execute the script as a non-root user! Otherwhise things would be clear :) – Yanik May 05 '15 at 11:59
  • Thank you very much good Sir. It's a workaround that works in my case (the update). I am still trying to find a nice non-workaround-way for the job. This means to do a login and pass a password with the login. Sadly, it dosn't look like this will work with ssh or su. Sudo and sshpass are no options. If I don't find another way, of course, I'll accept your answer, since it is the closest I've gotten to what I asked for, so far. – Yanik May 06 '15 at 13:34