-4

Ok I need to run my Apache web server as root. For this I typed echo whoami; in terminal. It gives me output: root. But when I check my apache server running as a root user or not by executing following php-script:

< ?php echo `whoami`;  ?>

It gives me output: nobody. So any suggestions to execute/login as a root user in apache??

  • 7
    I have never seen a user case where apache needs to run as root. by default, on Ubuntu, apache runs as www-data. What are you trying to do exactly ? There is almost certainly a better solution then running apache or php scripts as root. – Panther Mar 26 '12 at 14:08
  • 4
    Can you provide the reason for using Apache as root? I mean what problem could there be with Apache that you need to run it as root to solve it? – Luis Alvarado Mar 26 '12 at 14:28
  • Do you need to access to any folder that has only rights for root? – user42375 Mar 26 '12 at 14:29
  • I am working on xen virtualization.I am using LIBVIRT-PHP to talk with hypervisor to start create destroy etc etc. For this I used this php-script: <?php $conn=libvirt_connect("xen:///"); $name=libvirt_domain_lookup_by_id($conn,3); $dest=libvirt_domain_destroy($name); echo $dest; ?> When I execute this it shows me: Warning: libvirt_domain_destroy() [function.libvirt-domain-destroy]: operation virDomainDestroy forbidden for read only access in /opt/lampp/htdocs/xampp/shutdown.php on line 5 – Alee Mar 26 '12 at 14:49
  • 1
    "Ok I need to run my Apache web server as root." No you do not. – Rinzwind Apr 19 '12 at 14:43
6

What you are asking is very dangerous because any new vulnerabilities found in Apache can be exploited as root. One of the first things web masters do when securing their web server is to not run the server application as root. That said, I offer the following alternative that should meet the need as you have stated it.

  1. Create a shell script that does what you want. This is not a PHP script as PHP is run within the web server, you need a script that is run by Ubuntu. Here is a sample:

    #!/bin/sh
    # script that runs as root
    whoami
    

    I called this file /localstore/root.sh and you should place it somewhere that makes sense on your systems (e. g. /home/www_data/bin).

  2. In a terminal window, execute the command sudo vi /etc/sudoers and insert the following line at the end of the file (important to be at end so the other commands do not override):

    ALL ALL=NOPASSWD: /localstore/root.sh
    

    That will allow anyone to run the script as root, once you test and confirm it work, I strongly recommend (again for security purposes) that you change the line to

    nobody ALL=NOPASSWD: /localstore/root.sh
    

    but as Bodhi observed, Apache should run as www-data in which case you should change nobody to www-data. NOTE: I have never tried sudo with nobody as the user and am not sure that will work.

  3. In your Web server script, have the shell script run in PHP as follows:

    < ?php
    exec ("sudo /localstore/root.sh");
    ?>
    

    You can add parameters to the script inside the quotes.

    That should get it so the root.sh script executes as root when invoked from your web server. If you have other scripts, they can be a comma separated list on that same entry in the sudoers file. Make sure the permissions on the script allow execution by the web server.

| improve this answer | |
  • This is the proper way to execute commands as root using PHP, which is risky enough as it is. – Marco Ceppi Apr 19 '12 at 15:12
  • This is as close as it gets to "correct" unless you go the full route of setting up an application-specific daemon. – Kristopher Ives Dec 29 '16 at 13:16
  • @KristopherIves Hi can you give some information about what you mean by applications-specific daemon or point me good link to read ? thanks – charith Oct 5 '18 at 7:24
0

I wonder whether the requirement is because of running in a virtual environment with the Virtual Web Server using the shared directory in which case the directory ownership will be root so that it can be accessed by both the host and guest file systems. The solution may be to add the www-data group to the vboxfs group or whatever is the case in your environment. This is discussed in more detail in This Article

In my situation I was also confounded by the requirement to include an option in my virtual host configuration - specifically adding the

Require all granted

within my directory configuration as described in this article

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.