0

I have a server that I just installed apache on. I have a php script on the server that I would like to run a sudo command from. I've been scouring the web on why giving www-data sudo nopasswd access in the sudoers file is bad, but I don't actually understand why? If this is the only php script on the server, and the server's only purpose is to process this php script, is it still dangerous? If so, how else should I do it. I can't figure it out. I'm running a python script that will use os.system() to execute a sudo command and that is why I want to give it access. Another thing I noticed is that when I direct it to just the folder with my python script, it doesn't work. When I direct it to ALL, it does. I'm not sure what to do. Thanks.

  • 1
    Your website runs as www-data user. That means if some random guy on the web manages to hack your website, they directly have root access to your server! Kittens painfully died the moment you even thought of this! :( – Byte Commander Jul 20 '16 at 23:05
2

Under no circumstances permit your web server to run commands with sudo. Not even hyper-specific commands.

This is a huge security risk. A web server should not be given permissions to access sudo commands, which then permit root access for commands. Especially when given nopasswd form of sudo, should your web server be breached, any command run by a malicious threat actor can be run as root with god permissions, so your entire system is at reach for data theft, data deletion, corruption, and damage to the OS.

Many web applications are not written in a secure method, and if your Apache installation gets breached, you will not be able to protect yourself from scripts and malicious threat actors from running any arbitrary command.

If you must give the web server permission to run something as root, you're very much doing something wrong, and should re-evaluate what you're trying to do. Given that your question states nothing about what exactly you are trying to achieve or what exactly your script is doing, the only advice I can give as a systems adminsitrator and security person is do not attempt to give the web server sudo access.

  • Thanks Thomas, I appreciate the answer. So what I'm trying to do is take in a search query and download the first youtube video that comes up with that search query. So php takes it in through the url, then a python script is executed with the search query as an arg, then it searches and finds the url of the youtube video, and uses youtube-dl to download it to the server. So for example if I was searching for how to cook chicken for example, I'd type: – WebNinja Jul 21 '16 at 1:28
  • 12.34.567.890/search.php?searchQuery=how%20to%20make%20chicken then the script would do: python search.py "how to make chicken" then that would find the url and use os.system() to exec: sudo youtube-dl "youtube.com/whereeverthevideois" – WebNinja Jul 21 '16 at 1:30
  • but I need sudo to use youtube-dl and I can't think of how else to do it. Thanks again for the explanation though! – WebNinja Jul 21 '16 at 1:32
  • 1
    @WebNinja Why do you even need sudo for youtube-dl? The only reason you would need sudo for youtube-dl is if you're trying to write to a folder that www-data can't write to. The solution is to create a folder that the unprivileged www-data user (and web server) can read and write to, where it can execute youtube-dl and then try and download the data. That said, youtube-dl is not designed to be used for this case, so if the application itself won't work without sudo here, that's a problem in that application's actual use case and your target use case being in conflict. – Thomas Ward Jul 21 '16 at 2:31
1

The principle behind the www-data user is that it is an unprivileged user.

When you run a daemon (background program like a web server), for security purposes it is good for it to drop privileges after starting, so that it spends the rest of its time with the lowest privileges possible.

In the past the nobody account was often used for this purpose. The benefit of that was that the name "nobody" made it clear that this was supposed to be an unprivileged account, with no rights.

However, exceptions to the rule would occasionally come up, whereby somebody will need a daemon to have write permission here or there. Modifying the nobody account would affect all daemons.

So www-data was born as a way to have a mostly unprivileged user for web servers only, but isolated from other daemons or purposes, so if you did have to give that user account some additional privileges, it would only affect the web server and not reduce the security of other system daemons.

The idea that www-data should be an unprivileged user is still important. The more privileges you give it, the more concern you need to have over what might happen if the daemon (or any of the scripts or commands it runs) is compromised or exposes a security hole of any kind.

Giving www-data some sudo access is the antithesis of this principle. While it is possible to be selective with sudo access, it still opens up a fairly large security risk due to the potential for human error, or the potential that the web server or any scripts it runs may have security holes.

How can you avoid it?

  • Is there any way you can design the task so it doesn't need superuser privileges?
  • If not, does the task really need to be run by a script made available on the web server? It would be more secure if it was run by something not public facing, like Cron - or run manually over, say, SSH.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.