Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I am trying to execute sudo commands via cgi-bin perl scripts. I want to give sudo access to the apache user for a small subset of commands. Someone before me may have set the requiretty flag. Things like cron and cgi-bin scripts do not get a tty session, so currently if i try to sudo in my script, it tells me about the flag. Also, the apache user will sudo without a password.

My question to you all is, what are the security implications if I were to disable this flag and continue writing my script?

share|improve this question
up vote 2 down vote accepted

If your script was prone to any sort of injection, all commands entered by a malicious user would be run as root. I don't think it gets any more dangerous than that :)

I ran into this same issue a while ago. I ended up having user jobs submitted into a "queue folder", which was processed by a script I ran through a crontab every few minutes. The files in the queue were parsed by my scripts with regular expressions and any files which contained invalid characters (eg. .*<-_>![]{}()\|/;) were discarded and the user was notified to resubmit.

share|improve this answer
    
but wouldn't I be specifying what commands apache can run? Cmnd_Alias APACHECMDS = /bin/touch,/bin/ls,/usr/bin/id,/usr/bin/python,/bin/env apache ALL=NOPASSWD:APACHECMDS – Phil Aug 26 '10 at 2:20
    
Yes and apache can run python. os.remove(), anyone? – John T Aug 26 '10 at 2:50
    
not only that, but python can create arbitrary subprocesses. – Brian Minton Aug 13 '15 at 20:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .