Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I am trying to execute sudo commands via cgi-bin perl scripts. I want to give sudo access to the apache user for a small subset of commands. Someone before me may have set the requiretty flag. Things like cron and cgi-bin scripts do not get a tty session, so currently if i try to sudo in my script, it tells me about the flag. Also, the apache user will sudo without a password.

My question to you all is, what are the security implications if I were to disable this flag and continue writing my script?

share|improve this question
up vote 2 down vote accepted

If your script was prone to any sort of injection, all commands entered by a malicious user would be run as root. I don't think it gets any more dangerous than that :)

I ran into this same issue a while ago. I ended up having user jobs submitted into a "queue folder", which was processed by a script I ran through a crontab every few minutes. The files in the queue were parsed by my scripts with regular expressions and any files which contained invalid characters (eg. .*<-_>![]{}()\|/;) were discarded and the user was notified to resubmit.

share|improve this answer
but wouldn't I be specifying what commands apache can run? Cmnd_Alias APACHECMDS = /bin/touch,/bin/ls,/usr/bin/id,/usr/bin/python,/bin/env apache ALL=NOPASSWD:APACHECMDS – Phil Aug 26 '10 at 2:20
Yes and apache can run python. os.remove(), anyone? – John T Aug 26 '10 at 2:50
not only that, but python can create arbitrary subprocesses. – Brian Minton Aug 13 '15 at 20:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.