1

So I am trying to execute sudo commands via cgi-bin perl scripts. I want to give sudo access to the apache user for a small subset of commands. Someone before me may have set the requiretty flag. Things like cron and cgi-bin scripts do not get a tty session, so currently if i try to sudo in my script, it tells me about the flag. Also, the apache user will sudo without a password.

My question to you all is, what are the security implications if I were to disable this flag and continue writing my script?

Improve this question

1 Answer 1

Reset to default
2

If your script was prone to any sort of injection, all commands entered by a malicious user would be run as root. I don't think it gets any more dangerous than that :)

I ran into this same issue a while ago. I ended up having user jobs submitted into a "queue folder", which was processed by a script I ran through a crontab every few minutes. The files in the queue were parsed by my scripts with regular expressions and any files which contained invalid characters (eg. .*<-_>![]{}()\|/;) were discarded and the user was notified to resubmit.

Improve this answer
5
  • but wouldn't I be specifying what commands apache can run? Cmnd_Alias APACHECMDS = /bin/touch,/bin/ls,/usr/bin/id,/usr/bin/python,/bin/env apache ALL=NOPASSWD:APACHECMDS
    – Phil
    Aug 26, 2010 at 2:20
  • Yes and apache can run python. os.remove(), anyone?
    – John T
    Aug 26, 2010 at 2:50
  • not only that, but python can create arbitrary subprocesses.
    – Brian Minton
    Aug 13, 2015 at 20:13
  • 1
    Downvoted because the question is specifically about the "require TTY" boolean setting that sudo can enforce, while this answer is just about the security ramifications of running untrusted input as scripts through sudo in general.
    – mtraceur
    Dec 15, 2017 at 1:14
  • 1
    Okay to be fair, I can see the connection between requiretty and this answer, but logically, if you start with the premise that you have to use sudo, having requiretty on just forces the programmer to programmatically do PTY creation (which is annoying but trivial from most programming languages) in their scripts, and which point they've create a more complex but feature-equivalent situation to just turning off requiretty, and this answer doesn't address what the difference between those two alternatives is.
    – mtraceur
    Dec 15, 2017 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.