Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

So I am trying to execute sudo commands via cgi-bin perl scripts. I want to give sudo access to the apache user for a small subset of commands. Someone before me may have set the requiretty flag. Things like cron and cgi-bin scripts do not get a tty session, so currently if i try to sudo in my script, it tells me about the flag. Also, the apache user will sudo without a password.

My question to you all is, what are the security implications if I were to disable this flag and continue writing my script?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

If your script was prone to any sort of injection, all commands entered by a malicious user would be run as root. I don't think it gets any more dangerous than that :)

I ran into this same issue a while ago. I ended up having user jobs submitted into a "queue folder", which was processed by a script I ran through a crontab every few minutes. The files in the queue were parsed by my scripts with regular expressions and any files which contained invalid characters (eg. .*<-_>![]{}()\|/;) were discarded and the user was notified to resubmit.

share|improve this answer
    
but wouldn't I be specifying what commands apache can run? Cmnd_Alias APACHECMDS = /bin/touch,/bin/ls,/usr/bin/id,/usr/bin/python,/bin/env apache ALL=NOPASSWD:APACHECMDS –  Phil Aug 26 '10 at 2:20
    
Yes and apache can run python. os.remove(), anyone? –  John T Aug 26 '10 at 2:50

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.