I have a server that I just installed apache on. I have a php script on the server that I would like to run a sudo command from. I've been scouring the web on why giving www-data sudo nopasswd access in the sudoers file is bad, but I don't actually understand why? If this is the only php script on the server, and the server's only purpose is to process this php script, is it still dangerous? If so, how else should I do it. I can't figure it out. I'm running a python script that will use os.system() to execute a sudo command and that is why I want to give it access. Another thing I noticed is that when I direct it to just the folder with my python script, it doesn't work. When I direct it to ALL, it does. I'm not sure what to do. Thanks.
2 Answers
Under no circumstances permit your web server to run commands with sudo
. Not even hyper-specific commands.
This is a huge security risk. A web server should not be given permissions to access sudo
commands, which then permit root access for commands. Especially when given nopasswd
form of sudo
, should your web server be breached, any command run by a malicious threat actor can be run as root
with god permissions, so your entire system is at reach for data theft, data deletion, corruption, and damage to the OS.
Many web applications are not written in a secure method, and if your Apache installation gets breached, you will not be able to protect yourself from scripts and malicious threat actors from running any arbitrary command.
If you must give the web server permission to run something as root, you're very much doing something wrong, and should re-evaluate what you're trying to do. Given that your question states nothing about what exactly you are trying to achieve or what exactly your script is doing, the only advice I can give as a systems adminsitrator and security person is do not attempt to give the web server sudo
access.
-
Thanks Thomas, I appreciate the answer. So what I'm trying to do is take in a search query and download the first youtube video that comes up with that search query. So php takes it in through the url, then a python script is executed with the search query as an arg, then it searches and finds the url of the youtube video, and uses youtube-dl to download it to the server. So for example if I was searching for how to cook chicken for example, I'd type:– WebNinjaJul 21, 2016 at 1:28
-
12.34.567.890/search.php?searchQuery=how%20to%20make%20chicken then the script would do: python search.py "how to make chicken" then that would find the url and use os.system() to exec: sudo youtube-dl "youtube.com/whereeverthevideois"– WebNinjaJul 21, 2016 at 1:30
-
but I need sudo to use youtube-dl and I can't think of how else to do it. Thanks again for the explanation though!– WebNinjaJul 21, 2016 at 1:32
-
1@WebNinja Why do you even need
sudo
foryoutube-dl
? The only reason you would needsudo
foryoutube-dl
is if you're trying to write to a folder thatwww-data
can't write to. The solution is to create a folder that the unprivilegedwww-data
user (and web server) can read and write to, where it can executeyoutube-dl
and then try and download the data. That said,youtube-dl
is not designed to be used for this case, so if the application itself won't work withoutsudo
here, that's a problem in that application's actual use case and your target use case being in conflict.– Thomas Ward ♦Jul 21, 2016 at 2:31
The principle behind the www-data
user is that it is an unprivileged user.
When you run a daemon (background program like a web server), for security purposes it is good for it to drop privileges after starting, so that it spends the rest of its time with the lowest privileges possible.
In the past the nobody
account was often used for this purpose. The benefit of that was that the name "nobody" made it clear that this was supposed to be an unprivileged account, with no rights.
However, exceptions to the rule would occasionally come up, whereby somebody will need a daemon to have write permission here or there. Modifying the nobody
account would affect all daemons.
So www-data
was born as a way to have a mostly unprivileged user for web servers only, but isolated from other daemons or purposes, so if you did have to give that user account some additional privileges, it would only affect the web server and not reduce the security of other system daemons.
The idea that www-data
should be an unprivileged user is still important. The more privileges you give it, the more concern you need to have over what might happen if the daemon (or any of the scripts or commands it runs) is compromised or exposes a security hole of any kind.
Giving www-data
some sudo
access is the antithesis of this principle. While it is possible to be selective with sudo access, it still opens up a fairly large security risk due to the potential for human error, or the potential that the web server or any scripts it runs may have security holes.
How can you avoid it?
- Is there any way you can design the task so it doesn't need superuser privileges?
- If not, does the task really need to be run by a script made available on the web server? It would be more secure if it was run by something not public facing, like Cron - or run manually over, say, SSH.