2

I want to be able to shutdown my server remotely by clicking on a button on a web page. The server runs Ubuntu 14.04.1 64 Bit and a python web application. I have not decided which yet, but it will be either Apache or Gunicorn.

I need to be able to shut the server down remotely since I won't always have physical access to the machine. I'd rather not have to log in via ssh and execute a poweroff command for that, so I want to have a kind of button in the browser to initiate shutdown.

My ideas are something like

  • create a shutdown program make root owner and set the sticky bit. The python web application can call that
  • somehow, using the sudoers file
  • having the webapp write to a file and monitor that (inotify) to send the shutdown command

What are the best practices, or at least the most secure ways I can do this?

Of course, the web interface will be secured and there will also be a mechanism to protect against clicking by accident.

6
  • You have come up with a way to do it, and "best practice" is dependent on the situation and risk tolerance. If you are comfortable it is protected well enough, then it is good enough. Anything else is opinion. – Paul Oct 21 '14 at 0:44
  • What's the operating system? You're using bash, so Linux? OSX? BSD? I'd agrue controlling OS-level stuff from a webui is never a best or secure practice, but that's not to say I wouldn't ever do it. You'll have to weigh the risks and try to mitigate them. You may have to find a completely different approach. – James T Snell Oct 21 '14 at 0:46
  • Thanks for the responses. I added the OS - forgot that. I also find a solution to store a file and poll it from roots crontab, but polling means to wait and cpu load. I didn't ask should I do that... I try to figure what do you think are the best trade-off solutions of usability and security... – wenzul Oct 21 '14 at 0:51
  • 1
    If you can place a text file and have that trigger the shutdown, then you could use inotify to avoid polling – Paul Oct 21 '14 at 1:31
  • @Paul That would be an idea. So thats one solution. Are there anything else I could do? I still favour the script with setuid. – wenzul Oct 21 '14 at 11:13
7

There's no reason to write a script for this, you can do it through python. In any case, you can't set the SUID bit for scripts on Linux.

The simplest way would be for you to run the shutdown command from within your python script and then give the webserver's user the right to run it.

  1. Give the user your webserver runs as the right to execute shutdown. Run visudo and add this line to the file:

    www-data ALL=NOPASSWD:/sbin/shutdown
    

    I am assuming your server runs as user www-data, if not, change appropriately.

  2. Write a little script that runs the shutdown command and save it in one of your cgi-bin directories:

    #!/usr/bin/env python
    import os;
    os.system("sudo shutdown -h now");
    
  3. Make the script executable with

    sudo chmod 755 /var/www/yourpage/cgi-bin/shutdown.py
    
  4. Make a webpage that gives you a button that will run that script:

    <HTML>
     <BODY>
        <FORM method="post" action="cgi-bin/shutdown.py"> 
            <INPUT TYPE="submit" VALUE="Submit" NAME="Submit"> 
        </FORM>
     </BODY>
    </HTML>
    

That's it, you now have a button that will shutdown your server.


A note on security

I have no idea why you would want to set up a web interface for this. This is, obviously, very unsafe. Anyone who has access to that page will be able to shutdown the computer. However, there's no way around that, whatever you do, you are going to have a webpage that can shutdown your machine which means that anyone who can see the page can do so. So, be careful.

A much better alternative would be to run something like this from another machine:

ssh root@server shutdown -h now

That's a single command and, assuming you are on a Linux system, you can even create a one-word alias for it. If you're using bash, just add this line to your ~/.bashrc:

alias shtdn='ssh root@server shutdown -h now'

That way, all you need to do is run shtdn and you can safely and securely shut down the remote machine.


If you really insist on being able to do this via a web interface, I suggest you try something like webmin. It is a full featured, web-based server administration suite. It is free and open source, very easy to install and offers an intuitive GUI for many different aspects of your computer. You can use it to configure SAMBA shares, webservers, databases etc. You can also use it to shut down your system.

On Debian-based systems, you can install it by simply running

sudo apt-get install webmin

Once you have done so, go to http://localhost:10000 and log in as root. You may have to first activate the root account by running sudo passwd. Then, go to System -> Bootup and Shutdown, scroll to the end of the page and click on the "Shutdown" button:

enter image description here

This is very easy to set up and is likely to be more secure than any ad hoc solution you implement.

3
  • Thanks for the detailed answer with examples. I still have a bad feeling to implement this and give it away to users. What will another programmer think about this solution at last? :) I will think about it - and may create simple shortcuts with putty. The only requirement for the user is that he needs the ssh key or password for login and port 22 to be accessible too. – wenzul Oct 21 '14 at 23:39
  • 1
    @wenzul see the update, if you really want to do this via a web server, use one of the existing ones. Webmin will be much more secure and has all sorts of cool features. – terdon Oct 22 '14 at 0:02
  • I just read the name and never followed it. Now I will have a look. Thanks, already installed. I read that Ubuntu wiki disadvises the usage, but I think it's better than an own implementation anyway... the package is already removed from the official repositories – wenzul Oct 22 '14 at 0:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.